Kenza Living

1. Introduction

Harmony Evolution Works FZE LLC, operating Kenza Living ("we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Kenza Living mobile application ("the App").

We encourage you to review this policy carefully. Your continued use of the App means you accept these practices. If you have concerns, please contact us, review our Terms of Service, request account deletion through Delete Account, or adjust your privacy settings within the App.

2. Information We Collect

2.1 Personal Information

We collect information you provide directly to us, including:

• Full name
• Date of birth (for age verification)
• Email address and phone number
• Unit/property address within the community
• Profile photo (optional)
• Family member details (name, relationship, phone number, date of birth)
• Vehicle information (make, model, plate number, color)
• Staff linkage and employment details

2.2 Visitor Information

When you create visitor passes, we collect:

• Visitor name and phone number
• Purpose of visit
• Date and time of expected arrival
• Vehicle plate number (if applicable)

2.3 Automatically Collected Information

When you use the App, we automatically collect:

• Device platform (iOS or Android)
• Push notification token (for delivering notifications)
• Activity logs (login times, actions performed within the App)

2.4 AI Assistant

When you use the AI assistant feature, every message you send is transmitted to our servers and forwarded to Google Gemini, our third-party AI provider, for processing. Google Gemini processes your message and returns a response; its handling of submitted content is governed by Google's applicable service terms and data-processing commitments. Your conversation history is stored on our servers to maintain context across sessions and to enable features such as amenity booking and service ticket creation through the assistant. A recent copy of your conversation is also cached locally on your device for faster loading. You can clear your local conversation cache at any time using the "New Conversation" button within the AI assistant.

3. Third-Party Data

The App allows you to submit personal data about other individuals, including family members, visitors, and household staff. These individuals are also data subjects under applicable law. By providing their information, you confirm that you have obtained their consent or have the legal right to share their data with us. We recommend informing these individuals that their data is being collected and directing them to this Privacy Policy. If any such individual wishes to exercise their data rights, they may contact us directly at the email provided below.

4. How We Use Your Information and Legal Basis

We use the information we collect for the following purposes. For each use, we indicate the legal basis under the UAE Personal Data Protection Law (PDPL):

• Verify your identity and community membership -Contractual necessity (required to provide the service)
• Process visitor access requests and generate QR codes -Contractual necessity
• Manage service requests and maintenance tickets -Contractual necessity
• Send push notifications for visitor arrivals, approvals, community announcements, and ticket updates -Consent (you can disable notifications at any time through device settings)
• Provide AI-assisted community support, including amenity booking and ticket creation through the assistant -Consent (use of the AI assistant is optional)
• Translate content between English and Arabic -Contractual necessity (required for bilingual service delivery)
• Maintain audit logs of actions performed in the App -Legitimate interest (community security and safety)
• Ensure community security and safety, including gate access records -Legitimate interest
• Verify your age using your date of birth to ensure compliance with age restrictions (18+ for account creation) -Legal obligation (UAE CDS Law No. 26 of 2025)
• Process content reports and user blocks to maintain community safety on the community wall -Legitimate interest (community safety and content moderation)
• Comply with legal obligations under UAE law -Legal obligation

5. Information Sharing and Disclosure

We may share your information with:

5.1 Community Management

Community administrators and security guards who need access to manage gate access, verify residents, and maintain community safety.

5.2 Service Providers

Third-party services that help us operate the App:

• Amazon Web Services (cloud hosting and file storage)
• Google Gemini (AI assistant and translation services)
• Expo (push notification delivery)

Each service provider processes data only as necessary to perform their function and is bound by their own privacy and data protection policies.

5.3 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

6. Data Security

We implement industry-standard technical and organizational measures to protect your personal information, including:

• Encryption of all data in transit
• Secure authentication and session management
• Strong password hashing
• Role-based access controls
• Security headers and protections against common web vulnerabilities

We use reasonable safeguards to protect your data and continuously monitor, review, and improve our security practices to safeguard your information.

7. Data Storage and Retention

7.1 On Your Device

Your preferences, app settings, and a cached copy of recent AI conversations are stored locally on your device. You can clear this data at any time through the App or by uninstalling it.

7.2 On Our Servers

The following data is stored on our servers with the indicated retention periods:

• Account information (name, email, phone, profile) -Retained while your account is active, deleted 30 days after account deletion request
• Visitor logs and entry records -Retained for 12 months from the date of visit, then automatically purged
• Service and maintenance tickets -Retained for 24 months from ticket closure, then anonymized
• Family member and vehicle records -Retained while your account is active, deleted with your account
• Staff linkage records -Retained while the linkage is active, deleted when unlinked or upon account deletion
• Amenity booking history -Retained for 12 months from the booking date
• AI conversation history -Conversation history is retained for 7 days, after which it is automatically deleted; all conversations are also permanently deleted upon account deletion
• Audit logs -Retained for 24 months for security and compliance purposes

7.3 Hosting, Backup, and Cross-Border Data Transfers

Kenza Living is operated for UAE residential communities. Primary production hosting and personal-data processing are intended to be in the UAE, with Mumbai, India used only as backup, disaster-recovery, service-continuity, technical-support, or temporary operational-continuity infrastructure where required and legally permitted.

UAE personal data protection law regulates cross-border personal-data transfers; it does not automatically prohibit every transfer outside the UAE. Where necessary for security, backup, disaster recovery, technical support, service continuity, app-store operation, push notifications, AI processing, or legal compliance, limited personal data may be transferred to or processed outside the UAE subject to appropriate safeguards.

• AWS infrastructure outside the UAE -Used only where needed for backup, disaster recovery, service continuity, technical support, or temporary operational continuity
• Google Gemini -AI assistant and translation processing
• Expo -Push notification delivery
• Apple and Google -App-store review, distribution, crash/reporting, and platform services

Emirates ID and identity-verification data should be minimized and used only for eligibility, security, legal, or community-authorized operational purposes. We do not intentionally send Emirates ID images or full identity documents to AI services unless a future feature expressly requests it for a lawful operational purpose with appropriate disclosure.

7.4 Account Deletion

You may request account deletion inside the App from Profile or Privacy Settings, or from the public Delete Account web page. Upon account deletion, your data will be scheduled for removal with a 30-day grace period during which you may cancel the deletion. After this period, your personal data is first anonymized and then permanently deleted from our systems.

8. Your Rights

Under the UAE Personal Data Protection Law, you have the following rights:

• Right of access -Access and export your personal data (available in the App under Privacy Settings)
• Right to rectification -Request correction of inaccurate or incomplete personal data
• Right to erasure -Request deletion of your account and all associated data
• Right to restrict processing -Request that we limit how your data is used in certain circumstances
• Right to data portability -Receive your personal data in a structured, commonly used format
• Right to object to automated decisions -Object to decisions made solely through automated processing that significantly affect you
• Right to withdraw consent -Withdraw your consent at any time for processing activities based on consent, without affecting the lawfulness of processing carried out before withdrawal

To exercise these rights, use the Privacy Settings within the App, visit Delete Account for account deletion requests, or contact us at the email below. We will respond to your request within 30 days.

9. Push Notifications

The App uses push notifications to alert you about visitor arrivals, access approvals, community announcements, and ticket updates. You can manage notification permissions through your device settings at any time.

10. Children's Privacy

Kenza Living is not intended for independent use by anyone under 18. Users under 18 are not permitted to create independent accounts or use resident, staff, guard, admin, service provider, AI assistant, amenity booking, visitor approval, or other operational features in their own name. A minor may be added or managed only by a verified parent, guardian, resident, or authorized community representative where a feature permits it and where the adult has the required authority. If we learn that an under-18 person has created an independent account or provided personal information without proper authority, we may restrict the account and delete or de-identify the information subject to lawful retention obligations.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy in the App and updating the "Last Updated" date.

Your continued use of the App after any changes indicates your acceptance of the updated Privacy Policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

13. UAE Data Protection Compliance

We comply with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and its implementing regulations. This includes maintaining appropriate technical and organizational measures, providing transparency about data processing, honoring data subject rights, and ensuring lawful cross-border data transfers. For questions about our compliance practices, please contact us at the email above.