Mullak Privacy Policy

Last updated: 14 October 2026

This Privacy Policy explains how Mullak (“we”, “us”, “our”) collects, uses, discloses, and protects your information when you use the Mullak mobile application (the “App”), a marketplace that connects property buyers and renters directly with owners. By using the App you agree to this Policy.

1. Information We Collect

• Account information. Your name and email address when you create an account (via email and password, Sign in with Google, or Sign in with Apple). With Sign in with Apple you may choose to hide your email via Apple’s private relay.
• Phone number. Collected to verify your account via a one-time password (OTP).
• Identity verification data. To confirm you are a genuine, present person, we capture a short live selfie. We do not ask for, or collect, any government ID document. That means no national ID, passport or driving licence, and no data read from one. See “Biometric and Face Data” below.
• Listing and content data. Property details, photos, unit layouts, and documents you upload when listing or inquiring about a property. If you choose our optional photo enhancement feature, the photo you select is sent to a third-party image model (Google Gemini) to produce an improved version.
• Communications. Messages and voice calls you exchange with other users through the App. Voice calls may be recorded to support safety and our anti-broker policy; you are notified in the App that a call may be recorded. If a call is reported, its recording is transcribed by a third-party provider (ElevenLabs or Google Gemini) and the transcript is reviewed automatically by another (OpenAI) so we can detect broker behaviour.
• Payment data. When you pay to publish a listing or to enhance a photo, the payment is handled by our payment provider (Paymob). Your card details are entered on Paymob’s own page, under their certification. We never receive or store your card number, expiry or CVV. We keep a record of what you bought, when, and whether it succeeded.
• Location. The approximate area location you provide or select to search and filter property listings. We do not collect or track your device’s GPS location, and we do not use location for advertising.
• Device and technical data. A push notification token and basic technical information needed to operate the App (for example, to deliver messages and call notifications).
• App usage and session recordings. In our published app we record how the App is used, through Microsoft Clarity. This includes a replay of the screens you view and the taps you make, and it is linked to your account. We use it only to find where the App is confusing or broken. See “Session Recording” below for what is excluded.
• App installs and opens, for measuring our ads. In our published app, Meta’s software development kit tells Meta when the App is installed and each time it is opened, so we can tell whether our ads on Facebook and Instagram lead to installs. On Android this uses your device’s advertising ID; on iPhone no advertising identifier is collected and the App never asks for permission to track you. Nothing else is sent: not your name, phone number, email or account, and nothing about your listings, searches, messages, calls or payments.

2. How We Use Your Information

• To create and secure your account and authenticate you.
• To verify your identity and phone number, and to prevent fraud and abuse.
• To publish your listings and enable messaging, connection requests, and calls between users.
• To send you notifications related to your activity (for example, new messages, connection requests, calls).
• To operate, maintain, secure, and improve the App.
• To comply with legal obligations.

We advertise Mullak on Facebook and Instagram, and we tell Meta when the App is installed and opened so we can measure whether those ads work (see “App installs and opens” above). Beyond that, we do not use your information for advertising, we do not sell your information, and we do not show you ads inside the App.

3. Biometric and Face Data

To confirm you are a real, present person, Mullak performs a liveness check during account verification. With your participation, we capture a short live selfie. This processing is performed on our behalf by Amazon Web Services (AWS Rekognition) as our data processor, in the AWS Europe (Ireland) region.

No identity document is involved. We do not ask for, receive or store a national ID, passport or any other identity document, and we do not read or retain any information from one.

We do not keep the selfie. The image is used in the moment, to confirm liveness and to check the face against the representations described below, and is then discarded. It is never written to storage and there is no copy of it to retrieve, export or delete afterwards.

What we do keep. To stop a user who has been rejected or banned from opening a new account and evading our broker and fraud controls, we generate and retain an irreversible numeric representation of your face (a mathematical template that cannot be reversed to reconstruct your face or produce an image of you). It is held in an access-controlled AWS Rekognition collection and used solely for fraud and duplicate account prevention. It is never used for advertising, profiling, tracking or personalisation, and never sold or shared with data brokers. It is kept after you delete your account, for the same reason: without it, a banned user could delete the account and open a new one. See “Data Retention” below.

4. Session Recording

Our published app records how it is used, so we can see where people get stuck and where something is broken. This is provided by Microsoft Clarity, acting as our processor. A recording is linked to your account, so it is personal data, not anonymous statistics.

What a recording does not contain:

• Anything you type. The contents of text fields are never captured. A recording carries only how many characters were entered, never the characters themselves. This applies to every field in the App.
• Your credentials. Email, password, phone number and the one-time code are masked.
• Contracts and documents you upload or view.
• Your private conversations. Chats are hidden in full, because the other person in a conversation has agreed to nothing.

Recordings are not used for advertising or to build a profile of you, and we do not sell them. We tag a recording with your account number only, never your name, phone number or email address.

This recording runs only in the version of the App published on the app stores. Development and test builds record nothing.

5. How We Share Information

• With other users. Your listings and the profile and contact information necessary to transact (for example, when you message or call another user) are shared with that user.
• With service providers (processors). We use trusted providers that process data on our behalf and under contract. They may process data only to provide their service to us:
  • Amazon Web Services: liveness checking (Rekognition), storage, email, and infrastructure.
  • SuperTokens: authentication.
  • Akedly, WhatsApp and Amazon SNS: delivering your one-time verification code. They receive your phone number for that purpose.
  • Paymob: taking payment for listings and photo enhancement. Your card details go to Paymob directly, not to us.
  • ElevenLabs: transcribing the recording of a reported call.
  • Google (Gemini): transcribing the recording of a reported call, and producing an enhanced version of a listing photo when you choose that optional feature.
  • OpenAI: analysing the transcript of a reported call, so we can detect broker behaviour.
  • Microsoft (Clarity): recording how the App is used, as described in “Session Recording” above.
  • PostHog: recording which screens and steps of the App you use (for example, how far you get when posting a listing), so we can see where people get stuck. These events carry your account number only, never your name, phone number or email address.
  • Meta Platforms: receiving the App’s install and open events, with your Android device’s advertising ID, so we can measure our Facebook and Instagram ads. Meta’s use of this data is also governed by its own privacy policy.
  • Apple Push Notification service and Firebase Cloud Messaging: delivering notifications.
• For legal reasons. Where required by law or to protect rights, safety, and security.

We do not sell your personal data and we do not share it with data brokers.

6. Data Retention

We keep your information for as long as your account is active or as needed to provide the App. The liveness selfie is never stored at all, so there is nothing to retain or delete.

When you delete your account, we delete at once: your login and every sign-in method on it; your name, profile photo, email address and phone number; every photo, video, floor plan and document you uploaded; the location, address and description of your listings; your saved listings, notifications and device registrations; and the recordings of your calls, unless a call was reported (see below). What remains cannot be used to identify you by name, phone number or email address.

What other people keep. Messages you sent stay visible to the people you sent them to, shown as from a deleted user, so they keep the details of a conversation they were part of. Reviews you wrote about others, and reports you made, stay with the person they are about. Nobody can message or call a deleted account.

What we keep, linked only to your account number. We keep a record of how the account was used: the searches, listings, connection requests and calls it made, the reviews and reports it received, the transcripts and results of calls that were reported, and what our checks and staff concluded about it. This record carries no name, phone number, email address or photo. We keep it to prevent fraud and to improve our detection of brokers, including training automated checks. It is never used for advertising and never sold.

What we keep for a limited time. The audio recording of a call that was reported is kept for 90 days after you delete your account, so staff can review it and the other person can raise a dispute, and is then deleted. Deleted data leaves our database backups within 35 days and, for files, our storage’s previous versions within 90 days.

If your account was marked as a broker, banned or flagged. We keep a one-way, keyed hash of your phone number and email address together with that mark. The number and address themselves are not kept. The hash lets us recognise the same number or address if it is used to open a new account, so a ban holds and a broker mark carries over. Checks we ran on a phone number (see “Phone number” above) are kept by the number, not the account, for the same reason.

Payments. Records of what you paid, when, and whether it succeeded are kept for as long as the law and our payment provider require. They carry no name, phone number or email address after deletion.

7. Your Choices and Rights

• Account deletion. You can permanently delete your account at any time from within the App at Settings, then Delete account. Deletion is immediate and permanent. It removes your login and personal data as described in “Data Retention” above. If you no longer have the App, or cannot sign in, you can request deletion here.
• Deleting some of your data, without closing your account. You can delete any listing you have posted, and its photos, from within the App at any time. For anything else, email us at the address below and we will delete what you ask us to, so far as we are able to while keeping your account working.
• Your advertising ID (Android). You can reset or delete your device’s advertising ID at any time in your phone’s settings, usually under Settings, then Privacy, then Ads, or under Settings, then Google, then Ads. Once it is deleted, the App still reports installs and opens, but without it.
• Depending on your location, you may have rights to access, correct, or delete your personal data. Contact us using the details below to exercise them.

8. Security

We use access controls and encryption in transit to protect your data, and store sensitive verification data in private, access-controlled storage. No method of transmission or storage is completely secure, but we work to protect your information.

9. Children

The App is not directed to children and is intended for users who are of legal age to enter into property transactions. We do not knowingly collect data from children.

10. International Transfers

Your information may be processed in the European Union (AWS Europe, in the Ireland and Milan regions) and other locations where our service providers operate, with appropriate safeguards.

11. Changes to This Policy

We may update this Policy from time to time. We will revise the “Last updated” date above and, where appropriate, notify you in the App.

12. Contact Us

If you have any questions about this Policy or your data, including your face data, or to exercise your privacy rights, contact us at mo@mullak-eg.com.