Privacy notice

EZAQAR
Version: ⁨2026-10-21⁩ · Effective date: ⁨21 October 2026⁩

This is a translation. If the Arabic and English texts differ, the Arabic text prevails.

1. In short

• EZAQAR is a broker-free platform for renting homes in Egypt. We collect the data we need to run your account, listings, viewings, applications and chat, and to protect people from fraud and brokers.
• Owners never see your ID photos, your ID number or your selfie.
• For now we never share your phone number with other users. You talk in the in-app chat.
• Only the founder sees your ID photos and selfie. They are deleted within 72 hours of upload at the latest.
• Your data is stored outside Egypt, mainly in Germany (EU), and passes through Cloudflare's global network. That is why we ask for your consent to transfer it outside Egypt.
• We do not sell your data. The website uses no advertising, tracking or analytics tools.
• You can ask for a copy of your data, correct it, withdraw consent and delete your account.
• Some deletions are done by hand for now, not automatically. Section 10 explains.

2. Who we are and how to reach us

• Controller of your data: ⁨NM8 Designs⁩. EZAQAR is a trade name used by ⁨NM8 Designs⁩, an Egyptian ⁨limited liability company⁩, commercial register no. ⁨224521⁩, tax card no. ⁨759-285-748⁩, registered address ⁨48 Ahmed El Menessy St., El Narges 3, Fifth Settlement, New Cairo, Egypt⁩. It runs the website ezaqar.com.
• Privacy contact: ⁨wessamohsen@gmail.com⁩.
• Our emails come from no-reply@ezaqar.com. That address does not receive replies.
• Data Protection Officer: ⁨Mohamed Khodair⁩, contact: ⁨wessamohsen@gmail.com⁩.

This notice is governed by the Personal Data Protection Law issued by Law No. 151 of 2020, and its Executive Regulations.

3. What this notice covers

• This notice covers the website ezaqar.com. For now we accept listings only in New Cairo, Madinaty and El Rehab.
• The service is for long-term residential rentals only, furnished or unfurnished. Monthly rentals are not available for now.
• Anyone can browse listings and create an account. The founder reviews and approves every account before it can book, apply, chat or list a home.
• Today the service is run by its founder alone. No other staff review data. In this notice we call him "the founder".
• Not switched on for now:
  • We sell nothing and collect no money.
  • Monthly rentals are not available.
  • We send no SMS, no WhatsApp messages and no phone push notifications.
  • We use no outside identity-verification company.
  • We use no AI to enhance photos or check documents.
  • We use no third-party maps.
  • "Hosts" (a relative or doorman who opens the home for a viewing) are off.
  • Sharing a viewing's time and address with another person by link: the website has no button for it.
  • The phone app is not released yet.
• If we switch any of these on, we will update this notice first.

4. The data we collect

Two terms we use in this notice:

• One-way fingerprint: a code calculated from the data that cannot be reversed to get the data back. We make some of these fingerprints with a secret key. Anyone holding that key can test whether a given number matches a fingerprint, so these keys stay on our servers only.
• Encrypted: a file locked with a key, so it can be read only with that key.

4.1 When you create an account and complete your profile

The consents we ask for:

• To create an account (required): agreement to the terms of use and this privacy notice, and consent to transfer your data outside Egypt.
• Before the ID check (required to start it): consent to the use of your ID photos and selfie. See section 5.
• Before your first booking (required to book): consent to share your profile with owners. See section 7.
• Optional: booking updates on WhatsApp, and offers and news. We send neither yet. We only record your choice.

Consent record: for every consent or refusal we keep the consent type, the text version, your answer, your language, the platform, your browser's identification string (user agent), the time, and a one-way fingerprint of your IP address. The sign-up consents (terms, privacy notice and transfer outside Egypt) are recorded when you confirm your email in the same browser, or when you tick the boxes again while completing your profile. So the recorded time is the time of confirmation, not the time you ticked the box. This record cannot be edited. It records what you agreed to, and when your consent was recorded.

Account review record: the status of your request, how many times you sent it, the decline reason if any, and the founder's message if he asked you for more information. The notes on review decisions go into the audit log.

The founder's notes: the founder can write notes about your account (up to 2,000 characters each). They are kept in a separate record, and only he sees them.

Your data requests: requests for a copy or for deletion, their dates and their status.

Robot check: on the sign-up, sign-in, forgot-password, resend and change-password forms we use Cloudflare Turnstile to check that you are a person and not a bot. Cloudflare collects data from your browser for this.

Emails: we send emails to confirm your address and reset your password, and we also send important notices by email. Our emails never contain a property address or phone numbers.

4.2 During the ID check

This is sensitive data. See section 5.

4.3 If you list a home (owner, or agent under a power of attorney)

• Property and listing: the exact address and exact map pin (kept in a private table and never published), type, size, rent, terms, description, viewing times and your declarations.
• Listing photos: your browser re-saves each photo before upload, which removes camera and location data. We compute a digital fingerprint of each photo to spot copied or reused photos. Photos stay private until we approve them.
• Ownership documents: such as a title deed or a utility bill. We keep the file as you uploaded it (encrypted), its digital fingerprints, its page count, its date if there is one, and its technical details: the program that made or edited it, and when it was created and changed. We use these to spot reused or edited documents. The founder reads the name and address written on the document during review; we do not record them in the database. If the file is a photo, it may still hold details from the phone or camera, such as where it was taken, until it is deleted.
• Power of attorney (توكيل), if you are an agent: the POA file, your name as written in the POA, the principal's Arabic name, the principal's ID number turned into a one-way fingerprint plus its last 4 digits, your relationship, the POA number, letter and year and the notary office, the page that gives the right to lease, and the longest lease the POA allows if you say it allows a longer one. If you upload a certificate that the POA has not been revoked, we keep it encrypted, with its date. The POA file itself shows the principal's full ID number, and we keep it encrypted. We do not contact the principal. See section 17.

4.4 While you use the service

• Homes you save.
• Viewing bookings: time slot, status, cancellation reasons, two 4-digit check-in codes, and attendance.
• Applications: move-in date, lease length, your message (up to 500 characters), and the version of the key terms you accepted. When you accept the terms we keep a full copy of them, the time, your language, the platform, your browser's identification string and a one-way fingerprint of your IP address.
• Chat messages: up to 2,000 characters each. Our system checks every message automatically. Messages with phone numbers, email addresses, or links to or names of messaging and social-media apps are refused. Before an offer between the two people is accepted, messages that talk about commission or ask for payment before the viewing are refused too. Each refused attempt adds risk points. Other links are allowed, but we flag the message.
• People you block: whom you blocked, and when.
• Reports: who reported, whom, the reason, priority, details (up to 1,000 characters), attached messages, automatic actions and the outcome.
• Disputes and reliability review requests: the reason, what you write, and the decision.
• Requests to add a place: the name of the compound or district you asked us to add.
• In-app notices: contain ids and times only. Our system blocks any address, phone number, legal name or directions in them.
• Email delivery log in our database: for each email: channel, provider, the provider's message id, status and error code. No email addresses. But Cloudflare keeps its own log of each email, with the recipient's address. See section 8.
• Free Boost Packs: a record of what you received and used.

4.5 Trust and safety data

• Reliability score: a score from 0 to 100, its band, counts of attended and missed viewings, and an event history (attended, late cancellation, no-show and others). It is recomputed every night, and older events count less over time. It applies to renters and owners. See section 11.
• Risk signals and broker-risk score: points for each signal, for example an ID number used on another account, a reused photo or document, an attempt to send contact details in chat, or a broker report.
• "Same network" check: when reviewing a sign-up, the founder sees other accounts that signed in from the same IP address in the last 30 days, refused phone-number attempts (last 4 digits only) and the risk score.

4.6 Technical data

• Database access log: your full IP address, your browser's identification string (user agent), account id, the action and the request id. Logged actions: sign-in, exact-address reveal, document opening, the founder viewing private data in the admin console, and reveal of the other party's legal name.
• Last-active time: updated at each sign-in.
• Audit log: every admin action and many user actions: who did it, what, to whom, the reason, what changed, and a one-way fingerprint of the IP address. It cannot be edited.
• Cloudflare traffic logs: one line per request: time, program, outcome, the web address (URL) requested (secret parts removed), your IP address, your browser's identification string, Cloudflare's estimate of your rough location (country, city, network), request id, page kind and account id. They never contain emails, phone numbers, passwords, ID numbers or names. Cookies and tokens are removed.
• Short Cloudflare run logs (Workers Logs): kept 7 days at most.
• Supabase logs: Supabase keeps its own sign-in and audit logs, including IP addresses.
• Cookies and browser storage: see section 14.

4.7 Data we get from others or create ourselves

• From other users: reports about you, disputes opened against you, and viewing attendance records (based partly on what the other side does on the website, such as the check-in codes). If you are a principal under a POA, the agent gives us your details (section 17).
• From our systems: the reliability score, risk signals and the risk score, and the "same network" check.
• From the founder: the document details he types from your ID photos (section 5), and his notes about your account.
• From providers: Cloudflare's estimate of your rough location in the traffic logs, and the robot-check result (Turnstile).

5. The ID check (sensitive data)

When is it needed? Not for browsing. You need it before you book, apply, chat or list a home. You can do it while you wait for your account to be approved.

Your consent: we ask for your explicit consent before you start, in a separate box that is never pre-ticked. Without it the check does not start.

What you upload: photos of the front and back of your national ID card (or your passport and residence permit), and a selfie of your face. For now:

• The selfie is a photo you upload as a file. There is no automatic movement or liveness check.
• No outside company takes part in the check. The founder reviews the photos himself.
• The photos are uploaded as they are, without being re-saved. So they may still hold details from the phone or camera, such as where they were taken and the phone model, until they are deleted.

Important: the Egyptian national ID card shows religion, marital status, spouse's name, address and profession. Some of this, such as religion, is sensitive data under the Law. We do not record any of it, but it is visible in the photos until the photos are deleted.

Where are the photos stored? On the way, the photos pass through Cloudflare's network (section 9); the connection itself is encrypted. Our server encrypts each file with its own key (AES-256-GCM), then stores it with Cloudflare in storage restricted to the European Union.

Who sees them? Only the founder, inside the admin console. The image shows his email and the time as a watermark, and every opening is logged. Our rules forbid downloading, photographing or forwarding the images to anyone. Owners and other users never see any of it.

What does the founder record from the document?

• Your name in Arabic as on the document (full name, first name and family name), and your name in English if there is one.
• The document type and its expiry date.
• ID number: the founder types it into the admin console, and our server turns it into a one-way fingerprint. We do not keep it in full. We keep the fingerprint and its last 4 digits.
• Date of birth: the founder types it so we can check that you are 21 or older and that it matches the birth date in the national ID number. We do not keep it. We keep only "21 or older: yes or no".

When are the photos deleted? Within about 15 minutes of the founder's decision, and in any case within 72 hours of upload. We delete the file and its encryption key together, so it cannot practically be recovered. A further storage rule deletes any file still there after 3 days. If no decision is made within 72 hours, the photos are deleted and we ask you to upload them again.

What do we keep after the decision?

• The result and its reasons, the review method, who reviewed, the verification date and your consent reference.
• The document type, the ID-number fingerprint and its last 4 digits, your legal name, "21 or older", and the document's expiry date.
• A person record: links the ID-number fingerprint to your account, with its status and any ban. We use it so that each person has only one account, and to enforce bans.
• For each deleted photo: its digital fingerprint, its former storage location, the file type and the deletion times. The photo cannot be rebuilt from this fingerprint.

Rules applied automatically to what the founder records:

• Signs of tampering (the national ID number's check digit is wrong, or the birth date does not match the number): the case stays in manual review until the founder decides.
• ID number used on another account: the case stays in manual review until the founder decides.
• Under 21: rejected.
• Expired document: rejected.
• Banned person: rejected.

Trying again and challenging a rejection: if the founder asks you to try again (for example, because a photo is blurry), you can upload new photos. A rejection cannot be undone on the website today. To challenge a rejection, write to us at ⁨wessamohsen@gmail.com⁩.

Your shown name: after a passed check, your shown name becomes your first name and family initial from the document (for example "Ahmed M."). You cannot change it yourself. To correct it, write to us.

Re-verification: if your email or phone number changes after a passed check, we ask you to verify again.

How long we keep it:

• Photos: as above.
• The result and the person record: for the life of your account and 12 months after it closes, even if you delete your account.
• If the person is banned: 5 years.

Withdrawing consent: there is no button for this on the website yet. Write to us at ⁨wessamohsen@gmail.com⁩.

Later: we may use an Egyptian identity-verification company. We will update this notice before we do.

6. Why we use your data, and on what legal basis

Under Article 6 of the Law, processing is lawful when one of the following applies. The table refers to them by letter:

• (a) Consent: your consent to the processing for one or more set purposes.
• (b) Contract and legal rights: the processing is needed to perform or enter into our contract with you (the terms of use), or to claim or defend legal rights.
• (c) Legal obligation: carrying out a duty set by law, an order from a competent investigating authority, or a court ruling.
• (d) Meeting obligations and exercising legitimate rights: enabling us to meet our obligations, or any person with standing to exercise their legitimate rights, unless this conflicts with your fundamental rights and freedoms.

Sensitive data, such as ID card images because they show religion, also needs your explicit written consent and a licence from the PDPC.

We do not use your data for marketing today. We do not ask about religion, marital status or details of children.

7. Who sees your data

7.1 Anyone, even without an account

• Live listings, with an approximate location only (a point moved away from the real one), approved photos and the published key terms.
• The lister's card: shown name (first name and family initial), "ID verified", the lister's capacity (owner, or agent under a power of attorney), badges, the month they joined, and "Keeps X% of viewings".
• Live listings, with the lister's card, and our public information pages can appear in search engines such as Google, which may keep a copy for a while after we remove them. Account and sign-in pages are not indexed.

7.2 The owner, when you book a viewing

This happens only after you consent to share your profile with owners. Without that consent you cannot book. The owner sees:

• Your shown name and your approved profile photo.
• "ID verified · 21 or older".
• Your reliability score (or "New"), and how many of your booked viewings you attended.
• Your household size.
• Whether your job is verified (job verification is not switched on yet).
• How many rentals you have completed on the platform, and whether your account is new (under 30 days).

7.3 The owner, when you apply

Everything above, plus your job, move-in date, lease length, message, and the terms version you accepted.

7.4 Both sides, after an offer is accepted

Once an offer is accepted or the home is rented, our system makes the other side's full Arabic legal name, as on their ID document, available to each side, if that side passed the ID check. Each reveal is logged.

7.5 The renter, after booking

The renter sees the exact address and map pin after booking, and while their application for that home is open (accepted and backup applications included). Access also lasts until 30 days after a viewing the renter attended. Each reveal is logged.

7.6 What owners never see

ID photos, ID number, selfie, date of birth, nationality, religion, your address, your income, your other bookings, the internal risk score, and the details behind your reliability score.

7.7 Phone numbers

For now we never share your phone number with any user. We do not store the full number in the database. The chat refuses phone numbers and other contact details (section 4.4).

7.8 The founder

He sees what he needs for reviews and safety:

• Your full email (each opening is logged), and the last 4 digits of your phone with the note that it is unverified.
• Your profile details, your consents, risk signals and the number of reports against you.
• Other accounts linked to the same ID-number fingerprint.
• The notes he writes about your account.
• ID photos only while a check is open, and the check result.
• Ownership and POA documents (each opening logged; images shown with a watermark).
• Only those chat messages attached to a report (each viewing logged).
• The audit log and data requests.

Technically, with his database access, the founder can read any data stored in it. This direct access is not recorded in our access log.

7.9 Service providers

See section 8.

7.10 Authorities

We disclose your data to public bodies only when Egyptian law requires us to, such as a written order from the Public Prosecution, a competent investigating authority or a court. We log each request and each disclosure, and tell you about it, unless the law or the order forbids it.

7.11 We do not sell your data

We do not sell your personal data and do not share it with anyone for advertising.

8. Service providers and where data is kept

We use companies that process data on our behalf.

Supabase Inc. and Cloudflare Inc. are US companies, even when the data is stored in Europe.

Not used today: identity-verification companies (such as Valify), WhatsApp (Meta), SMS, phone push notifications, payment gateways (such as Paymob) and app-store billing, AI photo enhancement, AI document checks, map services and analytics tools.

9. Transfers outside Egypt

• All your data is stored and processed outside Egypt. The reason: the providers we use offer no storage in Egypt or the region.
• Countries and regions:
  • Germany and the EU: the database and storage.
  • Cloudflare's global network: handling website requests (including ID photos before they are encrypted), the robot check, photo processing, sending email and short logs. This may include data centres in many countries.
  • The United States: some of Cloudflare's own logs.
  • The United States and other countries: GitHub and Anthropic.
  • Google's data centres around the world: the founder's mailbox, which receives the emails you send us and system alerts.
• Basis: your consent (a) at sign-up and before you send your account for review; and the transfer is needed to perform our contract (b).
• Safeguards: connections to our site are encrypted. ID photos, ownership and POA documents, and backups are encrypted. We do not store your full phone or ID number as text in the database: only a one-way fingerprint and the last 4 digits. But both numbers pass through our providers' systems in full when they are typed. And ID photos (kept 72 hours at most) and POA files show the full ID number, and are stored encrypted in the EU.
• If you refuse: we cannot create your account, because the service cannot work without this transfer.

10. How long we keep data

We keep data only as long as its purpose needs. There is no complete automatic deletion process yet. Some deletion is automatic, and some is done by hand by the founder. The table shows which.

When you delete your account:

• A 14-day grace period starts. Signing in during it cancels the deletion. We finish the deletion before day 30.
• For now, deletion is done by hand. When the date comes, the founder deletes your sign-in account, which automatically deletes your phone record (its fingerprint and last 4 digits) and your account review record. The founder then deletes the rest of your data by hand, or removes what identifies you, following the table above: your profile is replaced by a record saying it was deleted and when, and your message texts are replaced by "[deleted]".
• We keep only the categories that have their own period in the table, such as the ID-check result, consent, audit and access records, and viewing and application records. We remove what identifies you from them where we can.
• But the ID-check result stays, with your legal name, your ID-number fingerprint and its last 4 digits, for 12 months.
• Your data stays in the encrypted backups for up to 35 days.

11. Automatic decisions and the reliability score

Some decisions are made automatically by our systems. Here they are, and how to challenge them.

Reliability score: worked out automatically from your attendance, no-shows and cancellations. Owners see the score and counts only, not the details. The rules are published on the "Reliability" page in your account:

• If you miss a viewing, one of your free viewing places stays used for 7 days.
• 3 no-shows within 60 days: no bookings for 14 days.
• For owners: a score under 50 pauses their listings. If an owner does not show up, or cancels after the free-cancellation time, twice within 30 days, new bookings on all their listings pause for 14 days.
• Challenging it: dispute a no-show within 48 hours. For any other event, use "Ask for a review" within 7 days. The founder decides within 7 days.

Automatic safety steps:

• An urgent safety report (a threat or harassment) from someone who dealt with the reported person on the platform: the reported person's account is frozen at once, and their bookings and applications are cancelled. We usually review it before 10:00 the next morning, Cairo time. If the freeze is lifted, the account holder's viewing and application credits come back.
• Scam or broker reports add risk points when they come from an ID-verified person who dealt with the reported person. All of a lister's live listings pause when there is evidence in the chat, two independent reports, or a risk score of 60 or more. Only the founder can suspend for good or ban. To appeal a ban, write to ⁨wessamohsen@gmail.com⁩ within 7 days.
• Two fake-listing reports from two approved accounts: the listing pauses until it is reviewed.
• A listing whose owner does not answer "Still available?" within 72 hours pauses until the owner presses "Yes, still available".
• The chat filter refuses messages with contact details and, before an offer between the two people is accepted, messages that talk about commission or ask for payment before the viewing; each refused attempt adds risk points. See section 4.4.

ID check: automatic rules on what the founder records. See section 5.

Sign-up review: the founder decides. The signals only help him. If your request is declined you see the reason, and you can fix your details and apply again.

Your right to object: you can object to any of these outcomes by writing to ⁨wessamohsen@gmail.com⁩.

12. Your rights and how to use them

• Contact: ⁨wessamohsen@gmail.com⁩.
• Response time: we answer within ⁨6 working days⁩.
• Fees: we charge nothing for using your rights.

13. Age

The service is for people aged 21 or over. We check age during the ID check. If the person is under 21, the check is rejected, so the account cannot book, apply, chat or list a home. Please do not create an account if you are under 21.

14. Cookies and browser storage

We use only what the website needs to work:

• We use no advertising or analytics cookies and no trackers. Our fonts are served from our own servers, and we use no third-party maps.
• The admin console uses a Cloudflare Access session cookie. Only the founder uses it.
• You can delete these from your browser. Deleting the session cookie signs you out.

15. How we protect your data

• Every database table has rules that decide who can see each row. Private and audit tables cannot be reached directly from the internet.
• We never store your full phone or ID number as text in our database. We store only one-way fingerprints made with secret keys, and the last 4 digits. ID photos and POA files show the full ID number, and ownership papers may show it too. We keep these files encrypted, and ID photos for 72 hours at most.
• ID photos and ownership and POA documents are encrypted with a separate key per file, in storage restricted to the EU. Deleting a file and its key together means it cannot practically be recovered.
• The admin console has three locks: Cloudflare Access, then a password, then a code from an authenticator app. Image files open in a viewer that shows the viewer's email and the time as a watermark. PDF documents open in the browser itself. Our rules forbid downloading, photographing or forwarding these files, and every opening is logged. Every view of private data through the admin console is logged.
• Secure cookies, protection against forged requests, a content security policy and a robot check. The sign-up, sign-in, forgot-password and resend pages answer the same way whether or not an email is registered with us. Only the phone step tells you that a number is already in use.
• We remove camera and location data from listing photos and profile photos. ID photos and documents are stored exactly as uploaded, encrypted. We put no addresses, phone numbers or legal names in emails or notices.
• Backups are encrypted, and only a key the founder keeps offline can open them.
• Server secret keys live only on the servers, never in the website or your browser.
• No system is perfectly secure. If you notice a security problem, write to ⁨wessamohsen@gmail.com⁩.

16. If there is a breach of your data

If a breach affects your personal data:

• We tell the PDPC within 72 hours of becoming aware of it, and at once if national security is involved.
• We tell you by email within 3 working days of notifying the PDPC.

17. Data about other people

• The principal under a power of attorney: if an agent lists your home under a POA, we keep your Arabic name, a fingerprint of your ID number and its last 4 digits, the POA details, the POA file, encrypted (it shows your full ID number), and the certificate that the POA has not been revoked, encrypted, if the agent uploads one. We do not contact you directly. Only the founder sees this data. You have the same rights as in section 12. Write to ⁨wessamohsen@gmail.com⁩.
• Reports: if someone reports you, we keep the report and its content, and the founder sees it.

18. Changes to this notice

• Each version has a number and a date. This version: ⁨2026-10-21⁩. We record which version you agreed to.
• If we change this notice in an important way, we will tell you before the change applies, and ask for your consent again where needed.

19. Complaints

• Please contact us first at ⁨wessamohsen@gmail.com⁩, or our Data Protection Officer at ⁨wessamohsen@gmail.com⁩.
• You may complain to the Personal Data Protection Center, through its official channels. The PDPC decides complaints within 30 working days.
• This does not stop you from going to court.

20. Language

This notice is available in Arabic and English. If the two texts differ, the Arabic text prevails.