Privacy notice

Homeowners. Your name, email address, phone number if you give one, and the details of the projects you post — scope, community, property type, timeline and budget band, along with any photographs you upload.

Contractors. Company name and trading name, trade licence number and issuing authority, establishment year, VAT and TRN where applicable, office address, the communities and services you cover, a contact name, role, phone and WhatsApp number, and your portfolio. Separately, and held privately, your trade licence and liability insurance certificate, and identity and company registration documents.

Prospective contractors we have contacted. Business name, a published business email address or telephone number, the public source we found them in, and a record of what we sent and when. Never a personal email address.

To run the platform — performance of a contract. Creating your account, matching a project to contractors who cover that work and area, and letting you shortlist.

To verify contractors — legal obligation and legitimate interest. Checking licences, insurance and portfolios so the word “verified” means something. Data collected for verification is never used for marketing.

To contact contractor businesses — legitimate interest. See the outreach section below.

To send marketing — consent. Only if you have separately opted in. Accepting our terms is never consent to marketing, and consent is never bundled or pre-ticked.

⚖️ Under legal review. The lawful basis assigned to each purpose above, and whether contractor document verification is properly characterised as a legal obligation or as legitimate interest.

We contact contractor businesses in Dubai about joining the platform. If you received a message from us, this section explains it.

Where we got your details. From publicly published business contact information — company websites, public business directories, and public trade licence and contractor registers. We do not buy contact lists and we do not scrape personal email addresses.

Why this is not consent. We contact businesses on a legitimate-interest basis, not on consent. The interest is connecting Dubai homeowners with licensed, insured contractors, and the contact is business-to-business, to a published business address, about services that business already offers.

How to stop it. Every message we send carries a one-click opt-out that works without a login and without replying. You can also email privacy@constructive.ae and we will suppress the business immediately and permanently. Opt-out is irreversible on our side: once suppressed, our systems refuse to send to that contact even in error.

What we never do. We never send cold WhatsApp messages or cold SMS, and we never contact personal email addresses. We contact a business at most three times across all channels; after that it is suppressed automatically, whether or not anyone replied.

Your contact details are not shown to contractors until you shortlist them. Until then a contractor sees the project brief and its community, not who posted it.

Contractor licence, insurance and identity documents are held in private storage. They are visible to the contractor who uploaded them and to our verification administrators. They are never shown to homeowners and never published.

We do not sell personal data, and we do not share it with third parties for their own marketing.

Contractor documents are deleted twelve months after an account is closed.

Prospect records — the businesses we contacted — are reviewed annually and removed when they are no longer relevant. A suppression record is kept even after removal, because it is the only way to guarantee we do not contact you again.

Account and project data is kept while your account is open, and after closure only where we need it to substantiate a verification decision or to meet a legal obligation.

⚖️ Under legal review. Statutory minimum retention for verification records, and whether twelve months is sufficient to substantiate a disputed approval.

You can ask us for a copy of your data, for a machine-readable export of it, to correct it, to delete it, or to object to a particular use. Email privacy@constructive.ae and we will action it.

You do not have to ask us for a copy.If you have an account, Settings has a “Download my data” button that produces a machine-readable JSON file of everything we hold about you, immediately and without going through us. Contractor documents are listed in it rather than embedded — ask us if you need the original files.

Correction, deletion and objection open a request from the same screen. Those are worked by a person, because each one needs a judgement about what we are allowed to remove: a fee that was charged and an outreach record we are obliged to keep cannot simply be deleted, and we would rather tell you which records those are than quietly leave them in place. Every request is logged with the date it arrived, and we record what was actually done before it can be closed.

Your consent history is part of the export. Every time you agree to something or withdraw it, we write a new record rather than editing the old one, so the history shows what you agreed to and when — including what you later changed your mind about.

⚖️ Under legal review. The statutory response window under the applicable regime, and whether it must be stated here.

The platform runs on Supabase, which hosts on Amazon Web Services. Documents are held in private storage and are not publicly addressable.

⚖️ Under legal review. The cross-border transfer mechanism, and the hosting region, given the entity's free-zone status.

If personal data is exposed in a way likely to harm you, we will notify the UAE Data Office and the people affected within 72 hours of becoming aware of it, and tell you plainly what happened and what we are doing about it.

Cookies that are strictly necessary — signing in, security, and remembering your cookie choice itself — are set without asking, because the site cannot work without them.

Everything else is off until you turn it on. Analytics and marketing cookies are set only if you choose them, and nothing optional is loaded before you decide — the decision is read on our server before the page is built, so an optional script is never sent to you in the first place rather than being sent and then disabled.

Rejecting is one click, in the same place and the same size as accepting. You can change your mind at any time from “Cookie settings” in the footer of every page, and withdrawing is recorded the same way agreeing was.

See the cookie notice for the detail.

If this notice changes materially we will say so on the site rather than change it quietly. Nothing here is retrospective.