Privacy Policy

BAB PropTech Platform
Version 1.2.6 — Effective Date: November 24, 2026 (the change of version 1.2.6: sections 3, 6 and 8 now name the community-governance and data-protection laws of Saudi Arabia and the United Arab Emirates beside Egypt's; the change of version 1.2.5: the sharing bullet in section 6 for the owner and the listing agent of a unit you apply for, as section 2.17 already describes; the change of version 1.2.4, effective October 14, 2026: the vehicle alerts and vehicle reports paragraph in section 2.3; the changes of version 1.2.2, effective October 19, 2026: the forum text in section 2.9, the forum retention rows and the sharing bullet for city, country and Global spaces)

---

1. Introduction

BAB is a smart community management platform where every feature is, at its core, a gate event — a door that opens, permits, records, or protects. The LPR camera fires and a gate opens or denies. A visitor pass is issued and a door is granted. An owner votes in assembly and a governance gate is crossed. A maintenance request is approved and a resource gate releases. Every threshold has an auditable record, and every record has a purpose.

BAB is operated by BAB PROPTECH LLC, an Illinois limited liability company with its principal place of business at 2648 N Merrimac Ave, Chicago, IL 60639, USA ("we," "our," or "the Platform"), which acts as the data controller for the personal data described in this policy. We are committed to protecting the privacy and personal data of all residents, owners, visitors, and staff associated with the communities managed through this Platform. This Privacy Policy explains how we collect, use, store, and protect your information. For communities located in Egypt, we additionally process data in compliance with applicable Egyptian laws, including Law No. 151 of 2020 on the Protection of Personal Data and the community governance framework established under Egyptian Law No. 119 of 2008 (Owners' Unions).

By using BAB, you acknowledge that you have read and understood this Privacy Policy.

---

2. Data We Collect

2.1 Personal Identification Data

• Full name, email address, and phone number
• National ID or passport number
• Date of birth, gender, and nationality
• Emergency contact information

2.2 Residence and Property Data

• Unit number, building, and compound assignment
• Ownership or tenancy records
• Lease agreements and associated dates

2.3 Vehicle and License Plate Recognition (LPR) Data

The Platform uses License Plate Recognition (LPR) technology at gate entry and exit points for the following purposes:

• Automated gate access control and security
• Recording entry and exit timestamps for each vehicle
• Linking vehicle plates to registered resident or visitor profiles

Data captured includes:

• License plate numbers (text)
• Vehicle photographs captured at gate checkpoints
• Entry/exit timestamps
• Gate/zone identifiers

LPR data is associated with your profile and retained for 90 days from the date of capture, after which it is automatically purged unless required for an active security investigation.

Vehicle alerts and vehicle reports. A plate you register may be used to reach you about your own vehicle inside your compound. A resident can send you a fixed, pre-written alert by typing your plate (for example, that your car is blocking theirs), and Security can notify you after a resident reports your vehicle. The sender does not learn who you are, and you see the sender only as "a neighbour", or by unit number if they choose to show it. A vehicle report is kept by Security as an incident record with the plate, the place, the time and up to three photos (re-encoded without location data); Security sees the reporter by role and unit, never by name. BAB records these alerts and reports; it does not decide liability.

2.4 Visitor and Access Data

• Visitor name, purpose of visit, and host unit
• Visitor photographs captured during check-in
• QR code–based visitor pass records

2.5 Security and Surveillance Data

• CCTV footage recorded in common areas is retained for 30 days, then automatically deleted
• Visitor log photographs (check-in photos) are retained for 90 days, then automatically deleted
• Security pass images are retained for the duration of pass validity plus 30 days
• Incident-related recordings may be retained longer if flagged by security personnel for an active investigation

2.6 Financial Data

• Maintenance fund contributions and transaction records
• Service fee payments and billing history
• Expense approvals related to common property management

2.7 Usage Data

• App login timestamps and session activity
• Feature interactions for performance improvement
• Device identifiers for push notification delivery

2.8 Google Sign-In Data

When you choose to sign in with your Google account, BAB requests access to the following Google user data via the Google Sign-In service (OAuth 2.0):

• Email address (userinfo.email scope): Used to identify your account and populate your BAB profile.
• Basic profile information (userinfo.profile / openid scope): Includes your display name and profile photo URL. The display name is stored in your BAB profile; the profile photo URL is used only to display your avatar within the app and is not permanently stored.

No other Google account data is requested or accessed. BAB does not request access to Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google Workspace data.

2.9 Messages, Community Forum and Announcements

• Messages you send to a role address in your community (for example, the management office). Messages are addressed by role; your name is not shown to the other side.
• Posts, comments and photos in the community forum, published under a community name you choose once from names BAB offers you, never your real name or unit. A post shows the capacity you write in (resident, management or staff) and, if you keep it to your building, that building. Up to four photos per post in your community's forum and two in a wider space; BAB removes location and camera data from every forum photo before it is shown.
• If your community is placed in a city or country, you can also read and post in those wider spaces and in Global, which BAB moderates centrally. Posts there never show your community, building or unit, and Global never shows your country.
• The link between your account and your community name is kept closed. Only after a report, and with a written reason that is recorded, can it be revealed: by your community administrator for posts in your community, and only by BAB's central team for posts in a city, country or Global space.
• Reports you file about messages or posts.
• Announcements your community's management or your building committee sends to residents.

2.10 Contact Directory (Optional)

If you choose to list yourself in your community's contact directory, your name, phone number and email address are shown to the audience you select (your whole community, or management only). You can remove your listing at any time; it is also removed when your role in the community ends.

2.11 Property, Ownership and Sale Records

• Co-ownership of a unit: each owner's share and which co-owner votes for the unit.
• When a unit is sold: the signed sale contract, the developer's assignment letter, the finance office's clearance and the record of who checked each document.
• If you sell your unit, you can still see statements for the period you owned it, for five years after the sale.

2.12 Leases, Move-In/Move-Out, Meter Readings and Inspections

• Lease details: tenant and co-tenant names and contact details, rent, deposit, dates and the lease document.
• Move-in and move-out reports: condition photos, notes, deposit details and the typed sign-off of the person moving.
• Utility meter readings, with an optional photo of the meter.
• Inspection answers, notes and photos.

2.13 Photos and Documents You Upload

Photos and files you add to maintenance requests, inspections, move-in/move-out reports, meter readings, incidents, fines and appeals, payment receipts, vehicle registration (including a photo of the licence plate, which is read on your device to fill in the plate number), forum posts, and documents such as leases, invoices and provider certificates.

2.14 Emergency Alerts and Voice Dictation

• When you send an emergency alert, the app attaches your device's location once, only if you have already allowed location access. It is shown to your community's security staff.
• Some security forms let you dictate text. Dictation uses your device's own speech recognition service (Apple or Google), which may process the audio under its own terms. BAB receives and keeps only the resulting text, never the audio.

2.15 Data About People Who Do Not Use BAB

Residents and staff may enter details about people who do not have a BAB account: visitors (name, phone number, vehicle plate, entry photo), tenants and co-tenants on a lease, the person moving in or out, emergency contacts, and people invited to join a service provider. When management imports a list of residents, BAB only looks for existing accounts; rows that do not match an account are not stored.

2.16 Support Requests

When you contact support from the app: your contact email, your description, an optional screenshot, and your device model, operating system and app version, to help us solve the problem.

2.17 Rental Listings, Viewings and Applications

If your compound has switched rental listings on, a unit's owner, the owner's representative or a listing agent of the compound may publish a listing for the unit: the rent, deposit, availability, terms, notes and photos. The compound's management reviews it first. People searching see the listing without the owner's or the lister's name. If you ask to view a unit, we record the times you propose and the time agreed, and we issue a visitor pass in your name with your phone number, which the compound's guards see at the gate. If you apply for a unit, the owner and the listing agent see your name, phone number, move-in date, term, number of occupants and your message, and we record the terms the owner accepts. To open the search or a listing plan you enter a code; we keep a one-way hash of your phone number with the code to stop a code being used twice.

---

3. Legal Basis for Processing

We process your data on the following legal bases:

• Performance of a contract: To provide community management services to owners, tenants, and residents
• Legal obligation: To comply with the owners'-association law that applies to your community — Egyptian Law No. 119/2008 on Owners' Unions in Egypt, and the owners'-association and jointly-owned-property regulations of Saudi Arabia and the United Arab Emirates — which require maintaining records of ownership, contributions, and decisions
• Legitimate interest: To maintain compound security, including LPR-based gate access
• Consent: For optional features such as push notification preferences

---

4. How We Use Your Data

• Gate Access Control: LPR data, QR codes, and visitor logs are used to control gate access and enforce community security — every entry and exit is a gate event that BAB records and protects
• Community Governance: Owner and resident data is used for assembly voting (weighted by ownership shares), board election management, and legal compliance per Law 119/2008
• Financial Management: Contribution and expense records are maintained as required by Articles 23–26 of Law 119/2008
• Communication: We use contact information to deliver maintenance alerts, security notifications, and community announcements
• Analytics: Aggregated, anonymized data is used to improve community management services
• Google Sign-In: Your Google email address and display name are used solely to create and identify your BAB account. This data is not used for advertising, reselling, or profiling, and is not shared with third parties beyond what is required to operate your account.

---

5. Data Retention Schedule

---

6. Data Sharing

We do not sell your personal data. Data may be shared with:

• Compound management staff (guards, managers) with role-based access controls
• Board members for governance purposes as permitted under Law 119/2008
• Service providers (maintenance vendors, contractors) only with the minimum data required for their task
• The owner of a unit you apply for, and its listing agent (the compound's leasing office or a brokerage the compound approved): your application and contact details, only when you apply (section 2.17)
• Law enforcement or courts when required by the applicable law of the country where your community is located (Egypt, Saudi Arabia or the United Arab Emirates) or by the laws of the State of Illinois, USA
• Other residents of your community, only where you choose: your directory listing, and your forum posts under your community name
• Members of a city, country or Global space, only if you post there: your posts and comments under your community name. Members of Global may live in other countries.
• Service providers that run the Platform for us: Google Cloud and Firebase (hosting, sign-in, storage and push notifications), Zoho (email delivery) and Cloudflare Turnstile (spam protection on the web support form). Your device's speech recognition service processes audio only when you dictate

---

7. Security

We implement the following technical safeguards:

• Firebase Authentication for secure login
• Firestore security rules restricting access by role and permission
• Firebase App Check to prevent unauthorized API access
• Encrypted data transmission (TLS)
• Role-based access control (RBAC) across all Platform features

---

8. Your Rights

Under the data-protection law that applies to you — Egyptian Law No. 151/2020 in Egypt, the Personal Data Protection Law (PDPL) in Saudi Arabia, and Federal Decree-Law No. 45 of 2021 in the United Arab Emirates — you have the right to:

• Access your personal data held by the Platform
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention obligations)
• Object to certain types of processing
• File a complaint with your data-protection authority: the Personal Data Protection Center (PDPC) in Egypt, the Saudi Data and AI Authority (SDAIA) in Saudi Arabia, or the UAE Data Office

To exercise these rights, contact your BAB community administrator or submit a request through the Platform's support channel.

---

9. Changes to This Policy

We will notify you of material changes to this Privacy Policy through an in-app notification at least 14 days before the changes take effect. Continued use of the Platform after that date constitutes acceptance of the revised policy.

---

10. Google API Services — User Data Policy Compliance

BAB's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10.1 Scopes Requested

10.2 Limited Use Disclosure

Google user data obtained through the Google Sign-In integration is used only to:

• Authenticate the user and create or link their BAB account via Firebase Authentication
• Store the user's display name in their BAB Firestore profile document

Google user data is never:

• Sold or transferred to third parties for advertising or any other commercial purpose
• Used to serve targeted or personalized advertising
• Used to train AI or machine learning models
• Shared with third parties except as necessary to deliver the BAB service (i.e., via Firebase Authentication and Firestore, both operated by Google)

10.3 Data Deletion

You may request deletion of all your data — including data sourced from Google — at any time by deleting your BAB account from within the app (Settings → Delete Account). Upon account deletion, all associated personal data is permanently removed from BAB's systems within 30 days.

---

11. Contact

For privacy-related inquiries, contact your BAB community administrator through the Platform, or reach the operator directly:

BAB PROPTECH LLC
2648 N Merrimac Ave, Chicago, IL 60639, USA
Email: info@getbab.com

This policy was last updated on November 10, 2026 and is governed by the laws of the State of Illinois, USA.