Privacy Policy

1About This Policy

Bedspace Manager(“we”, “us”, “our”) is a PropTech SaaS platform for shared accommodation operators. This Privacy Policy applies to all users of the Bedspace Manager web application, iOS app, and Android app, as well as visitors to https://www.bedspacemanager.com.

By creating an account or using any part of the platform, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the service.

This policy covers two categories of people: Operators — businesses and individuals who sign up and manage properties — and Tenants — people whose information is entered into the platform by operators as part of lease and invoicing workflows. The two are treated differently under data protection law, including the Personal Data Protection Law (PDPL) in the UAE and Saudi Arabia; see Who Is Responsible for What and PDPL Compliance.

2Who Is Responsible for What

Bedspace Manager is sold to and used by operators — the businesses that run shared accommodation. Tenants are not our customers and do not hold accounts with us. This distinction determines who is legally responsible for tenant personal data.

The Operator Is the Data Controller

For all tenant and lease data, the operator is the data controller. The operator decides which tenants to record, what information to enter, why it is collected, and how long it is kept. Accordingly, the operator is responsible for:

• Having a lawful basis — consent, contract, or legitimate interest — for collecting and storing each tenant's personal data
• Informing tenants what data is held about them and how it is used
• Responding to tenant requests for access, correction, or deletion
• Ensuring the data entered is accurate, relevant, and no more than is needed
• Controlling which team members are given access, via the role permissions in the platform

Bedspace Manager Is the Data Processor

We act as a data processor on the operator's behalf. We store and process tenant data solely to deliver the service the operator has asked for — generating invoices, sending them over WhatsApp, tracking payments, and producing reports. We do not decide what tenant data is collected, we do not use it for our own purposes, and we do not build tenant profiles.

3Data We Collect

Account & Identity Data

When you create an account we collect:

• Email address and password (or Google OAuth profile if you sign in with Google)
• Your name (as provided during sign-up or pulled from Google profile)
• Email verification status

Business Data

During onboarding and throughout use we collect:

• Business name (printed on all tenant invoices)
• Country selection — used to set currency and time zone. This cannot be changed after setup.
• Subscription plan and billing history
• Team member names, email addresses, and assigned roles

Property & Unit Data

• Property addresses resolved via Google Places API
• Geographic hierarchy (city, location, building, floor, property, unit)
• Unit types, bed types, occupancy status, and furnishing details

Tenant & Lease Data

Operators enter tenant and lease data into the platform. This may include:

• Tenant names and WhatsApp/phone numbers (used for invoice delivery)
• Lease start and end dates, rent amounts, billing type
• Move-in and move-out records
• Demographic information if entered by the operator

Financial Data

• Invoice amounts, types (income / expense), and payment status
• Payment method recorded per transaction (for audit purposes)
• Adjustment entries and settlement records
• Recurring billing rule configurations

Usage & Technical Data

• Pages and features accessed, actions taken within the platform
• Device type, operating system, and app version
• IP address and approximate location (country-level) for security purposes
• Crash reports and error logs

4How We Use Your Data

We use the data we collect to:

• Provide the service — create and manage leases, generate invoices, track payments, and maintain your property portfolio.
• Deliver communications — send PDF invoices to tenants via WhatsApp, send monthly financial reports (Insights PDF and Transactions Excel) to the business Founder by email, and send push/email/WhatsApp reminders for rent due and occupancy changes.
• Process payments — manage subscription billing, upgrades, downgrades, prorations, and cancellations.
• Maintain security — enforce role-based access controls (Founder, Admin, Manager, Finance, Agent), detect unauthorized access, and preserve financial audit trails.
• Improve the product — analyze aggregated, anonymized usage patterns to guide feature development and fix bugs.
• Comply with legal obligations — respond to lawful requests from regulators or courts where required.

5Data Sharing

We do not sell, rent, or trade your personal data, and we never share operator or tenant data with other operators, advertisers, data brokers, or any third party for their own purposes. Data leaves our systems only in these circumstances:

Service Providers

We use third-party vendors to operate the platform. They access only the data necessary to perform their function and are contractually bound to protect it:

• Cloud hosting & infrastructure — servers, databases, file storage
• Payment processor — handles subscription billing; we do not store full card numbers
• Email delivery — for monthly reports, notifications, and verification emails
• Push notification service — for mobile app alerts
• Google Maps Platform — to resolve property addresses via Google Places API
• WhatsApp Business API — to deliver PDF invoices directly to tenants' WhatsApp numbers

Legal Requirements

We may disclose data if required by law, court order, or government regulation, or to protect the rights, property, or safety of Bedspace Manager, our users, or the public.

Business Transfers

If Bedspace Manager is acquired, merged, or its assets are sold, your data may be transferred to the acquiring entity. We will notify you before this happens and your rights under this policy will continue to apply.

6Retention & Deletion

While Your Subscription Is Active

All data is retained and fully accessible for as long as your subscription remains active.

After Cancellation

When you cancel your subscription your account enters a read-only window of 4 months. During this period you can view and export your data but cannot create or modify records.

Account Deletion Requests

You may request immediate deletion of your account and all associated data at any time by emailing support@bedspacemanager.com. We will process the request within 30 days. Note that deletion is permanent and cannot be undone.

7Security

We apply industry-standard technical and organizational measures to protect your data:

• All data transmitted between your device and our servers is encrypted via TLS/HTTPS
• Role-based access control with five permission levels (Founder, Admin, Manager, Finance, Agent) ensures team members only access data relevant to their function
• Financial records include immutable audit trails — invoices and transactions can be voided but not deleted, preserving a complete history
• Passwords are hashed; we never store plaintext credentials
• Regular security reviews and dependency updates

No system is perfectly secure. If you suspect unauthorized access to your account, change your password immediately and contact us at support@bedspacemanager.com.

8Your Rights

Depending on where you are located, you may have the following rights regarding your personal data:

All Users

• Access — request a copy of the personal data we hold about you
• Correction — request that inaccurate data be corrected
• Deletion — request deletion of your account and data (see Retention section above)
• Export — download your data in a portable format

UAE & Saudi Arabia (PDPL)

• Right to be informed — know how your personal data is collected, used, and stored
• Right of access — obtain a copy of the personal data held about you
• Right to correction and destruction — have inaccurate data corrected or unnecessary data destroyed
• Right to restrict or object to processing — including the right to withdraw consent
• Right to data portability — receive your data in a structured, machine-readable format
• Right to complain to the competent authority — the UAE Data Office or the Saudi Data & AI Authority (SDAIA)

European Economic Area & UK (GDPR)

• Restriction — request that we restrict processing of your data
• Objection — object to processing based on legitimate interests
• Portability — receive your data in a machine-readable format
• Right to lodge a complaint with your local supervisory authority

California (CCPA / CPRA)

• Right to know what personal information is collected and how it is used
• Right to delete personal information
• Right to opt out of the sale of personal information — we do not sell personal data
• Right to non-discrimination for exercising your rights

To exercise any of these rights, email support@bedspacemanager.com with your request. We will respond within 30 days (or as required by applicable law).

9PDPL Compliance

Most Bedspace Manageroperators run accommodation in the Gulf, where personal data is governed by the Personal Data Protection Law — UAE Federal Decree-Law No. 45 of 2021 and Saudi Arabia's PDPL (Royal Decree M/19), enforced by SDAIA. The platform is built and operated in line with these laws.

How the Platform Supports Your Obligations

Because the operator is the data controller for tenant records, PDPL compliance for that data rests primarily with the operator. Bedspace Manager is designed so that meeting those obligations is practical rather than manual:

• Purpose limitation — tenant data is processed only to run leases, invoicing, and reporting. We never repurpose it.
• Data minimisation — we require only the fields needed to issue a lease and an invoice. Anything beyond that is the operator's choice to enter.
• Access control — five role levels (Founder, Admin, Manager, Finance, Agent) let you restrict tenant and financial data to the staff who need it.
• Accountability — the void-not-delete policy preserves an immutable audit trail of every financial action, so you can demonstrate what happened and when.
• Right of access and portability — data can be exported at any time, including during the post- cancellation read-only window, so you can answer a tenant request.
• Storage limitation — data is deleted permanently at the end of the retention window, or immediately on request.
• Security — encryption in transit and at rest, hashed credentials, and role-scoped access, as described under Security above.

No Onward Sharing

We do not sell, rent, trade, or otherwise disclose operator or tenant personal data to any third party for their own purposes. The only transfers that occur are to the infrastructure and delivery providers listed in Data Sharing, strictly to run the service, under contractual terms requiring them to process data only on our instructions and to apply appropriate safeguards.

Cross-Border Transfers

Where data is processed outside the country in which it was collected — for example by a cloud hosting or messaging provider — we rely on providers that offer contractual and technical safeguards consistent with the transfer conditions set out in the PDPL. If you need details of the specific safeguards or a data processing agreement for your records, email support@bedspacemanager.com.

10Cookies & Tracking

The Bedspace Manager web application uses cookies and similar technologies for the following purposes:

• Authentication — to keep you signed in across sessions. These cookies are strictly necessary and cannot be disabled.
• Preferences — to remember your in-app settings.
• Analytics — aggregated, anonymized usage data to understand how features are used. No individual user is tracked or profiled for advertising.

We do not use third-party advertising cookies. You can control cookies through your browser settings; disabling authentication cookies will prevent you from signing in. The marketing website (https://www.bedspacemanager.com) may set analytics cookies; a consent banner is shown on your first visit.

11Third-Party Services

Bedspace Manager integrates with the following third parties. Each operates under their own privacy policy:

• Google Maps Platform — property addresses are resolved using the Google Places API. Address data is sent to Google to return exact coordinates and formatted addresses. Governed by the Google Privacy Policy.
• WhatsApp Business API — tenant phone numbers and invoice PDF files are shared with Meta's WhatsApp Business platform for invoice delivery. Governed by WhatsApp's Privacy Policy.
• Google Sign-In (OAuth) — if you choose to sign in with Google, your Google profile name and email are shared with us. Governed by the Google Privacy Policy.
• Payment Processor — subscription payments are handled by our payment provider. We do not receive or store full card numbers. Their privacy policy is provided at checkout.

12Children's Privacy

Bedspace Manager is a business tool intended for use by adults operating accommodation businesses. The service is not directed at children under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@bedspacemanager.com and we will delete it promptly.

13Policy Changes

We may update this policy periodically. When we do, we will revise the “Last updated” date at the top of this page. If changes are material — such as a new category of data collected or a new way data is shared — we will notify you by email (if you have an active account) at least 14 days before the change takes effect.

Continued use of the platform after changes become effective constitutes your acceptance of the revised policy.

14Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach us through any of these channels: