Privacy policy

This policy applies to eywalifedubai.com and to the enquiry form published on it. It does not cover the developer’s own website, the aggregator portals we cite as sources, or the third-party platform that hosts the 360° tours — each of those has its own policy and its own operator.

We have written it as a description rather than a disclaimer. If something below does not match what the site actually does, the description is wrong and we will correct it.

What the form collects

The enquiry form is the only place on this site where you can enter personal data. It stores exactly the following, and nothing beyond it:

• Your name, as typed.
• Your email address, if you provide one.
• Your phone number, if you provide one. One of email or phone is required, because otherwise we cannot reply.
• The site language you were reading in when you submitted (English, Russian or Arabic).
• The reply language you selected, which may differ from the site language.
• Your stated interest: Tree of Life, Way of Water, or both towers.
• The specific residence you selected, if you opened the form from an availability card.
• The budget band you selected, if any. Bands are ranges; no exact figure is collected.
• Your message, if you wrote one.
• The form placement and page you submitted from, so the reply can address the right subject.
• The referring URL, if your browser sent one.
• UTM parameters present in the page address, so we can tell which campaign or link brought you here.
• A random identifier for the current browser tab, so the interaction record from that tab can be linked to the enquiry. It expires with the tab session and is not a cross-site identifier.
• Your explicit consent to be answered, recorded together with the time of submission.

What is recorded automatically

The server attaches the user agent string sent by your browser. It also derives a normalised contact key from your phone number or email to recognise a repeat enquiry, and a sales-priority score from 0 to 100 from the fields you supplied: contact methods, message length, selected tower, selected residence and budget band.

The score only helps order human follow-up. It uses no external data and makes no automated decision about whether you may buy, what price you receive or whether anyone replies.

The web server also keeps standard access logs, which contain the connecting IP address and the requested URL. No geolocation is derived from your address: the site does not resolve your IP to a country, city or coordinates, and it does not attempt to identify you across other websites. Access logs are kept only for operating and securing the server.

The site keeps its own interaction statistics without cookies: which pages are opened, which buttons and links are clicked, scroll depth and whether the intro video started, together with the page language, a device class and the random per-tab identifier described above. No IP address, no precise location and no cross-site identifier is stored in the analytics database, and a browser "Do Not Track" setting switches this collection off entirely.

The form also contains a hidden field that a human never sees. If it arrives filled in, the submission is treated as automated and discarded rather than stored. Where the anti-abuse challenge is enabled, its verification token is checked at submission time and not retained afterwards.

Why we collect it

One purpose: to answer your enquiry and to follow it up as a sales conversation. That means sending you availability, the price list, floor plans and the payment schedule, and continuing the same thread until you either buy, decide against it, or ask us to stop.

We do not build cross-site behavioural profiles, and the simple internal priority score described above is not used for automated decision-making. We do not sell or rent your details, and we do not pass them to third-party brokers. You are not added to a marketing list as a side effect of asking a question; if we ever want to send you something unrelated to your enquiry, we will ask first.

Where it is stored

Enquiries are stored in a SQLite database file on the dedicated server that runs this site, located in a DigitalOcean data centre in New York, United States. Traffic between your browser and the site is encrypted in transit with TLS, and the database is snapshotted daily to the same server with snapshots retained for fourteen days.

Access to the stored enquiries is limited to the people who answer them and to the technical administrator of the site. There is no public interface to the database and no export path other than the one those people use to answer you.

How long it is kept

An enquiry is kept while it is open, and then for a further twenty-four months after it is closed. Twenty-four months is deliberate rather than arbitrary: an off-plan purchase decision routinely spans two construction seasons, and buyers frequently come back to a conversation a year later expecting us to remember it.

After that period the record is deleted, including the automatically attached fields. If you ask for deletion earlier, we delete it earlier — see your rights below.

Who else processes it

Four technical service providers touch an enquiry, each for one narrow technical reason:

• DigitalOcean — the dedicated server in New York on which this site, its web server and the enquiry database run.
• Resend — delivery of the notification email that tells the sales desk an enquiry has arrived, and of any confirmation email sent to you.
• Cloudflare — only the anti-abuse challenge on the form, where it is enabled; it verifies that a human submitted the form and receives no enquiry content.
• Telegram — an optional internal notification that an enquiry has arrived, used so that time-sensitive enquiries are seen quickly. Where it is enabled, it carries the enquiry contents into a private internal channel; it is never used to contact you.

Your rights

You can ask us to show you the enquiry we hold about you, to correct anything in it, to delete it, or to withdraw the consent you gave when you submitted it. There is no form to fill in and no identity ritual: write to us through the enquiry form, from the address or with the phone number you originally used, and say which of the four you want.

Withdrawing consent stops the sales conversation. We keep only the minimum record that consent was withdrawn and when, because without it we cannot prove we were entitled to stop. Deletion removes the enquiry itself, including the message, the automatically attached fields and the consent timestamp.

We answer these requests in writing, in the reply language of the original enquiry, and we do not charge for them.

Cookies and analytics

This site sets no advertising cookies or advertising pixels. There are no embedded third-party trackers, social-media widgets or remarketing tags.

The first-party interaction statistics described above start when a page loads unless your browser sends "Do Not Track". They use sessionStorage only for a random identifier limited to the current tab and do not read or write cookies. The site has no analytics-consent prompt and stores no analytics-consent preference.

The anti-abuse challenge on the form is a security measure rather than analytics. It runs at the moment of submission and is not used to track you between visits.

Links away from this site

The 360° tours open on a platform operated by a third party, and several pages cite property portals as data sources. Once you follow one of those links you are on someone else’s site, subject to their policy and their tracking, and we have no control over and no visibility into what they collect.

Children

The site addresses buyers of residential property and is not directed at children. We do not knowingly collect data from anyone under eighteen. If such an enquiry reaches us, we delete it.

Changes to this policy

If what the site does changes — a new processor, a different retention period, a new field on the form — this page is updated and the date below it changes with it. We do not keep a public archive of previous versions; if you need to know what the policy said on a particular date, ask through the form and we will tell you.

What this policy does not claim

We make no certification claims. This site is not “GDPR-certified” and no such certification exists; the description above is simply what happens to your data. We publish no company registration number and no postal address here, and we deliberately publish no telephone number, no messaging handle and no email address — every route to us runs through the form, which is why the form is described in this much detail.