Privacy Policy

NeighbourHub (www.neighbourhub.ae) is operated by Carnelian Technologies L.L.C-FZ, Meydan Free Zone, Dubai, UAE (licence no. 2415615.01) - the data controller for personal data processed on the Platform. We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"). NeighbourHub is an independent platform and is not affiliated with any developer, owners association, or community management company. Questions or requests: support@carnelian.tech.

• Account data: name, email address, password (stored only as a secure hash), account type (resident / vendor / shop), and your community.
• Profile data you choose to add: photo, bio, skills, tagline, your cluster (the area of the community you live in - never your villa or unit number), WhatsApp number, social links, portfolio items.
• Residency verification: the proof of residence you upload - for example a DEWA bill, a DAMAC Living app screenshot, or a photo showing you live in the community - see section 6 for its special handling.
• Content you create: posts, comments, likes, listings, events, RSVPs, reviews, offers, and photos you attach to them.
• Private messages you exchange with other members, including images.
• Billing data (paid vendor features only): if a vendor or business purchases a paid feature (not currently offered - this applies to any subscription from an earlier period), payment is handled by our payment processor - card details go directly to them and are never stored on our systems. We keep the subscription status and billing history.
• Home Help listings: the Home Help board is currently switched off - no new helper details or Emirates IDs are collected (see section 7).
• Technical data: session cookies (to keep you signed in), a cookie remembering which community you are browsing, and - if you tick "Remember me" - your email stored in your own browser. Our hosting provider and our usage analytics provider (servers in the European Union) collect privacy-friendly, cookie-free analytics (aggregate page views, feature usage, and performance - no cross-site tracking and no advertising profiles). We do not run advertising trackers. Section 14 lists every cookie we set and why.

Information we collect from other sources. To make the shops and restaurants directory useful from launch, we create some business listings ourselves from publicly available business information - for example public business directories - checked locally. For a business this may include the business name, its category, a short description, its location, and a publicly listed contact number. We do not create listings about individual residents in this way, we do not gather prices from residents, and service-provider (vendor) listings are only ever created by the businesses themselves. If you are a business (including an individual trading under your own name) and we hold a listing about you, you may claim it, correct it, or ask us to remove it entirely at any time by writing to support@carnelian.tech - we action removal requests without requiring a reason.

We do not ask residents for Emirates ID or passport numbers, unit or villa numbers, precise location, or sensitive personal data (health, religion, biometrics). While the Home Help board is switched off, no identity documents are collected anywhere on the Platform. Please also do not include health, religious, or other sensitive information in your profile, posts, or reviews - the Platform does not need it.

• to operate your account and the features you use (profiles, feed, marketplace, events, messaging, reviews, notifications) - necessary to provide the service you asked us for under our Terms of Use;
• to verify residency and display verification badges - necessary to provide the service; the document upload itself is processed with your consent;
• to process payments and manage subscriptions for paid vendor features - necessary to perform your subscription;
• to send service emails (confirmation, password reset) - necessary to provide the service;
• with your consent, to send occasional community news, digests, and offers by email - every such email includes an unsubscribe link, and you can opt out at any time without affecting your account;
• to keep the Platform safe: moderating reported content, preventing fraud and abuse, enforcing our Terms - necessary to protect the Platform and its users;
• to keep billing and tax records - legal obligation;
• for compiled business listings (section 2), we rely on the information having been made public by the business concerned and our need to operate a community directory - and the business can object or request removal at any time.

We keep a record of the consents you give - what you agreed to, which version, and when - so we can demonstrate them. We do not sell personal data, and we do not use it for third-party advertising.

• Public (including signed-out visitors): a limited preview of the community - listings, events, vendor/business pages, and a small selection of resident profiles (name, photo, skills, bio, and cluster - never your villa or unit number). Business contact details are public by design. Visitors only ever see a capped preview of profiles; the full directory is for signed-in members. You can remove your profile from the public preview at any time on your account page. Anything publicly visible may be indexed by search engines.
• Signed-in members of your community: the full directory, feed, marketplace, and events.
• Never shown to anyone: your email address and password. Your WhatsApp number is shown only where you have chosen to add it to content that displays it. Resident-to-resident contact happens through in-app messaging so personal contact details stay private.
• Private: your messages (participants only, subject to the next line) and your proof of residence (administrators only, during review).
• We do not read messages in the ordinary course, but we may access, preserve, or disclose message content and account information where we reasonably believe it is required by law or a competent authority, or to investigate abuse, fraud, or safety issues - as described in our Terms of Use.

Members of one community cannot browse another community's data.

We share personal data only with the service providers that run the Platform, acting on our instructions and bound by contractual data-protection obligations:

• a cloud database, authentication, and file storage provider (data hosted in Singapore);
• an application hosting and content delivery provider (which serves the Platform from edge locations worldwide and may temporarily cache content closer to the person viewing it);
• a usage analytics provider (cookieless, aggregate usage statistics only, data hosted in the European Union);
• a transactional email provider (for the emails described in section 3);
• a payment processor for paid vendor features (card details go directly to them and never touch our systems).

A current list of our processors is available on request at support@carnelian.tech. We may also disclose data where required by UAE law or a competent authority, to protect the rights and safety of users or the Company, or as part of a business reorganisation or sale (in which case this policy continues to apply).

• Used only to confirm that you live in the community. Any document that shows this is accepted - a DEWA bill (you may redact account and meter numbers before uploading), a DAMAC Living app screenshot, or a photo.
• Stored in a private, access-controlled area that only administrators can view, and only during review.
• Deleted automatically as soon as a decision is made - approved or rejected, the file does not remain on our systems (other than transiently in routine backups, which are themselves overwritten on a rolling basis).
• We keep a minimal record of the decision itself (date, document type, and outcome - never the document) so we can answer questions about it later.

The Home Help board is currently switched off. No new listings are being accepted and no new Emirates ID data is collected. Data from listings created while the board was open is still handled exactly as described below until it is deleted.

The Home Help board works differently from the rest of the Platform, because listings advertise a person for work and need a stronger check before they appear:

• A helper listing includes a photo of the helper's Emirates ID. An administrator checks it before the listing goes live.
• We record the ID's expiry date (used to lapse listings automatically) and a one-way cryptographic hash of the ID number, used only to detect duplicate or abusive listings. We do not keep the ID number itself.
• The ID photo is visible to administrators only - never to other users - and is used only to check the listing and prevent abuse. This check is not identity verification and does not confirm any person's right to work.
• When the listing is removed, the ID photo, the recorded hash, and the expiry date are all deleted, subject to the routine backup cycle described in section 10.
• If you submit a listing on a helper's behalf, you must have their permission to share their details and ID, and you should show them this policy.
• Helpers have rights of their own: a helper may contact us directly at support@carnelian.tech at any time to see what is held about them or to have their listing and ID removed - no account needed, and we act on these requests as a priority.

Posts, photos, reviews, and event pictures may include other people - a neighbour in a photo, a staff member named in a review. We process this data as part of hosting user content; the person who posts it is responsible for having the consent of anyone identifiable in it, as set out in our Terms of Use and Community Guidelines. If you appear in content on the Platform and want it removed, email support@carnelian.tech with a link - you do not need an account, and we treat removal requests involving identifiable people, especially children, as a priority.

Our infrastructure providers store data outside the UAE (primarily in Singapore, with content delivery served from edge locations worldwide as described in section 5). We rely on three protections together: your explicit consent, given when you create an account; the fact that the transfer is necessary to perform our agreement with you, since the Platform cannot be provided without it; and data-processing agreements with each provider requiring them to protect your data to standards equivalent to this policy. Our providers maintain industry-standard security certifications, and the same protections in this policy apply wherever the data is processed. You may withdraw the consent at any time by deleting your account.

• Account, profile, and content: for as long as your account exists. When you delete your account, your profile, posts, comments, likes, listings, and uploaded images are removed from our live systems immediately. Residual copies may persist in routine encrypted backups for a limited period (up to 30 days) before being overwritten; backups are not used for any other purpose.
• Messages: deleting your account removes your participation in conversations from live systems; the other participant may retain their own copy of messages you sent them, as with any messaging service.
• Content you delete individually (a post, comment, or listing) is removed from live systems immediately, subject to the same backup cycle.
• Verification proofs: deleted on decision (section 6). Home Help IDs: deleted with the listing (section 7).
• Billing records for paid features are kept for as long as UAE tax and accounting law requires.
• We may retain minimal records where the law requires it or to resolve disputes or enforce our Terms.

You may at any time:

• access and correct your data (self-service via your profile and account pages);
• delete your account and data (account page → delete account);
• withdraw consent to any processing, or object to it;
• request a copy of the data we hold about you, including in a structured, machine-readable format you can take elsewhere (portability);
• restrict processing of your data while a dispute about it (for example a moderation decision) is being resolved;
• object to automated processing: the Platform uses simple automation to order feeds, sort search results, and route reports for human review. No automated decision on the Platform has a legal or similarly significant effect on anyone - moderation and verification decisions are made by people. If you object to any automated processing of your data, contact us;
• complain to the UAE Data Office if you believe we have mishandled your data.

For anything not self-service, email support@carnelian.tech - we respond to verified requests within a reasonable period, and in any case within the time required by law.

We protect personal data using industry-standard technical and organisational measures, including encryption in transit, hashed password storage, strict access controls, least-privilege administration, and safeguards that keep private data private even against direct attempts to bypass the application. No system is perfectly secure; if a breach affecting your data occurs, we will notify the UAE Data Office and affected users as required by the PDPL.

The Platform is for adults (18+). We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will remove it. Children may appear in content posted by adults (for example event photos) - our Community Guidelines restrict this, and section 8 explains how to have such content removed.

NeighbourHub uses a small number of cookies to work properly. We do not use advertising cookies, we do not run third-party advertising or cross-site tracking, and we do not sell or share your data with advertisers.

• Sign-in cookies (essential) - set only after you sign in, these keep you signed in. They last until you sign out or the session expires.
• nh_seen (essential) - lets us record that you were active today without writing to the database on every page load. Signed-in users only, cannot be read by scripts, and expires after 1 hour.
• nh_lang (functional) - remembers whether you chose English or Arabic. Lasts 1 year.
• nh_active_community (functional) - remembers which community you are browsing. Lasts 1 year.
• Remembered email (functional) - if you tick "Remember me", your email is stored in your own browser so it fills in next time. This is browser storage, not a cookie, and it never reaches us.
• Page and usage analytics - our hosting provider counts page views and measures loading speed, and our usage analytics provider (servers in the European Union) measures aggregate feature usage. Neither sets cookies or browser storage, follows you across other websites, or builds a profile of you.
• Advertising and marketing - we set none.

Why you are not asked to accept cookies. The cookies above are either strictly necessary to sign you in and keep the Platform secure, or they simply remember a choice you made yourself. We set no advertising or cross-site tracking cookies, and our page analytics uses no cookies at all. A consent banner exists to gate non-essential tracking, and we do not do any, so there is nothing to gate. If that ever changes, we will ask for your consent first and update this policy.

How to refuse or remove cookies. You can delete cookies and block them in your browser settings at any time - Chrome, Safari, Firefox and Edge all offer these controls in their privacy settings. Blocking essential cookies will stop you from signing in. You can also leave "Remember me" unticked, and clear your browser storage to remove the remembered email.

Fonts and third parties. Our fonts are served from our own domain, so loading a page does not tell any font provider that you visited us. Buttons that open WhatsApp, a delivery app, or a business website take you to that company's own service, which sets its own cookies under its own policy.

We may update this policy from time to time. The "Last updated" date above will change, and material changes will be signposted on the Platform. Where a material change affects how we use your personal data, we may ask you to re-confirm your consent before continuing.