01
Who we are and what this policy covers
Ettihad Software, registered with the Netherlands Chamber of Commerce under KVK number 42130162, operates the Ettihad app and the ettihad.org website under the Ettihad trade name (“Ettihad”, “we”) and is the controller responsible for the personal data described in this policy. Its registered business address is Morgen 8, 2408 RL Alphen aan den Rijn, Netherlands. There is no public access at this address; visits are by appointment only. This policy covers the mobile app, the website — including public invite and payment-information pages — and our support channels.
Ettihad currently supports buildings and communities located in Egypt, Saudi Arabia, the United Arab Emirates, Jordan, Qatar, Iraq, and Lebanon. Managers and members may access their communities while living or travelling in other countries, subject to local availability and applicable law.
02
Information we collect
We collect the following categories of information:
- Account and profile details: your name, email address, any phone number you choose to add, and your profile photo.
- Community and financial records created in your communities: units and unit numbers, dues, credits, settlements, payment-proof images, and the payment-method details your community configures (such as the account names and numbers used to receive payments).
- Content you share in a community: announcements, comments, votes, reviews, service requests, and file attachments.
- Contacts you choose to share: if you use the contact-based invite picker, Ettihad reads your device contacts on your device and uploads only the contacts you select in order to send invites.
- Voice messages: voice messages you record for the AI assistant are uploaded so the assistant can process and transcribe them.
- Live voice (Fary-live): if you start Fary-live, your microphone audio is streamed for the live conversation only; we do not record or store it.
- Device and security data: sign-in identifiers, push-notification tokens, the device model and operating-system details of devices linked to your account, IP addresses, security and audit logs, and the verification codes we send you.
- Usage and diagnostics: app analytics and crash reports needed to keep the service reliable.
- Support correspondence: messages you send to our support channels.
03
How we use information
We use information to operate the community-management service, connect you to the right communities, record and track dues and payment submissions, send notifications, provide support, improve reliability, diagnose failures, and protect the service from abuse. Ettihad does not process payments and never holds or transfers money — members pay their communities directly, and the app only stores the resulting records and proof images.
Not all information comes from you directly. Your community's managers may enter information about you — for example your unit number or amounts owed — and may do so before you join the app. Other members may also post content about community activity that mentions or concerns you, such as announcements or comments. Managers must be authorized by their community to enter this information and may use it only for community purposes.
After you create a community, we may ask an optional, one-time question about how you first heard about Ettihad. We store your selected source, or a completion or decline marker if you prefer not to answer, so we do not ask you again, and use answered responses only for aggregate analysis of which outreach channels are effective.
04
Legal bases for processing
We process personal data on the following legal bases:
- To provide the service you signed up for — operating communities, memberships, dues, financial records, and notifications (performance of our agreement with you).
- To meet our legal obligations — keeping records the law requires us to keep and responding to lawful requests from authorities.
- For our legitimate interests, balanced against your rights — securing the service, preventing abuse, and diagnosing failures.
- With your consent — AI features, including Fary-live (a consent you can withdraw at any time in the app), contacts you choose to share for invites, and the optional question about how you first heard about Ettihad.
05
AI features
Some Ettihad features send what you submit to Google Gemini, a third-party AI service operated by Google. We ask for your permission first, and nothing is sent to Google until you agree.
For community managers, the AI assistant receives the messages and voice recordings you send it, your account and contact details (your name, email address, and any phone number on your account), your community's profile and address, its membership and financial totals, and the community records the assistant looks up to answer your request — which can include other members' records. Receipts, payment proofs, and invitation screenshots are sent as images, together with the amount, currency, due date, and the name of the account your community has configured to receive payments.
This content is used only to produce what you asked for: an assistant reply, extracted receipt details, a payment-verification suggestion, or invitation details. The AI does not confirm that a payment is genuine and does not decide anything on its own — a manager reviews the result.
Ettihad uses this content only to provide the AI feature you requested; we do not use it to train any model, sell it, or use it for advertising. Under our contract with Google, Google does not use this content to train or improve its AI models, and does not keep what we send or the responses after producing the result — apart from a short-lived, project-isolated technical cache of up to 24 hours. Google also does not log this content for human review. Google's handling of this content is further governed by the terms of the Google services we use and by Google's privacy policy linked below.
On our side, when you delete an AI conversation it is removed right away; any conversation you do not delete expires automatically about 24 hours after your last activity in it, and voice recordings are deleted from storage within 24 hours of upload. Receipts and payment proofs are kept with your community's financial records, and the outcome of an AI check is stored with the payment record.
Fary-live is an optional live voice conversation with Fary, our AI assistant — an AI, not a person. When you start it, your microphone audio and the community information Fary needs to answer you pass through a voice transport provider to Google as our AI provider. We do not record or store Fary-live audio or a transcript of what you say, and recording is switched off at the voice transport provider. Google may keep Fary-live audio and context for up to 24 hours, under the same commitments described above.
We keep the text Fary speaks and the results of the lookups Fary makes for you for about 24 hours after your last activity, like other AI conversations, unless you delete the conversation sooner. Ettihad does not create voiceprints and does not use voices to identify or verify who is speaking. People near you may be heard, so use Fary-live where others will not be captured without their knowledge.
Fary-live relies on your separate consent: the AI data-sharing permission plus the Fary-live notice you accept before you use it. Withdrawing AI data sharing, as described below, also turns off Fary-live.
You can withdraw your permission at any time in the app, under Settings → Privacy → “AI data sharing”. The rest of Ettihad keeps working: you can still attach receipts and submit payments, and your community's managers review them instead of AI.
Withdrawing takes effect promptly and stops future AI processing, including work that was queued but had not yet been sent. It cannot undo processing that already happened — content sent to Google while your permission was active cannot be recalled. To ask us to delete AI-related content we still hold, or your data generally, contact dpo@ettihad.org or delete your account from the app.
06
Address search and maps
Address-search suggestions when you create or update a community are provided by Google. Your search text is sent to Google through our servers to return suggestions; your name, account details, and network address are not included in those requests.
The map view itself uses OpenStreetMap: map images load directly from OpenStreetMap's servers onto your device, so those servers receive your device's network address and the map area you view. When you drop a pin, the address lookup for that point runs through our servers using OpenStreetMap's lookup service.
07
Sharing and service providers
We share personal data only with the service providers that help us run Ettihad — hosting, authentication, file storage, notifications, email delivery, analytics, crash reporting, and AI features — and only for that purpose. These providers act on our instructions. The mapping provider described above acts under its own privacy policy. We may also disclose information where the law requires it or to protect the service, and the members and managers of your community can see the community records their role allows.
For Fary-live, a voice transport provider carries the live audio to Google as our AI provider. Both act on our instructions under their agreements with us.
We do not sell personal data, we do not use it for third-party advertising, and we do not track you across other apps or websites.
08
Where your data is stored
Your data is processed and stored in secure data centers that may be located outside your country of residence, including in Belgium (European Union) and the United States; for AI features, content may be processed in Google data centers in other regions that are not confined to a single country. We transfer data under contractual safeguards with our service providers, and only to the extent the transfer is necessary to operate the service you asked us to provide. Wherever your data is stored, we apply the same protections described in this policy, including encryption in transit and at rest.
On its way to Google, Fary-live audio may pass through countries outside your country of residence.
09
Retention and deletion
We keep data only as long as it is needed: account data for as long as your account exists; community financial records for as long as the community needs them plus any legal or accounting retention period that applies; AI assistant conversations until about 24 hours after your last activity in them, and voice recordings for at most 24 hours after upload; and security logs and backups for limited periods after which they expire automatically.
Fary-live: we keep no audio and no transcript of what you say; the text Fary speaks and the results of its lookups are kept for about 24 hours after your last activity, or less if you delete the conversation.
When you delete your account, your personal identifiers — name, email address, any phone number you added, profile photo, sign-in identifiers, and notification tokens — are removed. Financial ledger entries needed for the community's accounting are kept, but without a direct link to your identity.
10
Security
We protect information with technical and organizational measures, including encryption in transit and at rest, access controls, and security logging and monitoring. No online service is completely risk free. If a data breach affects you, we will notify you and the relevant authorities where the law requires it.
11
Your rights and choices
You can access, correct, or delete your account data from the app, or ask us to at dpo@ettihad.org. Depending on where you live, you may also have legal rights to access, correct, or delete your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to your local data-protection authority. We respond to requests within the periods required by the law that applies to you.
You may complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Local law may also let you complain to the authority where you live: in Egypt, the Personal Data Protection Center (PDPC), including by email to info@pdpc.gov.eg; in Saudi Arabia, the Saudi Data and Artificial Intelligence Authority (SDAIA); in the United Arab Emirates, the UAE Data Office, whose complaint procedures are still being established; and in Jordan, Qatar, Iraq, and Lebanon, the authority designated by your national data-protection law, where one exists.
12
Children
Ettihad is intended for adults and requires users to be at least 18 years old. We do not knowingly create accounts for, or collect personal data directly from, anyone under 18. If you believe a child is using the service, contact us at support@ettihad.org and we will remove the account.
13
The website and local storage
The website does not use third-party advertising cookies or trackers, and it does not follow you around the internet. It stores small preferences — such as your language choice — in your browser's local storage, and keeps standard security server logs (including IP addresses and the addresses of pages you request) for a short period. On our own pages only, we collect campaign measurements — visits, clicks, and usage, including which campaign brought you here — for our own analysis: no cookies, no advertising identifiers, no fingerprinting, no third-party analytics, and no visitor profiles; any ad-click identifier is immediately replaced with a keyed, irreversible hash, and these campaign records — which contain no name, account, or advertising identifier — are kept for up to 13 months. We also collect first-party, non-advertising measurements of how our invite and payment pages are used; if you look up an amount due through a shared payment link, the unit number you enter is used only to show the amounts and payment instructions for that unit. A payment link made for one unit asks for a 6-digit code instead; the code you enter is used only to open that unit's amounts and is not stored.
14
Changes to this policy
We may update this policy from time to time. The date at the top of this page shows the latest version. For material changes, we will give notice in the app or by email before the change takes effect.
15
Contact
Ettihad Software — KVK 42130162, registered business address Morgen 8, 2408 RL Alphen aan den Rijn, Netherlands. There is no public access; visits are by appointment only. For privacy questions, requests about your data, or complaints, contact dpo@ettihad.org, or support@ettihad.org for anything else. If you are not satisfied with our response, you can contact the Dutch Data Protection Authority or the data-protection authority in your country, including those listed under “Your rights and choices”.
If you would rather read the same commitments in plain words, our privacy commitment page explains what we do with your data and what we refuse to do with it.