Privacy Policy

Introduction

At Kyora International, we take the protection of your personal data very seriously. This privacy policy explains how we collect, use, share, and protect your information when you use our platform.

Data controller: Anthony Carayon, Entrepreneur individuel (micro-entreprise), trading as Kyora International, 173, rue de Courcelles, 75017 Paris, France. Contact: contact@kyora-international.com — +33 6 72 49 45 05.

Data collected

When you register and use Kyora, we collect the following information:

Identification data

• First and last name
• Email address
• Phone number (required) – used to connect you with agents and, where applicable, for account verification

Usage data

• Investment preferences and goals
• Custom scanners and filters you create
• Watchlists (tracked properties)
• Listing view history (weak signal — audit only, no contact sharing)
• Outbound contact signals (WhatsApp, email, phone, Telegram clicks) and expressed interest, recorded for evidentiary purposes
• Navigation data on the public site (pages visited, duration, clicks), subject to your cookie consent for analytics trackers

Payment data

Payments (agent subscriptions, commissions) are processed by Stripe. Kyora does not store full credit card numbers.

Why is a phone number required?

Your phone number allows us to:

• Enable introductions when you voluntarily initiate first contact through the platform (Kyora Introduction)
• Allow the agent to contact you after revealing your details in their CRM, within an existing Introduction

Use of data

We use your personal data for the following purposes:

• Personalize your experience: recommendations based on your preferences
• Improve matching: connect the right investors with the right agents
• Secure your account: authentication, fraud detection, session management
• Statistical analysis: measure public site performance (aggregated or anonymized data where possible)
• Communication: notify you of new listings matching your criteria, send transactional emails
• Billing: manage subscriptions and commissions via Stripe

Legal bases and retention

Under the GDPR, each processing activity relies on a legal basis and a proportionate retention period:

Sharing with real estate agents

Sharing your contact details with real estate agents follows strict rules aligned with the Kyora Introduction model described below.

Strong signals — Kyora Introduction

A Kyora Introduction is created when you voluntarily initiate first contact with an agent through a channel offered by the platform: outbound WhatsApp, email, phone, or Telegram click, expressed interest, or any equivalent means. This timestamped event is the record of that introduction.

Contact reveal in the agent CRM

The agent may then reveal your contact details (name, email, phone) in their CRM workspace, within their monthly reveal quota. Reveal is a commercial follow-up feature distinct from the Kyora Introduction: it lets the agent contact you but does not replace commission contract rules.

What does NOT trigger sharing your contact details

• Simply viewing a listing (view recorded for audit only)
• Displaying search results or browsing the platform
• Adding a property to your watchlist
• Viewing an agent profile without outbound contact
• Any action that is not a strong signal as defined above

Why this model?

Only investors who show genuine interest are connected with an agent. Kyora does not transmit your contact details when you merely open a listing page.

Cookies and trackers

On the public site, we use essential cookies (language, session, remembering your cookie choice) and, with your consent, audience tools (Microsoft Clarity, Umami, Google Analytics 4 where applicable).

Logged-in areas (app.kyora-international.com) rely on cookies strictly necessary for authentication.

See our cookie policy for details and managing your preferences.

Sub-processors

We use the following providers to operate the platform:

• Google Firebase / Google Cloud — authentication, database (Firestore), file storage
• Vercel Inc. — hosting, performance metrics (Analytics, Speed Insights)
• Stripe, Inc. — online payments
• Resend — transactional email delivery
• Sentry — application error monitoring (session replay not enabled by default)
• Microsoft Clarity — heatmaps on the public site (with consent)
• Umami — audience measurement (with consent)
• Google Analytics 4 — traffic statistics (with consent, if enabled)
• Google Gemini (Google Cloud) — drafting assistance and internal AI features, without resale of your data

Each sub-processor is selected for its security compliance. Where data is processed outside the European Union, Kyora relies on appropriate safeguards (standard contractual clauses, data processing agreements — DPAs) maintained internally and reviewed periodically.

Data security

Kyora implements technical and organizational measures to protect your data:

• Encryption: your data is encrypted in transit (HTTPS/TLS) and at rest with our hosting providers
• Authentication: email and password login, secure sessions via HttpOnly cookies
• Restricted access: only authorized personnel can access sensitive data
• Continuous monitoring: detection and prevention of unauthorized access attempts
• Regular audits: security testing and protocol updates

Introduction proof and audit log

A Kyora Introduction is created when an identified investor voluntarily initiates first contact with an agent through a communication channel offered by the platform (WhatsApp, email, phone, Telegram, or any equivalent means). This Introduction is the timestamped record of that introduction and may support commission obligations owed to Kyora under the applicable contract terms.

Data recorded (audit_events)

For this purpose, Kyora records server-side events in an append-only log separate from the agent CRM, including in particular: server timestamp, account and Introduction identifiers (e.g. KYR-XXXXXXXX), action type (outbound contact, expressed interest, CRM status change, sale declaration, etc.), IP address, user-agent, and a SHA-256 integrity hash computed server-side only. These records cannot be modified from the user interface.

Weak signals (no contact sharing)

Certain actions (listing view, watchlist add, agent profile view) generate audit events for statistical or supplementary evidentiary purposes only. They do not create a Kyora Introduction and do not trigger transmission of your contact details.

Legal basis: contract performance and Kyora's legitimate interest in preventing commission circumvention and establishing proof in disputes. Recommended retention: three (3) years after closure of the relevant introduction file or commercial relationship.

Retention period

We retain your data for as long as your account is active, then for the period required by legal obligations (accounting, disputes). Audit logs related to Kyora Introductions are kept for up to three (3) years after the relevant file is closed. Other technical logs and analytics data are kept for limited periods according to each tool's policies.

International transfers

Some sub-processors (Firebase, Vercel, Stripe, Microsoft, Google) may process data outside the European Union, including in the United States. These transfers are governed by appropriate safeguards (EU Standard Contractual Clauses, supplementary security measures).

UAE PDPL addendum (Dubai agents and UAE-based users)

In addition to GDPR compliance, Kyora processes personal data of certain users in the United Arab Emirates (UAE) in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), which came into force on 2 January 2022.

Applicability (Art. 2(1)(c))

Under Federal Decree-Law No. 45/2021 Article 2(1)(c), PDPL applies to Controllers or Processors located outside the State who process Personal Data of Data Subjects located inside the State. This addendum applies to personal data of:

• Real estate agents registered in the UAE (including agents holding Dubai RERA licenses)
• Investors or users physically located in the UAE when using the platform
• Any person whose data is processed in connection with the provision of services related to the UAE real estate market

Official sources: https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws and https://uaelegislation.gov.ae/en/legislations/1972

Controller and processor roles

For the purposes of UAE PDPL:

• Kyora International (Anthony Carayon, Entrepreneur individuel (micro-entreprise), trading as Kyora International) acts as the data controller for personal data collected through the platform (investor accounts, agent registration data, platform usage data)
• Sub-processors listed in this privacy policy (Firebase, Vercel, Stripe, Resend, etc.) act as data processors on behalf of Kyora, subject to data processing agreements

Legal bases for processing (PDPL)

Under the UAE PDPL, Kyora processes your personal data based on the following legal grounds:

• Consent: you have provided explicit consent for specific processing activities (e.g., marketing newsletter, optional analytics cookies on the public site)
• Contract performance: processing is necessary to fulfill our contractual obligations to you (account management, agent subscriptions, Kyora Introductions, commission invoicing)
• Legal obligation: processing is required to comply with applicable UAE or French laws (accounting records, AML/CFT reporting obligations)
• Legitimate interests: processing is necessary for Kyora's legitimate business interests, provided your rights are not overridden (fraud prevention, security, audit logs for commission proof)

Cross-border data transfers (Arts. 22-23)

Personal data of UAE-based users may be transferred outside the UAE to:

• France (where Kyora's publisher is based)
• The European Union (for GDPR-compliant sub-processors)
• The United States (Firebase, Vercel, Stripe, Microsoft, Google — subject to appropriate safeguards such as Standard Contractual Clauses and supplementary security measures)

These transfers are conducted in accordance with UAE PDPL Articles 22-23 requirements for cross-border data transfers, including the use of contractual safeguards and ensuring recipients maintain adequate data protection standards.

Your rights under UAE PDPL (Arts. 13-19)

Under the UAE PDPL Articles 13-19, you have the right to:

• Access (Art. 13): request confirmation of whether we process your personal data and obtain a copy
• Rectification (Art. 14): request correction of inaccurate or incomplete personal data
• Erasure (Art. 15): request deletion of your personal data (subject to legal retention obligations)
• Restriction (Art. 16): request limitation of processing in certain circumstances
• Objection (Art. 17): object to processing based on legitimate interests or for direct marketing purposes
• Data portability (Art. 18): receive your personal data in a structured, commonly used format (where technically feasible)
• Withdraw consent (Art. 19): withdraw previously given consent at any time (without affecting the lawfulness of processing prior to withdrawal)

To exercise these rights, contact us at contact@kyora-international.com. We will respond to your request within the timeframes required by UAE PDPL (generally within 30 days, extendable by an additional 30 days for complex requests).

Complaints and regulatory authority

If you believe your rights under UAE PDPL have been violated, you may lodge a complaint with the UAE Office for Data Protection (part of the UAE Data Office) or the competent regulatory authority in the UAE. Contact details are available at the UAE Government official portal.

PDPL compliance commitment

Kyora does not claim certification under any specific UAE PDPL compliance framework. We commit to applying the principles and obligations of the UAE PDPL in good faith and reviewing our practices regularly to ensure ongoing compliance. Where GDPR and PDPL requirements differ, we apply the standard that provides the highest level of data protection. Administrative fines for non-compliance are determined by Cabinet of Ministers decision (Art. 26); Kyora does not speculate on fine schedules.

Your rights

Under the GDPR and applicable regulations, you have the following rights:

• Right of access: view the data we hold about you
• Right to rectification: correct your personal information
• Right to erasure: request deletion of your data
• Right to portability: receive your data in a structured format
• Right to object: object to processing of your data
• Right to restriction: request limitation of processing

To exercise these rights, contact us at contact@kyora-international.com. You may also lodge a complaint with the CNIL (www.cnil.fr).

Contact us

For any questions about this privacy policy or the processing of your data:

Email: contact@kyora-international.com

Address: 173, rue de Courcelles, 75017 Paris, France