1. Who we are

This policy covers the Nese Real Estate iPhone app and the connected system at nese-sys.cloud, both operated by Nese Real Estate in Iraq ("we"). The app is not a public marketplace; it is a closed business tool. Accounts are created by company management for its employees and agents only, and the app offers no self-registration.

2. Data we collect

Employee account: name, phone number, email address and job role; the password is stored hashed and is never readable by anyone, including us; two-factor settings, including the phone number used for codes and an encrypted authenticator secret.

Client records entered by staff: client name, phone numbers, address, occupation, approximate budget, lead source, follow-up status and notes, plus reservation and sale details (unit, price, instalments, payments, commission). These records belong to the company's clients; the employee entering them is responsible for their accuracy and for obtaining the client's consent.

Public interest forms: when someone fills in a form shared by one of our agents, we receive the name, phone number and address they typed, plus the IP address the form was sent from (used solely to block automated repeat submissions).

Technical data collected automatically: IP address, browser or device type and last activity time for each session; a pseudonymous device identifier used to enforce our "one session per platform" rule and to recognise trusted devices; an internal audit log of who changed what and when; and the Apple-issued push token used to deliver notifications.

What we never collect: we do not request your location, access your contacts, open the camera or upload photos from your device, read your messages, or use any advertising tracker or third-party analytics inside the app.

3. Face ID and Touch ID

When biometric sign-in is enabled, the check happens entirely on your device through Apple's system. Your biometric data never leaves the device; we do not receive, store or have any way to access it. After your first full password sign-in, our server issues a random quick-sign-in code that is kept in your device's Keychain; the biometric check only unlocks that code locally. The code is valid for ninety days and is revoked immediately on sign-out, password change, or when management removes the device.

4. Why we use this data

To operate the service (clients, units, reservations, commissions, invoices); for security (identity verification, blocking unauthorised access, tracking active sessions); for operational messaging (verification codes, deal alerts and invoices by SMS, WhatsApp or email); to deliver notifications; and for internal accountability. We never use any of this data for advertising, never sell or rent it, and never share it with data brokers.

5. Service providers who receive some data

• Apple (APNs) — push token and alert text, to deliver notifications to your device.
• Twilio — phone number and message text, for verification codes, deal alerts and invoices over SMS and WhatsApp.
• Our email provider — email address and message text, for email verification, password recovery and reports.
• Anthropic — your question to the in-app AI assistant and the data needed to answer it. Nothing is sent unless you write to the assistant, and the data sent is not used to train AI models.
• Google Sheets — residential unit and price data only; no client personal data is included.

We may also disclose data where Iraqi law or a court order requires it.

6. How we protect data

All traffic is encrypted over HTTPS/TLS. Passwords are hashed, and sensitive tokens (quick sign-in, trusted devices) are stored only as hashes. We enforce two-factor authentication and email verification at sign-in, one session per platform, account lockout after failed attempts, and strict role-based permissions so each employee sees only what their job requires. The database is backed up regularly and the system undergoes periodic security reviews.

7. Retention

Account and client records are kept for as long as the company uses the system, as they form its business and accounting record. Quick sign-in codes last at most ninety days or until sign-out. Push tokens are deleted automatically once Apple reports them as invalid or when the app is deleted. Session and audit logs are retained for security auditing.

8. Your rights

You may request access to your data, its correction, or its deletion. Because accounts are centrally managed, employees should contact company management or write to the address below to have an account disabled or personal data deleted; account deletion is not available inside the app because the account is company-owned. Clients may write to us to access, correct or delete their data, and we will respond within a reasonable time unless a legal or accounting obligation prevents it. You can also turn notifications off at any time in iOS Settings without affecting how the app works.

9. Children

The app is a workplace tool for adults employed by the company. We do not knowingly collect data from anyone under eighteen.

10. Changes

We update this policy whenever a new feature changes what data is collected. The last-updated date always appears at the top of this page, and material changes are announced inside the app.

11. Contact

For any privacy question or request: support@nese-sys.cloud