BAB PropTech Platform
Version 1.2 — Effective Date: July 27, 2026
1. Introduction
BAB is a smart community management platform where every feature is, at its core, a gate event — a door that opens, permits, records, or protects. The LPR camera fires and a gate opens or denies. A visitor pass is issued and a door is granted. An owner votes in assembly and a governance gate is crossed. A maintenance request is approved and a resource gate releases. Every threshold has an auditable record, and every record has a purpose.
BAB is operated by BAB PROPTECH LLC, an Illinois limited liability company with its principal place of business at 2648 N Merrimac Ave, Chicago, IL 60639, USA ("we," "our," or "the Platform"), which acts as the data controller for the personal data described in this policy. We are committed to protecting the privacy and personal data of all residents, owners, visitors, and staff associated with the communities managed through this Platform. This Privacy Policy explains how we collect, use, store, and protect your information. For communities located in Egypt, we additionally process data in compliance with applicable Egyptian laws, including Law No. 151 of 2020 on the Protection of Personal Data and the community governance framework established under Egyptian Law No. 119 of 2008 (Owners' Unions).
By using BAB, you acknowledge that you have read and understood this Privacy Policy.
2. Data We Collect
2.1 Personal Identification Data
- Full name, email address, and phone number
- National ID or passport number
- Date of birth, gender, and nationality
- Emergency contact information
2.2 Residence and Property Data
- Unit number, building, and compound assignment
- Ownership or tenancy records
- Lease agreements and associated dates
2.3 Vehicle and License Plate Recognition (LPR) Data
The Platform uses License Plate Recognition (LPR) technology at gate entry and exit points for the following purposes:
- Automated gate access control and security
- Recording entry and exit timestamps for each vehicle
- Linking vehicle plates to registered resident or visitor profiles
Data captured includes:
- License plate numbers (text)
- Vehicle photographs captured at gate checkpoints
- Entry/exit timestamps
- Gate/zone identifiers
LPR data is associated with your profile and retained for 90 days from the date of capture, after which it is automatically purged unless required for an active security investigation.
2.4 Visitor and Access Data
- Visitor name, purpose of visit, and host unit
- Visitor photographs captured during check-in
- QR code–based visitor pass records
2.5 Security and Surveillance Data
- CCTV footage recorded in common areas is retained for 30 days, then automatically deleted
- Visitor log photographs (check-in photos) are retained for 90 days, then automatically deleted
- Security pass images are retained for the duration of pass validity plus 30 days
- Incident-related recordings may be retained longer if flagged by security personnel for an active investigation
2.6 Financial Data
- Maintenance fund contributions and transaction records
- Service fee payments and billing history
- Expense approvals related to common property management
2.7 Usage Data
- App login timestamps and session activity
- Feature interactions for performance improvement
- Device identifiers for push notification delivery
2.8 Google Sign-In Data
When you choose to sign in with your Google account, BAB requests access to the following Google user data via the Google Sign-In service (OAuth 2.0):
- Email address (
userinfo.emailscope): Used to identify your account and populate your BAB profile. - Basic profile information (
userinfo.profile/openidscope): Includes your display name and profile photo URL. The display name is stored in your BAB profile; the profile photo URL is used only to display your avatar within the app and is not permanently stored.
No other Google account data is requested or accessed. BAB does not request access to Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google Workspace data.
3. Legal Basis for Processing
We process your data on the following legal bases:
- Performance of a contract: To provide community management services to owners, tenants, and residents
- Legal obligation: To comply with Egyptian Law No. 119/2008 on Owners' Unions, which requires maintaining records of ownership, contributions, and decisions
- Legitimate interest: To maintain compound security, including LPR-based gate access
- Consent: For optional features such as push notification preferences
4. How We Use Your Data
- Gate Access Control: LPR data, QR codes, and visitor logs are used to control gate access and enforce community security — every entry and exit is a gate event that BAB records and protects
- Community Governance: Owner and resident data is used for assembly voting (weighted by ownership shares), board election management, and legal compliance per Law 119/2008
- Financial Management: Contribution and expense records are maintained as required by Articles 23–26 of Law 119/2008
- Communication: We use contact information to deliver maintenance alerts, security notifications, and community announcements
- Analytics: Aggregated, anonymized data is used to improve community management services
- Google Sign-In: Your Google email address and display name are used solely to create and identify your BAB account. This data is not used for advertising, reselling, or profiling, and is not shared with third parties beyond what is required to operate your account.
5. Data Retention Schedule
| Data Type | Retention Period |
|---|---|
| CCTV footage (common areas) | 30 days |
| Visitor check-in photographs | 90 days |
| LPR vehicle photographs | 90 days |
| LPR plate records (text) | 90 days |
| Security pass images | Pass validity + 30 days |
| Financial transaction records | 7 years (legal requirement) |
| Incident-flagged recordings | Until investigation closure |
| User profile and association data | Duration of membership + 2 years |
6. Data Sharing
We do not sell your personal data. Data may be shared with:
- Compound management staff (guards, managers) with role-based access controls
- Board members for governance purposes as permitted under Law 119/2008
- Service providers (maintenance vendors, contractors) only with the minimum data required for their task
- Law enforcement or courts when required by applicable Egyptian law
7. Security
We implement the following technical safeguards:
- Firebase Authentication for secure login
- Firestore security rules restricting access by role and permission
- Firebase App Check to prevent unauthorized API access
- Encrypted data transmission (TLS)
- Role-based access control (RBAC) across all Platform features
8. Your Rights
Under Egyptian Law No. 151/2020, you have the right to:
- Access your personal data held by the Platform
- Request correction of inaccurate data
- Request deletion of your data (subject to legal retention obligations)
- Object to certain types of processing
- File a complaint with the Personal Data Protection Center (PDPC)
To exercise these rights, contact your BAB community administrator or submit a request through the Platform's support channel.
9. Changes to This Policy
We will notify you of material changes to this Privacy Policy through an in-app notification at least 14 days before the changes take effect. Continued use of the Platform after that date constitutes acceptance of the revised policy.
10. Google API Services — User Data Policy Compliance
BAB's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
10.1 Scopes Requested
| Scope | Data Retrieved | Purpose |
|---|---|---|
openid |
User identity token | Authenticates the user via Google Sign-In |
userinfo.email |
Email address | Account identification and BAB profile creation |
userinfo.profile |
Display name, profile photo URL | Populating the user's in-app display name and avatar |
10.2 Limited Use Disclosure
Google user data obtained through the Google Sign-In integration is used only to:
- Authenticate the user and create or link their BAB account via Firebase Authentication
- Store the user's display name in their BAB Firestore profile document
Google user data is never:
- Sold or transferred to third parties for advertising or any other commercial purpose
- Used to serve targeted or personalized advertising
- Used to train AI or machine learning models
- Shared with third parties except as necessary to deliver the BAB service (i.e., via Firebase Authentication and Firestore, both operated by Google)
10.3 Data Deletion
You may request deletion of all your data — including data sourced from Google — at any time by deleting your BAB account from within the app (Settings → Delete Account). Upon account deletion, all associated personal data is permanently removed from BAB's systems within 30 days.
11. Contact
For privacy-related inquiries, contact your BAB community administrator through the Platform, or reach the operator directly:
BAB PROPTECH LLC
2648 N Merrimac Ave, Chicago, IL 60639, USA
Email: info@getbab.com
This policy was last updated on July 27, 2026 and is governed by the laws of the State of Illinois, USA.