Privacy Policy

Flatwayz is operated by Drentova Group Ltd, which is the data controller. The group’s full Privacy Policy, Cookie Policy and data-processing documentation are published at drentova.com/legal.

When you create an account: your name, email address, mobile number and the country of your dialling code. A corporate signup also records the company name and the country it trades in.

If you sign in with Google: your Google account’s subject identifier, email address, name and profile picture. We request only the openid, email and profile scopes, and we never receive your Google password.

What you put in a brochure: property details, photographs, your company logo and licence details, and your agent contact card. These are yours; we store them so the product works.

Operational records: a hashed session token, one-time email codes while they are valid, a count of exports for billing, storage totals, and server logs.

We never store your password. It is held as a scrypt hash with a per-account salt. The same is true of session tokens and email codes — only hashes are stored, so a copy of the database cannot be replayed as a login.

Every uploaded image is re-encoded before it is stored, and all embedded metadata is stripped in the process. That includes EXIF GPS coordinates, which property photographs frequently carry and which would otherwise reveal the exact location of a listing to anyone who received the file.

The original file you uploaded is not retained — only the processed version and a thumbnail.

• To perform our contract with you — your account details, your brochures, and the export counts that determine what you are billed.
• Our legitimate interests — keeping the service secure, preventing abuse, and rate-limiting requests.
• Legal obligation — retaining billing records for as long as tax and accounting rules require.

We use a small number of processors, each for one job:

• Vercel — hosting and the servers that render your PDF.
• Turso — the database holding accounts, workspaces and brochures.
• Cloudflare — storage for uploaded images, and DNS.
• Resend — sending verification codes and workspace invitations.
• Google — only if you choose to sign in with Google.
• OpenAI — only when you use the Arabic translation feature. The text of the fields being translated is sent for that purpose; images and account details are not.

We do not sell your data, and we do not use it to train anything.

Your brochures and images stay until you delete them or delete your account. Sessions expire and are removed automatically. One-time email codes are destroyed as soon as they are used, expire, or are guessed too many times.

Deleting your account deletes your data. That means every workspace you created, its brochures, its uploaded files and the agent accounts inside it. It is immediate and it cannot be undone.

You can access, correct, export or delete your personal data. Your name and mobile number are editable in account settings; deletion is a single action there. For anything else — including a copy of what we hold — write to support@flatwayz.com.

If your account was created for you by a brokerage, that brokerage controls it and can reset your password or remove your access. Requests about such an account may need to go through them.

Privacy questions and complaints go to support@flatwayz.com, or follow the group’s published complaints procedure.