Privacy Policy

Belvair AI LLC provides Ryselist. We decide how personal information is used for our own business activities, including accounts, support, security and marketing. When we process personal information in property submissions on an agency's instructions to provide its listing service, the agency determines the purpose of that submission and we process the information for that work.

Agencies must have authority to provide information about their staff, clients, property contacts and anyone shown or heard in submitted media. The responsibilities for a particular activity depend on how the service is used. Any agreed data-processing terms form part of the agency arrangement. This policy covers the website, portal, property submissions and communications with Ryselist, including WhatsApp.

Belvair AI LLC is the controller for the account and security records described below. This means we decide why and how to use them to protect the Service, prevent misuse and handle legal claims. This is separate from processing property submissions on an agency's instructions. Contact us at hello@ryselist.com or 1111B S Governors Ave, Suite 59942, Dover, Delaware 19904, USA.

We may collect business contact and account information, including your name, work email address, phone number, agency, role and portal activity; order and service information, including the services requested, instructions and transaction status; property information, including listing links, community, building or project, property type, price, size, occupancy, furnishing and other listing facts; content you submit, including walkthrough videos, photos, floor plans, notes, change requests and attachments; communications with us; and technical information such as IP address, browser or device information, timestamps, security events, diagnostic data and cookie or similar identifiers. Submitted media may include images, voices or other information about people shown in or connected with a property. Payment providers process card and bank details under their own terms and privacy notices, and we may receive related records such as payment status and transaction identifiers.

We record sign-ins, invitations and activity in the portal for account holders and invited users. Records identify the account or user, the recorded action and its time. They include the IP address and approximate location inferred from that address where available. This is an estimate, not GPS location. It may be inaccurate and does not by itself prove who used an account. The records do not necessarily show every action.

We receive invitation details, such as the invited person's name or work email address, from the person or agency inviting them. We receive account details from users and collect activity records as they use the Service. These records can concern invited people who have not yet used the portal. Basic account information and necessary security records are needed to provide secure account access. If we cannot process that information lawfully, we may be unable to provide the affected access. We explain any effect on an existing order separately.

We use information to manage accounts, receive submissions, produce and review listing media, deliver files, handle revisions and provide support. We also use it for security, service diagnostics, fraud prevention, order administration, legal duties and dispute handling.

We communicate about orders and accounts through the portal, email and supported messaging channels. WhatsApp conversations can include footage, instructions, voice notes, delivery links and revision requests. Promotional messages are separate from the service messages needed to complete an order.

Property-image marketing use is described in section 13 of the Terms of Service and is included by default for submissions accepted under those terms. It can include portfolio, advertising, social media and before-and-after examples. That licence does not authorise publication of private contact details or unrelated confidential information.

Where a legal basis is required for an activity, it may include providing a service requested by you, complying with law, protecting legitimate business interests where permitted, or consent where required. A business contract does not itself establish permission for every use of another person's information. Consent-based activities can be withdrawn through the contact below, subject to applicable law.

We use account and security records to detect unauthorised access, protect customer information, investigate misuse and enforce the access and use rules in our Terms of Service. We may use relevant records to establish, exercise or defend legal claims. We limit this processing to what is necessary for the purpose.

Where the GDPR applies, we rely on legitimate interests under Article 6(1)(f) for necessary security monitoring, abuse prevention and the protection of our legal rights. These interests are protecting the Service and its users from unauthorised access, copying and misuse. We must balance those interests against your rights and reasonable expectations. Where a specific legal obligation requires processing, we rely on Article 6(1)(c) only where that obligation meets the GDPR's requirements. The right to object is explained in section 9.

Where the UAE federal Personal Data Protection Law applies, legitimate business interests are not, by themselves, a legal basis. For necessary account access, we rely on the Article 4 exception for performing a contract with the individual where that individual is a party to the contract and the processing is necessary for it. For legal duties or legal claims, we rely on the relevant Article 4 exception only to the extent its conditions apply. An agency's contract does not automatically provide a basis for processing every invited person's information. Where no exception applies, we must obtain valid consent before the processing. Accepting the Terms or receiving an invitation is not blanket consent. Other applicable UAE data-protection regimes remain unaffected.

Ryselist combines AI-assisted tools with human review. We may send the videos, images, plans, text, instructions or voice notes needed for a task to a processing provider. Tasks can include image editing, property analysis, drafting listing copy and transcribing a voice note. Image requests may go through an intermediary provider rather than directly to the model developer.

This policy and the production licence in our Terms do not grant permission to train AI models on customer media. Using media to produce a listing is a different purpose from using it to train a model. Any proposed training use would need separate lawful authority and an appropriate agreement. Provider-side processing and retention depend on the service and contractual arrangements used.

Only send information needed for the order. Avoid including faces, private documents, contact details or other personal material that is not needed to show the property.

We use providers for hosting, storage, video playback, AI processing, email, messaging, analytics and payments. Depending on the feature and processing route, these can include Cloudflare for infrastructure and video, Google for AI analysis, APIYI for image processing, KIE as an alternative AI integration, Resend for email, and WhatsApp and connected messaging infrastructure. The presence of an integration does not mean every order is sent to every provider. Payment services process payment details under their own notices.

Media can also be processed on work devices used by our editing team. Provider access should be limited to the information needed for the relevant work. We may disclose information to professional advisers, in a business transfer, under a customer instruction, or where needed to comply with law or protect rights and safety. We do not sell or rent personal information.

Cloudflare provides hosting and security infrastructure that may process account and activity records. Authorised Ryselist personnel may access records needed for their work. We may also disclose relevant records to professional advisers, courts, arbitrators or authorities where needed and lawful for an incident, legal duty or legal claim. We limit access and disclosure to the information needed for that purpose.

Portal access depends on the user's role and agency permissions. A public gallery share link works differently: anyone who has a valid link may be able to view or download its contents without logging in. Do not share a link with someone who should not receive the listing. Ask us about restricting or withdrawing access if a link is shared incorrectly. Expiry depends on the link and service configuration; not every link expires automatically after the same period.

If Belvair AI LLC is involved in a merger, acquisition, reorganisation, or sale of assets, customer information, submitted media and personal information may be transferred to the successor as part of that transaction. The successor will be bound by this Privacy Policy for the information it receives.

We retain account information, communications and listing media while needed to provide the service, keep delivered work available, support the customer relationship, protect the service and meet legal obligations. Different records have different retention needs. We do not apply one automatic deletion period to every type of information.

Archiving a listing does not erase it. Ending a plan also does not automatically erase all media, messages or account records. Copies can exist in media storage, databases, logs, messaging services, editing work devices and backups. A technical expiry on one record does not mean all related copies have been deleted.

Contact hello@ryselist.com to request access, correction or deletion. We may verify the request and the requester's authority, particularly where an agency controls the submitted information. We assess and handle requests under applicable law and any agreed processing terms. We will explain any information that must be retained for legal duties or disputes, and any relevant backup or provider limitations. Do not rely on the portal as your only copy of important files.

We keep routine portal activity records for up to 12 months from the recorded event. We delete or anonymise them earlier when they are no longer needed. Closing an account does not restart that period. This limit applies to routine activity records, not to every type of account, order or financial record.

We retain relevant records beyond that period only when needed for a specific security incident, dispute or legal duty. These records may include invitations, activity records, communications and copies that show the alleged breach. We restrict access and review whether continued retention is necessary. We delete or anonymise the records when the reason for keeping them ends. A general possibility of a future dispute does not justify keeping all records indefinitely.

After account closure, we delete or anonymise account data and stored media when no longer needed for an accepted order, an available file request, a specific legal duty or a legal claim. The Terms allow customers to request completed paid Deliverables for 30 days after closure. A longer period applies where law or an agreed data-processing arrangement requires it. Other records follow the retention criteria in this section. Copies in backups and provider systems remain protected while retained and subject to applicable deletion duties. We do not treat backups as an exception to the 12-month limit for routine activity records. We can explain relevant provider or backup limits when handling a deletion request.

Property images separately retained for marketing remain subject to the licence in section 13 of the Terms, any agreed restriction and applicable privacy rights. Account closure does not widen that licence or authorise the continued use of personal information without a lawful basis.

We use access controls, authentication, logging and infrastructure safeguards to protect information. Staff and systems should access customer content only for authorised work. Role-based portal access and a public share link provide different levels of access; section 5 explains that distinction.

No online service can promise absolute security. Keep login codes private and check who receives gallery links. Contact hello@ryselist.com promptly about suspected unauthorised access or a privacy incident. We will handle incidents and any required notifications in accordance with applicable law and agreed processing terms.

A person at Ryselist decides whether to suspend or close an account for a suspected or established breach of the Terms. That person considers the relevant records and circumstances. Activity records are not conclusive proof of a breach. The customer or affected user may contact hello@ryselist.com to challenge the decision and provide information for human review. This concerns account enforcement decisions. Ordinary technical controls, such as rejecting an invalid login, are separate.

We remain responsible for giving individuals the privacy information required by law. Agencies must also give invited users this policy before portal use. That agency duty does not replace our own notice duties when we obtain information directly or through an invitation.

You can contact hello@ryselist.com about access, correction, deletion or a copy of your personal information. Depending on the applicable law, you may also have rights to object, restrict processing, withdraw consent, request portability or complain to a competent privacy authority. Exceptions may apply and we may need to verify identity or authority.

Where we rely on GDPR legitimate interests, you may object at any time for reasons related to your situation. We will stop that processing unless we can show overriding compelling grounds or the processing is needed for legal claims. Email hello@ryselist.com to object. We assess your request under the applicable law.

You may request access to your personal information and ask for correction, deletion or restriction where the law provides those rights. You may request a portable copy where the legal conditions for portability apply. That right does not automatically cover security logs processed on legitimate interests. Where we rely on consent, you may withdraw it without affecting processing that was lawful before withdrawal. Account closure does not remove these rights.

You may complain to a competent data-protection authority. Under the GDPR, this includes the authority in the EU country where you usually live, work or believe an infringement occurred. For processing covered by the UAE federal law, the complaint route is the UAE Data Office under the applicable procedure. You do not have to complete our account-review process before exercising a statutory complaint right. The dispute clause in the Terms does not remove these rights.

If your information was supplied by an agency, contact that agency as well. Where we process it on the agency's behalf, we coordinate with the agency to handle the request. A gallery download is a copy of listing files, not necessarily a complete export of account or personal information.

Use the unsubscribe method in a marketing email or contact us to stop marketing messages. Marketing withdrawal does not stop service messages needed for an active order. Contact us separately about a property-image rights issue or the marketing licence described in the Terms.

We use cookies and similar technologies needed to operate the website and portal, maintain sessions, support security and remember settings. We may also use analytics technologies to understand visits and feature use. You can block or delete cookies through your browser or use any controls offered on the site. Blocking essential cookies may prevent portal login or other service features from working. Third-party services may use their own cookies when their features are used.

Belvair AI LLC is a United States company serving agencies in the UAE and elsewhere. Information may be processed in countries where our staff, editing devices, infrastructure or service providers operate. Choosing the UAE service does not mean every copy of data stays in the UAE.

Transfer requirements depend on the information, location and applicable law. Where required, transfers must use an applicable safeguard or other lawful basis. Contact hello@ryselist.com for information about the processing arrangements relevant to your agency. We do not promise a particular storage or processing region unless it is expressly agreed and supported by the service configuration.

Account and security records may be accessed by Belvair AI LLC in the United States and processed in locations where Cloudflare and other authorised recipients operate. The United States company address does not mean that every record is stored there. We do not promise that these records stay within the UAE or the European Economic Area.

A transfer subject to the GDPR must meet its international-transfer rules. Depending on the destination and recipient, this requires an applicable adequacy decision or an appropriate safeguard, such as the European Commission's standard contractual clauses with any additional measures needed. A limited legal exception may apply to a particular transfer. This policy does not claim that Belvair AI LLC is certified under the EU-US Data Privacy Framework or that one safeguard covers every recipient. Contact hello@ryselist.com for the destinations and transfer arrangements that apply to your information and how to obtain a copy of any relevant safeguards, subject to lawful redactions.

Where the UAE federal Personal Data Protection Law applies, transfers must meet Article 22 or an applicable condition under Article 23. We do not treat the GDPR's legitimate-interests basis or acceptance of the Terms as permission for a UAE transfer. Any more specific transfer requirement under an applicable data-protection arrangement or law remains in effect.

Ryselist is designed for real-estate professionals and other business customers. It is not directed to children, and we do not knowingly collect personal information directly from children. If you believe a child has provided personal information to us, contact us so we can review and, where appropriate, delete it.

We may update this policy as the service, providers, business practices or law change. The page shows its last-updated date and version. We will give additional notice where required for material changes. A policy update does not by itself create new rights over previously submitted content or replace a consent required by applicable law.

This policy explains information handling. Contractual service disputes are addressed in section 22 of the Terms of Service. Nothing in this policy removes a privacy right, regulator complaint route or protection that applies under mandatory law. Any applicable data-processing agreement governs the processing it covers.

Belvair AI LLC · 1111B S Governors Ave, Suite 59942, Dover, Delaware 19904, USA · hello@ryselist.com