Legal
Privacy Policy
What this website collects, why, who processes it, and how to ask us to delete it.
Last updated
Who we are
This policy covers smart-bricks.com, the Smart Bricks marketing website. The Smart Bricks platform at app.smart-bricks.com is a separate product with its own terms and privacy notice, which apply when you use it.
The controller of the data described here is Smart Bricks AI Limited, a company registered in the Dubai International Financial Centre (DIFC), United Arab Emirates. Its registered address is DIFC Gate Avenue, Level 1, Zone C, Office #170, Zaa'beel Second, DIFC, Dubai, United Arab Emirates. Privacy questions go to privacy@smart-bricks.com, which reaches the person responsible for data protection at Smart Bricks.
What this website collects
Here is everything this website collects. Job applications have their own section below.
| What | When | Why |
|---|---|---|
| Your full name, work email, client type and what you are interested in (required); your investable capital range (required only if you tell us you are an individual investor); and, if you choose to give them, your company, role, a message, how you heard about us and the answers to the questions for your client type (for an investment firm, lender, developer or advisor: a size range for your real estate assets, loan book, projects or client assets, the markets you work in, and a deal, loan, site or mandate you describe) | Only when you send the contact form | To read your request, pass it to the right person and reply. Without the required fields the form cannot be sent |
| Whether you tick the box asking for product news by email and, if you then confirm it, the record of your confirmation (see Marketing) | When you send the contact form, and when you use the confirm link | To send you product news only if you asked for it and confirmed it, and to be able to show that you did |
| The campaign tags in the link that brought you to the site (utm_source, utm_medium, utm_campaign, utm_term, utm_content, or a Google Ads click ID: gclid, gbraid or wbraid) | Only if you allow statistics in the cookie banner, and only when you send the contact form | To know which campaign brought your request. The tags are kept with your request and with your contact in Infobip (see Marketing) |
| A request ID your browser makes for the form, the page you sent it from and how long the form was open before you sent it | Only when you send the contact form | To avoid handling the same request twice, to spot automated submissions, and to match a delivery report to your request |
| Whether the confirmation email we sent you was delivered: a delivery report from Infobip about that email, which includes your email address, the delivery status and the request ID. We keep nothing from it: we read the status and pass only the request ID to our team, and we never store your address from it | After we send you the confirmation email | To tell our team when a confirmation could not be delivered, usually because of a mistyped address |
| Technical signals from your browser, checked by an automated bot test (Vercel BotID) | The check is set up on every page and runs when you send a form | To keep out automated spam and abuse |
| The page address, the referring site, your approximate location (country, region and city, worked out from your IP address, which is not kept), browser, operating system and device type, plus a code that groups repeat views on the same day and is discarded after 24 hours | On every page view | To see which pages are read, in aggregate |
| A random identifier stored in your browser that links your visits, the pages you view, the buttons and links you click, your IP address (used to estimate your city and country), browser, device and referring site | Only if you allow statistics in the cookie banner | To understand how people use the site and improve it |
| A second random identifier stored in your browser by Google Analytics that links your visits, the pages you view and what you do on them (such as scrolling, clicking a link to another site or downloading a file), how you reached us (the referring site and any campaign tags in the link), your approximate location (worked out by Google from your IP address, which Google Analytics does not store), browser, device, screen size and language | Only if you allow statistics in the cookie banner | To see how people find the site and which pages they read, so marketing can tell what works. Advertising features are off: this data is not used to show you ads |
| Your consent choice, a consent ID, the date and time, a shortened IP address, your browser and the page you were on | When you answer the cookie banner | To record your choice and be able to show what you chose |
| IP address, user agent, requested URL and timestamp | On every request, in server and CDN logs; when you send the contact form, your IP address is also held in our server’s memory for about an hour | To keep the site up, to investigate abuse and to limit how many requests one address can send |
We do not collect special category data and we do not sell personal data.
Job applications
If you apply for a role from our careers page, you complete your application on WhiteCarrot, the hiring platform we use, at app.whitecarrot.io. The details you give there (such as your name, email address, CV and links) are stored with WhiteCarrot, and we use them only to assess your application.
We keep an application for up to 12 months after the role is filled or closed, so we can contact you about a similar role, and then delete it. We keep it longer only if you agree. To see your application, or to have it deleted sooner, write to privacy@smart-bricks.com.
Marketing
We do not add you to marketing emails because you contacted us or applied for a job. If we ever want to send you news, we will ask first, and every email will let you unsubscribe.
The contact form has a box you can tick to receive product news from Smart Bricks by email. It is unticked unless you tick it, and leaving it unticked changes nothing about how we answer your request. If you tick it, the confirmation email we send you has a link to confirm it, which works for 30 days. We send you no product news until you use that link and press the button on the page it opens; if you never do, you get no product news.
We keep each contact form request as a contact in Infobip, the platform we use to send email (unless you were already a contact there, as explained below): your name, email address, company and role, the options you picked in the form, any campaign tags and the date of your latest request, but not your message, the markets you work in or the deal, loan, site or mandate you describe. If you tick the product news box, the contact is marked as waiting for your confirmation; when you confirm with the link in the email, we record that you agreed, the date, the wording you agreed to, the page you were on and which request it came with.
If you did not ask for product news, or asked but never confirmed it, we delete the contact 24 months after your latest request. If we have no record of when that was, we count from the day the contact was created. If you were already a contact of ours in Infobip before you used the form (for example as a customer), the form never writes your name or any of your answers onto that contact: it only marks that you used the form, and when. We never delete that contact under this rule: after the 24 months we take the form’s marks and the date off it again, and only a note that the contact existed before the form stays. If you confirmed, we keep the contact while you are subscribed, so we can send you product news. Every product news email has an unsubscribe link; once you use it, you stop receiving product news. Unsubscribing does not delete the contact: we keep it, with the record of your consent and that you withdrew it, until you ask us to delete it at privacy@smart-bricks.com.
You can withdraw your consent to product news at any time, with the unsubscribe link or by writing to privacy@smart-bricks.com. Withdrawing does not affect the emails we sent before.
Cookies
When you first arrive you are asked what may be stored on your device. Until you answer, nothing that needs your consent runs: no analytics cookie, no advertising tag, no session recording. Two tools are not part of the question: the cookieless tool that counts page views and stores nothing on your device, and the bot check that protects our forms.
The full list of tools, what each stores, and how to change your answer at any time is on the cookie policy page. The Cookie settings link at the bottom of every page opens your choice again.
Who processes it for us
| Processor | What they handle | Where | How a transfer is covered, as the processor publishes it |
|---|---|---|---|
| Vercel Inc. | Website hosting, content delivery and server logs; cookieless website analytics; an automated bot check when a form is sent; a private backup of a contact form submission that could not be delivered to our team (see How long we keep it) | United States and its global edge network | Standard contractual clauses (EU, with the UK addendum) in Vercel’s data processing addendum; Vercel is also certified under the EU-US Data Privacy Framework and its UK extension |
| Cookiebot (Usercentrics A/S) | Asking for and storing your consent choice | European Union | As set in its data processing terms |
| PostHog Inc. | Product analytics, only after consent. The same PostHog project measures the Smart Bricks platform, so if you also use the platform, your website visits may be linked to your platform account | United States | As set in its data processing agreement |
| Google Ireland Limited and Google LLC | Website traffic reporting (Google Analytics 4), only after consent, with Google signals and ad personalisation off. Google Ireland Limited is the processor for visitors in the European Economic Area, the UK and Switzerland; the data is transferred to and processed by Google LLC in the United States | United States | As set in Google’s data processing terms |
| Infobip (Infobip Limited, UK, or the Infobip company named in our contract) | Delivery of the email generated by the contact form, which holds every answer you gave in it and any campaign tags, and of the confirmation email we send you; delivery reports for the confirmation email; keeping each request as a contact (see Marketing) | European Union by default | Kept in Infobip’s EU data centres unless we agree otherwise; standard contractual clauses where a transfer needs them, under Infobip’s data processing agreement |
| Slack Technologies Limited (Ireland) | A copy of each contact form submission, with every answer you gave in it and any campaign tags, posted to our team’s Slack channel so the team sees new requests; a note naming only the request ID when a confirmation email bounces | United States, or the data region the workspace has chosen | Standard contractual clauses (EU, and the UK equivalent) in Slack’s data processing addendum |
| WhiteCarrot | Job applications: the application form, CVs and our hiring pipeline, at app.whitecarrot.io | WhiteCarrot’s data centres, as set in its data processing terms | As set in its data processing terms |
| Google (Workspace) | The mailbox that receives contact form submissions | Google’s data centres, as set by Google Workspace | Standard contractual clauses, or another transfer solution Google has adopted, under Google’s Cloud Data Processing Addendum |
The last column says what each processor’s own published terms offer. Those terms are written mainly for transfers out of the EU and the UK. Smart Bricks is based in the DIFC, and some of these processors store data outside it, mainly in the United States (Vercel, PostHog, Google, Slack) and the European Union (Cookiebot, and Infobip by default). Where the law requires it for a country that is not recognised as giving adequate protection, we put approved safeguards in place with the processor, such as the DIFC standard contractual clauses under Article 27 of the DIFC Data Protection Law (DIFC Law No. 5 of 2020) and, for visitors in the EU or UK, the EU standard contractual clauses with the UK addendum, or the EU-US Data Privacy Framework where the processor is certified. To get a copy of the safeguards that apply, write to privacy@smart-bricks.com.
How long we keep it
A contact form submission is sent by email to our team mailbox (info@smart-bricks.com), posted to our team’s Slack channel, or both. The contact form keeps no database of its own: the places below are the only copies.
| What is kept, and where | How long |
|---|---|
| The email with your request in our team mailbox, and the copy in our team’s Slack channel | We aim to delete them 24 months after our last exchange with you, unless they become part of a business relationship with you |
| The emails the form sends, at Infobip, which delivers them | The content for 2 days and the delivery logs for 3 months, by Infobip’s default |
| Your contact in Infobip (see Marketing) | If you did not confirm product news: deleted by a daily job 24 months after your latest request (or after the day the contact was created, if we have no record of your latest request); a contact that existed before you used the form is kept, as Marketing explains. If you confirmed: kept while you are subscribed, and after you unsubscribe until you ask us to delete it |
| A private backup of your request at our hosting provider (Vercel Blob), made only if neither our email nor our Slack channel could take it when you sent it | Deleted by a daily job once it is 30 days old |
| A private copy of what we store in your contact in Infobip, at our hosting provider (Vercel Blob), made only if Infobip could not take it when you sent your request | Deleted by a daily job once Infobip has it, or once it is 7 days old |
| The link in the confirmation email that confirms product news | Stops working after 30 days |
| The signed address Infobip uses to send us the delivery report for your confirmation email, which names only the request ID | Stops working after 14 days |
| The addresses that were sent a confirmation email, in our server’s memory, so the form cannot be used to fill someone’s inbox | 24 hours |
| Server and CDN logs | No more than 30 days, unless we need them longer to investigate a specific security incident |
| Analytics data collected in PostHog after your consent | Up to 24 months, then deleted |
| The data Google Analytics links to your browser’s ID | At most 14 months, the longest Google offers for a standard property, then deleted |
| Job applications | As described under Job applications above |
Infobip’s periods are set out in its data retention notice.
When the email to our team has gone, we also send you one confirmation email at the address you gave, through Infobip. It repeats only your first name, your client type, what you are interested in and the asset classes you ticked, and, if you ticked the product news box, the link to confirm it. None of the emails the form sends carries open or click tracking.
Cookieless page-view counts are aggregate and hold nothing that identifies you. How long each tool’s cookies last on your device is on the cookie policy page.
Your rights
Wherever you live, you can ask us to:
- tell you what personal data of yours we hold
- give you a copy of it
- correct it if it is wrong
- delete it
- stop using it, or restrict how we use it
- object to us using it for our legitimate interests
- give you your data in a structured, machine-readable format, or send it to another organisation
Write to privacy@smart-bricks.com. We will answer within one month, and tell you if we need longer. If you are not satisfied you can complain to the DIFC Commissioner of Data Protection, or to the data protection authority where you live or work.
We do not make decisions about you by automated means alone, and we do not profile you in ways that have legal or similarly significant effects on you.
Our lawful basis
For each thing we do with your data, this is what makes it lawful:
| What we do | Lawful basis |
|---|---|
| Reading your contact form request, passing it to our team by email and Slack, answering it and sending you the confirmation email | Taking the steps you asked for before a possible contract with us, and our legitimate interest in answering people who write to us |
| Keeping your request as a contact in Infobip for up to 24 months after your latest request | Our legitimate interest in following up on your request and knowing who has already been in touch. You can object at any time |
| Sending you product news by email | Your consent, given by ticking the box and confirming it with the link in the confirmation email |
| Keeping the record of your product news consent | The legal duty to be able to show that you agreed |
| Keeping your contact after you unsubscribe from product news, until you ask us to delete it | Our legitimate interest in being able to show that you agreed and when you withdrew, and in not emailing you product news again. You can ask us to delete it at any time |
| Reading the campaign tags in the link that brought you and keeping them with your request | Your consent to statistics in the cookie banner |
| Keeping a private backup of a request our team could not receive, and telling our team when a confirmation email bounces | Our legitimate interest in not losing your request and in reaching you at the address you meant |
| The bot check on forms, the limit on requests from one address, and server logs | Our legitimate interest in keeping out spam and abuse and keeping the site running |
| Cookieless page-view counts | Our legitimate interest in understanding which pages are useful |
| Analytics in PostHog and Google Analytics | Your consent, given in the cookie banner |
| Job applications | Taking the steps you asked for before a possible employment contract, and our legitimate interest in hiring |
Where we rely on your consent, you can withdraw it at any time: for analytics and campaign tags, from the Cookie settings link at the bottom of every page; for product news, with the unsubscribe link in any product news email. Withdrawing does not affect what was collected before you withdrew.
US state privacy rights
We do not sell your personal information or share it for cross-context behavioural advertising, as California law defines those terms, and we do not use sensitive personal information. California residents can ask to know, correct or delete their personal information by writing to privacy@smart-bricks.com, and we will not treat you differently for asking.
Changes
When this policy changes we update the date at the top of this page. Material changes will be called out here for a reasonable period after they take effect.
(to be confirmed): this policy now gives the lawful basis for each use of your data, how long each copy is kept and how each processor covers transfers. It now says that a product news request you never confirm is deleted with your contact after 24 months, and that unsubscribing stops product news but does not delete your contact unless you ask.
13 October 2026 (later the same day): product news now needs your confirmation through a link in the confirmation email (double opt-in), and a submission that could not be delivered to our team is kept in a private backup for 30 days.
13 October 2026: the contact form now sends you a confirmation email, asks whether you would like occasional product news, and, if you allow statistics, tells us which campaign link brought you. Each request is now also kept as a contact in Infobip, with your product news choice.
11 October 2026: the email the contact form sends is now delivered by Infobip instead of Resend, and Slack was added so our team is notified of each submission.