Privacy Policy

Bioot ("Bioot", "we", "us", or "our") operates a bilingual real-estate marketplace for the sale of property in the Arab Republic of Egypt, delivered through the Bioot mobile applications for buyers and for developer sales agents, and through the Bioot web dashboards. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it.

We process personal data in accordance with the Personal Data Protection Law No. 151 of 2020 of the Arab Republic of Egypt (the "PDPL") and its executive regulations. By creating an account or using Bioot, you acknowledge that you have read and understood this Policy.

The data controller responsible for your personal data is the entity that operates the Bioot platform. For any privacy question, to exercise your rights, or to contact our data protection point of contact, write to us at [email protected].

Where a developer company you interact with determines how your data is used for its own purposes (for example, managing you as a sales lead in its own records), that company acts as an independent controller for those activities and is responsible for its own handling of your data.

We collect the following categories of personal data, depending on how you use Bioot:

• Account and profile data — your name, the email address you register with, your role (buyer or developer sales agent), your preferred language, and, for developer accounts, your company name and company email address.
• Contact details — the phone number you choose to add to your profile. Bioot enables calls and messages inside the app, so you are not required to share your personal phone number with other users.
• Authentication data — for buyer accounts, a 4-digit PIN. Your PIN is never stored in readable form; it is kept only as a salted, one-way cryptographic hash used to verify sign-in, and it cannot be recovered by us or by anyone else. Developer accounts sign in with a password and a one-time verification code (OTP) sent to the company email.
• Location data — approximate or precise device location, collected only if you grant permission, and used to centre map search and show nearby listings. Location is optional; you can browse Bioot without it and can turn it off at any time in your device settings.
• Listings and content you provide — for developer accounts, the property listings you create (title, description, price, payment plan, area, images, and related details); for all users, favourites, saved searches, requests, and any content you submit.
• Messages and communications — the text messages, voice notes, images, shared listings, and other content you send or receive through in-app chat.
• Voice call data — call metadata such as who called whom, the time and duration of a call, and whether it was answered, missed, or declined; and, where call recording is enabled and lawful consent has been obtained, the recording and transcript of the call (see Section 6).
• Device and technical data — device type and operating system, app version, a device push-notification token used to deliver notifications, IP address, language and locale settings, and diagnostic or crash information.
• Usage data — how you interact with Bioot, such as searches you run, listings you view, and features you use, so we can operate and improve the service.
• Payment-related data — for developer subscriptions, the plan you select, invoices, payment method type (bank transfer or card/mobile wallet), and payment or proof-of-payment references. Full card or wallet credentials are handled by our payment partner and are not collected or stored by Bioot.

We do not intentionally collect special categories of personal data (such as data revealing health, religious or political beliefs, or biometric data). Please do not include such data in listings, messages, or calls.

We use personal data for the following purposes:

• To create and manage your account and authenticate your sign-in.
• To operate the marketplace: publish approved listings, run area and map search, and present property information.
• To connect buyers and developers through chat, voice calls, favourites, and requests.
• To power the AI advisor, which recommends only real, approved listings that exist on Bioot.
• To review, approve, or reject listings and to detect duplicate or fraudulent content, so that only verified developers and legitimate properties appear.
• To manage developer subscriptions, packages, limits, invoices, and payments.
• To send you service communications and notifications (for example, a new message, an incoming or missed call, a listing status change, or a payment update).
• To provide customer support and to investigate and resolve disputes, complaints, and safety or abuse reports.
• To keep Bioot secure, prevent fraud and misuse, and maintain the integrity of the platform.
• To comply with our legal obligations and to establish, exercise, or defend legal claims.
• To measure, maintain, and improve the performance, quality, and features of the service.

Under the PDPL, we process your personal data on one or more of the following legal bases:

• Your consent — for example, when you grant location access, or when you consent to a call being recorded. You may withdraw consent at any time, without affecting processing that already took place while your consent was valid.
• Performance of a contract — to provide the service you sign up for and to deliver the features you use.
• Compliance with a legal obligation — where the law requires us to process or retain certain data.
• Our legitimate interests — to keep the platform secure, prevent fraud and abuse, and improve the service, provided these interests are not overridden by your rights and freedoms.

Where processing relies on your consent, we ask for that consent clearly and separately, and we record it. You can manage many permissions (such as location and notifications) directly in your device or app settings.

Bioot lets buyers and developer sales agents speak through in-app voice calls ("Bioot Call"), without exposing personal phone numbers. For every call we process call metadata — the participants, the time, the duration, and the outcome (answered, missed, or declined) — to connect the call, show it in your history, and route missed calls to chat.

Where the call recording feature is enabled, a call MAY be recorded and transcribed for quality assurance, safety, fraud prevention, and the resolution of disputes. Recording only takes place where lawful consent has been obtained: because a call has two parties, both participants are notified and their consent is required before a call is recorded. If a participant does not consent, the call is not recorded. Where you are notified that a call may be recorded and you continue with the call, you are giving your consent to that recording.

Call recordings and transcripts, where they exist, are treated as confidential, are access-restricted, and are retained only for as long as needed for the purpose for which they were made or as required by law (see Section 11). You may ask us whether a recording of your call exists and request a copy or its deletion, subject to the limits described in Sections 12 and 11.

Your in-app messages are intended for you and the person or company you are communicating with. We do not read your private conversations to build advertising profiles, and we do not sell your messages.

Authorized Bioot staff may access the content of messages or calls only in specific, limited circumstances: to handle a support case you have raised, to investigate and resolve a dispute between a buyer and a developer, to investigate a report of abuse, fraud, or a safety risk, or to comply with a valid legal obligation or lawful request from a competent authority.

Such access is granted on a need-to-know basis, is limited to what is necessary for the specific case, and is logged and auditable — we keep an internal record of who accessed what content and why. We do not use this access for any purpose other than the case that justified it.

The AI advisor helps you find property by understanding what you describe and matching it to real, approved listings on Bioot. To do this, it processes the messages you send to it and your relevant search context. The advisor is informational only, never invents properties, and only ever recommends listings that actually exist on the platform.

To generate responses, your advisor messages may be processed by a specialised language- and speech-processing service acting strictly on our instructions and bound by confidentiality; this service is not permitted to use your data for its own purposes. The advisor does not provide financial, legal, investment, or tax advice.

We do not sell your personal data. We share it only as needed to run Bioot:

• With other users, as required by the service — for example, a developer sales agent you contact will see that you are an interested buyer and receive your messages and call requests; developers do not receive your PIN, password, or exact device location unless you choose to share it.
• With trusted service providers who process data on our behalf and under contract, only to deliver the service. These include providers of cloud hosting and storage, notification (push) delivery, in-app voice calling, language and speech processing for the advisor, payment processing, mapping, and analytics or crash diagnostics. Each provider is bound to use your data only for the service it provides to us.
• With competent authorities, regulators, or courts where we are legally required to do so, or to establish, exercise, or defend legal claims, or to protect the rights, safety, and property of our users, the public, or Bioot.
• In connection with a corporate transaction such as a merger, acquisition, or reorganisation, in which case any recipient will remain bound by protections consistent with this Policy.

We describe service providers by the function they perform rather than by name; the specific providers we use may change over time, and we require each of them to protect your data to a standard consistent with the PDPL.

Bioot primarily processes and stores personal data for the Egyptian market. Some of our service providers may process or store data outside the Arab Republic of Egypt. Where personal data is transferred outside Egypt, we do so only in accordance with the PDPL — including, where required, obtaining the necessary authorisation and ensuring the receiving country or party provides a level of protection no less than that required under Egyptian law, supported by appropriate contractual safeguards.

We keep personal data only for as long as necessary for the purposes described in this Policy, and then delete or anonymise it. In practice:

• Account and profile data is kept while your account is active and for a reasonable period after closure to handle disputes, meet legal obligations, and prevent fraud.
• Messages and call metadata are kept for the period needed to provide the service and to resolve any dispute or support case.
• Call recordings and transcripts, where made, are kept only for as long as needed for quality, safety, or dispute resolution, or as required by law, and then deleted.
• Payment, invoice, and subscription records are kept for the period required by applicable tax, accounting, and commercial-record laws.
• Technical logs and audit records (including records of staff access to content) are kept for a limited period to secure the platform and support investigations.

When you delete your account, we delete or anonymise your personal data unless we are required or permitted by law to keep specific records for longer.

Subject to the conditions and exceptions in the PDPL, you have the right to:

• Be informed about how your personal data is processed.
• Access the personal data we hold about you and obtain a copy of it.
• Correct, update, or complete inaccurate or incomplete data.
• Request deletion of your personal data ("right to be forgotten") where there is no lawful reason for us to keep it.
• Object to or restrict certain processing of your data.
• Withdraw a consent you previously gave, at any time, without affecting the lawfulness of processing before withdrawal.
• Request that we stop processing your data for direct marketing.

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before acting on a request, and we will respond within the period required by law. Exercising your rights is free of charge, except where the law permits a reasonable fee for excessive or repetitive requests.

Bioot is intended for adults and is not directed at children. We do not knowingly collect personal data from anyone under the age of majority in Egypt without the consent of a holder of parental responsibility, as required by the PDPL. If you believe a child has provided us with personal data, contact us at [email protected] and we will take appropriate steps to delete it.

We apply appropriate technical and organisational measures to protect personal data against loss, misuse, and unauthorised access, alteration, or disclosure. These include encryption of data in transit, one-way hashing of authentication secrets such as PINs and passwords, access controls on a need-to-know basis, audit logging of privileged access to content, and secure, access-restricted storage.

No method of transmission or storage is completely secure. If a personal-data breach occurs that is likely to cause you harm, we will notify the competent authority and affected individuals as required by the PDPL. Please keep your credentials confidential and notify us immediately if you suspect unauthorised use of your account.

On our web dashboards we use strictly necessary cookies and similar technologies to keep you signed in, remember your language preference, and keep the service secure. In our mobile apps we use local device storage for equivalent purposes.

We may use privacy-respecting analytics and crash-diagnostics tools to understand how the service is used and to fix problems. Where the law requires consent for non-essential analytics, we will ask for it, and you can decline without losing access to core features.

We may update this Privacy Policy from time to time to reflect changes in the service or in the law. When we make material changes, we will update the "last updated" date at the top of this page and, where appropriate, notify you in the app. The latest version always applies; please review it periodically.

If you have any question or concern about this Policy or about how we handle your personal data, contact us first at [email protected] so we can help.

You also have the right to lodge a complaint with the competent Egyptian data protection authority (the Personal Data Protection Center) if you believe your rights under the PDPL have been infringed.