Privacy & Terms

Ayan is a mobile application operated by Yazdan Properties (United Arab Emirates) that helps UAE property owners block unwanted spam calls — in particular calls from unsolicited real-estate agents, telemarketers, and business cold-callers — and access an integrated mortgage calculator (powered by our sister service, Mortgage at mortgage.yazdanproperties.ae).

Blocking is performed by your phone's operating system (iOS Call Directory Extension / Android Call Screening Service) using a database of likely-spam numbers we maintain. Calls are rejected on-device before they ring. No call audio ever leaves your phone.

• Phone number (E.164 format) and a chosen display name — to identify your account.
• Password — stored as a bcrypt hash. We never see your plaintext password.
• UAE property-owner declaration — Ayan is restricted to UAE property owners; we record your self-declaration.
• Your property portfolio (optional, future feature): details about properties you own — address, type, size, ownership status. Collected for our upcoming broker-assistant feature (see §5). You can choose not to provide this and Ayan still works as a call blocker.
• Device push token (FCM) — to notify you about blocklist updates and (in future) broker-assistant alerts. Push payloads never contain personal data.
• Your personal whitelist — numbers you've chosen to allow through, stored on your device and a private mirror on our server so it survives reinstalls.
• Reports you submit — when you flag a number as spam, we record the number, your reason, and your account id. Your identity as a reporter is never shown to other users or to the reported party. We may be required to disclose report records to a competent authority or court where the law compels it — see §4.
• Blocked-call metadata (Android only) — the phone number, timestamp, and agency label of calls blocked on your device, used to populate your in-app "Recently blocked" list. iOS does not expose this and we do not collect it on iOS.
• Mortgage scenarios you save — handed off to Mortgage when you open the in-app Mortgage tab. Governed additionally by Mortgage's privacy notice.
• Operational logs — API request timestamp, hashed IP (rotating daily salt), user-agent, and HTTP status. Retained for 90 days for security and abuse-prevention.

Ayan exists to stop the volume of unsolicited marketing, business, and real-estate-agent calls UAE property owners receive daily. To do that, we maintain a database of phone numbers known to be used for unsolicited outreach. Numbers in the database are downloaded to your device, and the OS blocks calls from them at the system level.

Where the numbers come from:

• A baseline curated by Yazdan Properties from publicly observed activity.
• Reports from Ayan users — a number is added only when the community-verification threshold is met (independently reported by multiple distinct users over a defined period), never on a single report.
• Numbers that real-estate agents themselves provide when registering on Ayan as an agent (optional — agents who register are explicitly enrolling their business number for transparency).

What we share: the blocklist phone numbers (and an optional agency label) are distributed to Ayan users via their device's on-device blocklist file. Separately, where Ayan is a recognised regulatory reporting partner, numbers that have crossed the community-verification threshold may be reported — with the supporting corroboration metadata — to a competent UAE authority for enforcement, as described in §4. We never share these numbers with advertisers, data brokers, credit agencies, or marketing partners.

Legal basis (UAE PDPL): our legitimate interest in protecting Ayan users from nuisance and unsolicited commercial communications (balanced against the listed party's interests under §11); and, for any regulatory reporting, the additional bases set out in §4.

Ayan may seek, or be granted, recognition as a reporting partnerto a competent UAE authority responsible for regulating unsolicited commercial calls (for example the TDRA, which operates the Do Not Call Registry, or the Dubai Department of Economy & Tourism). This section explains how that works and what it means for your data.

4.1 What we would report. Only a phone number that has crossed our community-verification threshold — independently reported by multiple distinct users over a defined period — together with the corroboration metadata that evidences the pattern (for example the number, the count of distinct reporting users, and the timeframe). We report patterns of suspected systematic violation; we do not forward the free-text content of individual complaints.

4.2 We are a reporting partner, not a regulator. Ayan does not investigate, adjudicate, fine, or penalise anyone. Any enforcement decision, penalty, or sanction rests solely with the competent authority. Ayan supplies information; the authority decides and acts.

4.3 Your consent. We will only submit reports linked to your account where you have given explicit, informed opt-in consent for regulatory reporting. This consent is separate from, and additional to, your use of Ayan as a call blocker. You can withdraw it at any time in Settings → Privacy → Regulatory reporting; withdrawal stops future reporting linked to your account but cannot recall reports already lawfully made.

4.4 Reporter confidentiality. We do not reveal your identity as a reporter to other users or to the reported party. However, a competent authority or court may lawfully require us to disclose report records, including reporter identity, as part of an enforcement process. Where the law compels disclosure we will comply, and we will notify you where we are permitted to do so.

4.5 Lawful basis (UAE PDPL). Regulatory reporting relies on (a) your explicit consent under 4.3, and (b) compliance with a legal obligation and/or the performance of a task in the public interest of protecting UAE consumers from unlawful unsolicited communications.

4.6 Where the reporting data lives. Where required by the competent authority or applicable law, the dataset used for regulatory reporting may be stored on infrastructure located within the UAE, separately from the general data-residency arrangements in §7.

4.7 If you believe a number was wrongly reported. Reported parties may contest a listing under §11. Where a number is contested in good faith, we suspend further reporting of that number while we review.

In a forthcoming release, Ayan will offer a broker-assistant feature that uses the property portfolio you provide to:

• Analyse your current real-estate holdings;
• Suggest optimal timing for buy, rent, or sell decisions based on UAE market conditions;
• Notify you about market shifts relevant to the specific properties you own.

This feature will be opt-in. We will not use your property portfolio to generate any automated recommendations or marketing without your explicit consent at the time the feature launches. You can delete your portfolio at any time before or after activation.

• Call audio or recordings — none. Ever.
• SMS contents.
• Your contact list.
• Browsing history outside Ayan.
• Precise location (GPS).
• Photos, files, or other media.
• Payment information — Ayan does not process payments.

• Neon Postgres (EU region) — primary store for account, blocklist, whitelist, reports.
• Railway — application hosting for ayan-api.yazdanproperties.ae and mortgage.yazdanproperties.ae.
• Firebase Cloud Messaging (Google) — to deliver push notifications to your device.
• WhatsApp Business API provider (360Dialog) — to deliver one-time codes (used by the Mortgage cross-product flow).
• GoHighLevel — Yazdan Properties' CRM, only when you save a mortgage scenario or request broker follow-up.
• UAE-based store (conditional) — where a competent authority requires it, the regulatory-reporting dataset described in §4 is held on infrastructure within the UAE.
• Your device — local SQLite cache containing the blocklist, your whitelist, and (Android) the recently-blocked log, for offline operation.

• Active accounts: indefinitely while you use the service.
• Deleted accounts: 30-day soft-delete window, then permanent hard-delete.
• Operational and audit logs: 90 days.
• Blocklist numbers: retained while in active circulation, subject to removal under §11.
• Reports: retained for blocklist provenance after the reporter's account is deleted, anonymised — no link to the reporter remains. Exception: where a report has formed part of a regulatory submission, the underlying provenance record (including, where legally required, the link to the reporter) may be retained for as long as the competent authority requires for that enforcement matter, overriding the anonymisation rule for those specific records.

• Access: export everything we hold on you from Settings → Profile → Export my data.
• Erasure: delete your account in-app from Settings → Profile → Delete account. Soft-delete is immediate; hard-delete after 30 days. Some records may be retained beyond deletion where we are under a legal obligation or where they form part of an active enforcement matter (see §4 and §8).
• Rectification: edit your name and display details in-app.
• Objection / withdrawal of consent: opt out of the broker-assistant feature, and opt out of regulatory reporting (Settings → Privacy → Regulatory reporting), at any time.
• Restriction & Portability: request via the contact email below.

• TLS 1.3 in transit; HSTS preloaded on all production domains.
• Bcrypt password hashing; passwords never logged.
• Constant-time login comparison — no timing oracle.
• Rate-limited authentication endpoints.
• Parameterized SQL throughout; no string concatenation.
• Push payloads contain no personal data — only an opaque trigger.
• OWASP ASVS Level 2 baseline; review summary available on request.

If your number is in Ayan's blocklist, or you believe it has been reported to an authority in error, email privacy@yazdanproperties.ae with proof that you own or operate the number. We will:

• acknowledge your request within 3 business days;
• suspend further reporting of the number while we review (see §4.7);
• complete our review within 14 days and, if the listing is not justified, remove the number promptly.

Agents who register honestly through the Ayan agent portal (when available) are not blocklisted automatically.

Ayan is not intended for users under 18 years of age.

Some processors above (Firebase / Google, GoHighLevel, and our WhatsApp provider) operate globally and data may transit outside the UAE. We rely on standard contractual clauses or equivalent transfer mechanisms with each processor. Where §4.6 applies, the regulatory-reporting dataset is held in-UAE and is not subject to those transfers.

We may update this notice; the "Last updated" date at the top tracks revisions. Material changes will be surfaced via an in-app banner when you next open Ayan, and through the contact channel you registered with.

Where a change introduces a new purpose for your data — such as regulatory reporting — we will not rely on the in-app banner alone. We will ask you to actively re-consent before that new processing applies to you.

Privacy questions, complaints, or right-to-erasure requests: privacy@yazdanproperties.ae.

Ayan is operated by Yazdan Properties (United Arab Emirates). For UAE PDPL escalation contact the UAE Data Office.