Privacy policy

1. Who we are

ReoSoft (short for Real Estate Operations Software) is a software company based in Dubai, United Arab Emirates. We operate the website reosoft.ai (the “Website”) and Mercato, a cloud platform for managing shopping malls and retail centres, together with related implementation and support (the “Services”). References to “we”, “us” and “our” are to ReoSoft.

This policy covers reosoft.ai and Mercato. Company details are in our legal notice.

We handle personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and, where it applies to a customer’s own operations, the data-protection law of the customer’s country, such as the Saudi Personal Data Protection Law or Egypt’s Law No. 151 of 2020.

2. Our role: controller and processor

Our role depends on the data.

• Controller. For data about visitors to the Website, people who contact us or book a demo, our customers’ staff who use the Services, and billing contacts, we decide why and how the data is used and are the controller.
• Processor. For the data our customers load into Mercato about their own retailers, tenants, owners, employees, suppliers and mall visitors, the customer is the controller and ReoSoft is the processor. We process that data only on the customer’s documented instructions, as set out in the Data Processing Agreement.

Customers are responsible for having a lawful basis, and where needed consent, for the data they enter, including visitor-marketing data collected through POS receipts or guest Wi-Fi.

3. Personal data we handle

Website and enquiries

• Details you type into the contact and demo forms: name, work e-mail, company, role, phone number if you give one, and your message.
• Correspondence with our sales and support teams.
• If you consent, analytics data about how the Website is used (see Cookies). Technical data such as IP address, browser type and request logs are processed by our hosting and security providers to deliver and protect the Website.

Customer accounts and billing

• User account details: name, work e-mail, role, permissions, language preference and sign-in history, including two-factor and passkey enrolment status.
• Billing contact and subscription details. Card payments are handled by Stripe; we do not store full card numbers.

Data inside Mercato (as processor)

Depending on how a customer uses the platform, this can include retailer and tenant company and contact details, lease, cheque, payment and tax records, sales declarations, owner and employee details, work orders, permits and documents, and, where the customer enables visitor marketing, visitor contact details, consent records and receipt or Wi-Fi activity. We do not use this data for our own purposes.

4. How we use personal data

• Respond to enquiries, schedule demos and provide onboarding and support.
• Create, provide, secure, maintain and improve the Services.
• Bill for subscriptions and keep financial records.
• Detect and prevent abuse, fraud and security incidents, and keep the audit trail the platform provides.
• Measure Website usage, only where you have consented.
• Comply with legal, tax, accounting and regulatory obligations, and establish or defend legal claims.

Our bases are performance of a contract or steps before entering one, our legitimate interest in running and securing a business-to-business service, compliance with legal obligations, and your consent where we ask for it (analytics). We do not sell personal data and we do not use customer data to train AI models.

5. Sharing and sub-processors

We share personal data only with providers that help us deliver the Services, under written confidentiality and data-protection terms, and with authorities where the law requires. The providers below may be involved; several apply only if the customer switches on the related feature.

The contact and demo forms may be received through a form-processing provider or by e-mail. We keep the sub-processor list current in the Data Processing Agreement and tell customers in advance of material changes.

We may also disclose data if required by law, court order or a competent authority, to respond to a security incident, or to protect the rights, safety and integrity of our customers, our staff and the platform. If ReoSoft is involved in a merger or sale of its business, data may transfer to the successor under the same commitments.

6. Hosting location and transfers

The hosting location of a customer’s deployment is agreed with that customer, and in-region hosting is available for customers with data-residency requirements. Some providers listed above, such as Stripe, Google, Anthropic, Meta and Twilio, may process data outside the customer’s country. Where personal data is transferred across borders, we do so as the PDPL and the applicable local law permit, using contractual safeguards and limiting transfers to what each feature needs.

7. Retention

• Customer data in Mercato is kept for the life of the subscription and then returned or deleted as the customer instructs. Customers can export their data at any time and for a limited period after termination, as the Terms of Service describe.
• Visitor-marketing data is kept for 24 months by default and then anonymised automatically; the customer can set a different period.
• Backups are automated and scheduled, with off-site copies, and are overwritten on a rolling cycle.
• Enquiries and demo requests are kept for as long as needed to follow up and for a reasonable period afterwards.
• Billing and accounting records are kept for the period required by tax and commercial law.

8. Security

We use administrative, technical and organisational safeguards designed to protect personal data. They include:

• per-company data isolation enforced in the database with PostgreSQL row-level security;
• encryption in transit with TLS; documents stored with server-side encryption, and sensitive credentials encrypted at the application level;
• two-factor authentication (TOTP), passkeys and single sign-on through OpenID Connect;
• role-based permissions with property-level access, and an audit trail of activity;
• automated scheduled database backups with off-site copies.

No online service can guarantee absolute security, so customers should also use strong credentials, least-privilege roles and their own internal controls. If we become aware of a personal-data breach affecting our customers, we will notify them without undue delay so they can meet their own obligations. More detail is on our security page.

9. Your rights

Subject to applicable law, individuals may ask to access, correct, delete, restrict or receive a copy of their personal data, to object to certain processing, to withdraw consent at any time, and to complain to the competent data-protection authority.

• For data we hold as controller, write to info@reosoft.ai. We will respond within the time the law allows.
• For data held in Mercato by one of our customers, the customer is the controller. If you contact us about such data, we will pass your request to the customer and help them respond. The platform includes data-subject export and erasure tools for that purpose.

We may need to verify your identity before acting on a request.

10. Cookies

The Website sets no cookies by default. If you consent, Google Analytics sets analytics cookies; your choice is stored in your browser and can be changed at any time from “Cookie settings” in the footer. Details are in the Cookie policy.

11. Changes to this policy

We may update this policy as our Services or the law change. The effective date is shown at the top of the page, and we will give customers notice of material changes in advance.

12. Contact

For privacy, data-protection, legal or security requests, write to info@reosoft.ai or use our contact page.

Related documents: Terms of Service, Data Processing Agreement, Acceptable Use Policy, SLA and support.