Mullak — Privacy Policy

Last updated: 3 September 2026

This Privacy Policy explains how Mullak (“we”, “us”, “our”) collects, uses, discloses, and protects your information when you use the Mullak mobile application (the “App”), a marketplace that connects property buyers and renters directly with owners. By using the App you agree to this Policy.

1. Information We Collect

• Account information. Your name and email address when you create an account (via email/password, Sign in with Google, or Sign in with Apple). With Sign in with Apple you may choose to hide your email via Apple’s private relay.
• Phone number. Collected to verify your account via a one-time password (OTP).
• Identity verification data. To confirm you are a genuine, present person, we capture a short live selfie. We do not ask for, or collect, any government-ID document — no national ID, passport or driving licence, and no data read from one. See “Biometric and Face Data” below.
• Listing and content data. Property details, photos, unit layouts, and documents you upload when listing or inquiring about a property. If you choose our optional photo-enhancement feature, the photo you select is sent to a third-party image model (Google Gemini) to produce an improved version.
• Communications. Messages and voice calls you exchange with other users through the App. Voice calls may be recorded to support safety and our anti-broker policy; you are notified in-app that a call may be recorded. If a call is reported, its recording is transcribed and reviewed automatically by a third-party provider (OpenAI) so we can detect broker behaviour.
• Payment data. When you pay to publish a listing or to enhance a photo, the payment is handled by our payment provider (Paymob). Your card details are entered on Paymob’s own page, under their certification — we never receive or store your card number, expiry or CVV. We keep a record of what you bought, when, and whether it succeeded.
• Location. Approximate/area location you provide or select to search and filter property listings. We do not collect or track your device’s GPS location, and we do not use location for advertising.
• Device and technical data. A push-notification token and basic technical information needed to operate the App (e.g. to deliver messages and call notifications).
• App usage and session recordings. In our published app we record how the App is used, through Microsoft Clarity. This includes a replay of the screens you view and the taps you make, and it is linked to your account. We use it only to find where the App is confusing or broken. See “Session Recording” below for what is excluded.

2. How We Use Your Information

• To create and secure your account and authenticate you.
• To verify your identity and phone number, and to prevent fraud and abuse.
• To publish your listings and enable messaging, connection requests, and calls between users.
• To send you notifications related to your activity (e.g. new messages, connection requests, calls).
• To operate, maintain, secure, and improve the App.
• To comply with legal obligations.

We do not use your information for third-party advertising, we do not sell your information, and we do not track you across other companies’ apps or websites.

3. Biometric and Face Data

To confirm you are a real, present person, Mullak performs a liveness check during account verification. With your participation, we capture a short live selfie. This processing is performed on our behalf by Amazon Web Services (AWS Rekognition) as our data processor, in the AWS Europe (Ireland) region.

No identity document is involved. We do not ask for, receive or store a national ID, passport or any other identity document, and we do not read or retain any information from one.

We do not keep the selfie. The image is used in the moment — to confirm liveness and to check the face against the representations described below — and is then discarded. It is never written to storage and there is no copy of it to retrieve, export or delete afterwards.

What we do keep. To stop a user who has been rejected or banned from opening a new account and evading our broker and fraud controls, we generate and retain an irreversible numeric representation of your face (a mathematical template that cannot be reversed to reconstruct your face or produce an image of you). It is held in an access-controlled AWS Rekognition collection and used solely for fraud and duplicate-account prevention — never for advertising, profiling, tracking or personalisation, and never sold or shared with data brokers. It is deleted when you delete your account.

4. Session Recording

Our published app records how it is used, so we can see where people get stuck and where something is broken. This is provided by Microsoft Clarity, acting as our processor. A recording is linked to your account, so it is personal data, not anonymous statistics.

What a recording does not contain:

• Anything you type. The contents of text fields are never captured. A recording carries only how many characters were entered, never the characters themselves. This applies to every field in the App.
• Your credentials. Email, password, phone number and the one-time code are masked.
• Contracts and documents you upload or view.
• Your private conversations. Chats are hidden in full, because the other person in a conversation has agreed to nothing.

Recordings are not used for advertising or to build a profile of you, and we do not sell them. We tag a recording with your account number only, never your name, phone number or email address.

This recording runs only in the version of the App published on the app stores. Development and test builds record nothing.

5. How We Share Information

• With other users. Your listings and the profile/contact information necessary to transact (e.g. when you message or call another user) are shared with that user.
• With service providers (processors). We use trusted providers that process data on our behalf and under contract. They may process data only to provide their service to us:
  • Amazon Web Services — liveness checking (Rekognition), storage, email, and infrastructure.
  • SuperTokens — authentication.
  • Akedly, WhatsApp and Amazon SNS — delivering your one-time verification code. They receive your phone number for that purpose.
  • Paymob — taking payment for listings and photo enhancement. Your card details go to Paymob directly, not to us.
  • OpenAI — transcribing and analysing the recording of a reported call, so we can detect broker behaviour.
  • Google (Gemini) — producing an enhanced version of a listing photo, when you choose that optional feature.
  • Microsoft (Clarity) — recording how the App is used, as described in “Session Recording” above.
  • Apple Push Notification service and Firebase Cloud Messaging — delivering notifications.
• For legal reasons. Where required by law or to protect rights, safety, and security.

We do not sell your personal data and we do not share it with data brokers.

6. Data Retention

We keep your information for as long as your account is active or as needed to provide the App. The liveness selfie is never stored at all, so there is nothing to retain or delete. When you delete your account, we delete your personal data, retaining only the irreversible face representation described above for fraud prevention, and any records we are required to keep by law (for example, records of payments).

7. Your Choices and Rights

• Account deletion. You can permanently delete your account at any time from within the App at Settings → Account → Delete account. Deletion is permanent and removes your login and personal data. If you no longer have the App, or cannot sign in, you can request deletion here.
• Deleting some of your data, without closing your account. You can delete any listing you have posted, and its photos, from within the App at any time. For anything else, email us at the address below and we will delete what you ask us to, so far as we are able to while keeping your account working.
• Depending on your location, you may have rights to access, correct, or delete your personal data. Contact us using the details below to exercise them.

8. Security

We use access controls and encryption in transit to protect your data, and store sensitive verification data in private, access-controlled storage. No method of transmission or storage is completely secure, but we work to protect your information.

9. Children

The App is not directed to children and is intended for users who are of legal age to enter into property transactions. We do not knowingly collect data from children.

10. International Transfers

Your information may be processed in the European Union (AWS Europe — Ireland and Milan regions) and other locations where our service providers operate, with appropriate safeguards.

11. Changes to This Policy

We may update this Policy from time to time. We will revise the “Last updated” date above and, where appropriate, notify you in the App.

12. Contact Us

If you have any questions about this Policy or your data, including your face data or to exercise your privacy rights, contact us at mo@mullak-eg.com.