This Privacy Policy explains how Prop-IRR.com, operated by Famplanr LLC ("Company," "we," "us," or "our"), collects, uses, stores, and shares information about you when you use the Prop-IRR.com platform and related services (the "Platform"). It also describes your rights and choices regarding your personal data.

By registering for an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.

1. INTRODUCTION & SCOPE

This Privacy Policy applies to all personal data processed by the Company in connection with the Platform, whether collected through the website, web application, email communications, or third-party integrations.

The Platform is operated by Famplanr LLC, a company registered in Sharjah Media City Free Zone, Sharjah, UAE. Our primary legal obligations are governed by the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Where users in the European Economic Area (EEA), United Kingdom (UK), or other jurisdictions access the Platform, we apply the corresponding protections described in Sections 11 and 12 of this Policy.

This Policy does not apply to third-party services linked to from the Platform. The Platform is not directed at children under the age of 18. See Section 9 for our children's privacy practices.

2. INFORMATION WE COLLECT

2(a). Information You Provide Directly

When you register for or use the Platform, you may provide us with the following categories of personal data:

Identity Data: Full name.
Contact Data: Email address; telephone number (if provided via the Help/Contact form).
Authentication Data: Hashed password; OTP codes (processed in transit only, not retained after verification).
Financial & Billing Data: Billing name and billing address. We do not store raw credit or debit card numbers. All card data is tokenised and processed directly by Stripe. We retain only the last four digits and card type for billing reference purposes.
Subscription Data: Selected plan, billing cycle, trial status, promotional code usage, and subscription history.
Project & Investment Data: Real estate project names, cashflow inputs, payment plan configurations, exit strategy selections, and IRR calculation outputs that you voluntarily enter into the Platform.
Communications Data: Messages and enquiries submitted via the Help/Contact form, including name, email, phone number, and message content.
Account Preferences: Currency display preference and notification settings.

2(b). Information Collected Automatically

When you access the Platform, we or our service providers automatically collect:

Log Data: IP address, browser type and version, operating system, referring URLs, pages visited, and time on page.
Device Data: Device type, screen resolution, and unique device identifiers.
Usage Data: Features used, projects created, navigation paths, session duration, and interaction patterns within the Platform.
Authentication Logs: Login timestamps, session tokens, and authentication failure records (retained for security purposes).
Traffic Metadata: Cloudflare, our DNS and traffic routing provider, processes request-level metadata including IP addresses as part of delivering the Platform to your browser.
Cookie & Tracking Data: See Section 5 for details.

2(c). Information From Third Parties

We may receive limited information about you from the following third-party sources:

Stripe: Payment confirmation status, subscription lifecycle events, and billing-related webhook notifications. We do not receive raw card numbers from Stripe.
Resend: Email delivery status, bounce notifications, and delivery failure reports.
Neon / Render / Vercel: Infrastructure-level logs and performance metrics generated as part of hosting your data and serving the Platform.

3. HOW WE USE YOUR INFORMATION

We process your personal data for the following purposes. For users in the EEA or UK, we identify the applicable legal basis under GDPR for each purpose:

Account Registration & Management: To create and manage your account, verify your identity via OTP, and maintain your profile. GDPR basis: Performance of a contract (Art. 6(1)(b)).
Service Delivery: To provide IRR calculation, cashflow analysis, project management, and comparison features. GDPR basis: Performance of a contract (Art. 6(1)(b)).
Subscription & Payment Processing: To manage your subscription, process payments via Stripe, apply promo codes, and send billing communications. GDPR basis: Performance of a contract (Art. 6(1)(b)); Legal obligation for tax/invoicing records (Art. 6(1)(c)).
Transactional Email Notifications: To send OTP codes, password reset links, payment receipts, trial expiry reminders, and subscription confirmations via Resend. GDPR basis: Performance of a contract (Art. 6(1)(b)).
Customer Support: To respond to enquiries submitted via the Help/Contact form. GDPR basis: Legitimate interests — responding to user communications (Art. 6(1)(f)).
Security & Fraud Prevention: To detect, investigate, and prevent unauthorized access, abuse, and fraudulent activity. GDPR basis: Legitimate interests — protecting platform integrity and user data (Art. 6(1)(f)).
Platform Improvement: To analyse usage patterns and improve Platform functionality using de-identified or aggregated data. GDPR basis: Legitimate interests — improving our services (Art. 6(1)(f)).
Legal Compliance: To comply with applicable UAE law, regulations, and lawful requests from competent authorities. GDPR basis: Legal obligation (Art. 6(1)(c)).
Marketing Communications (opt-in only): To send promotional content about Platform updates and new features if you have opted in. GDPR basis: Consent (Art. 6(1)(a)). Consent may be withdrawn at any time.

4. SHARING & DISCLOSURE OF INFORMATION

4(a). Service Providers / Data Processors

We share your personal data with the following third-party service providers who process data on our behalf under appropriate contractual controls. Each provider is engaged only to perform specific functions and is contractually restricted from using your data for any other purpose:

Stripe, Inc. (USA) — Payment processing and subscription lifecycle management. Privacy Policy: stripe.com/privacy. Stripe is PCI DSS certified and GDPR compliant.
Vercel, Inc. (USA) — Frontend hosting. Processes request-level logs including IP addresses when serving the Platform to your browser.
Render Services, Inc. (USA) — Backend application hosting. Processes all application data in transit as part of running the Platform's server-side logic.
Neon, Inc. (USA, with regional options) — PostgreSQL database hosting. Stores all persistent personal data including account details, project data, billing records, and subscription history. This is our primary data storage processor. Database region: primarily United States (subject to migration; see Section 8).
Cloudflare, Inc. (USA/Global) — Domain DNS and traffic routing. Processes IP addresses and request metadata at the network layer as part of delivering the Platform. Cloudflare is GDPR compliant and provides a Data Processing Addendum.
Resend, Inc. (USA) — Transactional email delivery. Processes email addresses and email content when sending OTP codes, billing notices, and account notifications.
UptimeRobot (EU/USA) — Platform availability monitoring. Pings the Platform's public URL to check uptime. Does not process personal user data.

4(b). Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets involving the Company, your personal data may be transferred to the successor entity. We will notify you by email at least 30 days before any such transfer occurs and before your data becomes subject to a materially different privacy policy.

4(c). Legal Obligations

We may disclose your personal data if required by applicable UAE law, a court order, or a competent governmental or regulatory authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of the Company, our users, or others.

We do not sell, rent, or trade your personal data to third parties for their own marketing or commercial purposes.

5. COOKIES & TRACKING TECHNOLOGIES

The Platform uses cookies and similar tracking technologies (including session tokens and local storage) to operate, secure, and improve the Platform. We do not use third-party advertising cookies or cross-site behavioural tracking.

Types of cookies we use:

Essential / Strictly Necessary Cookies: Required for authentication (session tokens), security (CSRF protection), and core Platform functionality. These cannot be disabled without preventing access to the Platform.
Performance / Analytics Cookies: Used to understand how users interact with the Platform. Where non-essential, we obtain your consent before setting these.
Preference Cookies: Used to remember your settings, such as currency preference and the 'Keep me signed in' selection.

You may manage cookie preferences through your browser settings. Disabling essential cookies will prevent you from using the Platform. A cookie consent mechanism will be implemented on the Platform in accordance with applicable law.

6. DATA RETENTION

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy or as required by applicable UAE law:

Account Data (name, email, hashed password): Retained for the duration of your account, plus 12 months following account deletion or termination.
Project & Investment Data: Retained for the duration of your account. Following account deletion, project data is permanently deleted within 30 days.
Billing & Payment Records: Retained for 5 years from the date of each transaction, in accordance with UAE accounting and tax record-keeping requirements.
Customer Support Communications: Retained for 3 years from the date of the communication.
Security & Audit Logs: Retained for 2 years.
Marketing Consent Records: Retained for 5 years from the date of consent or withdrawal, whichever is later.

Upon expiry of applicable retention periods, personal data is securely deleted or anonymised. You may request earlier deletion in accordance with Section 10.

7. DATA SECURITY

We implement appropriate technical and organisational security measures to protect your personal data. These include:

Encryption of all data in transit via HTTPS/TLS across all Platform environments.
Secure password hashing using industry-standard algorithms.
Email-based OTP verification for account access and sensitive account changes (email update, account deletion).
User-level data isolation — all API endpoints enforce strict access controls so users can only access their own data.
PCI DSS-compliant payment processing via Stripe's tokenisation infrastructure. No raw card data is stored on our servers.
Role-based access controls within the Admin Panel, with all admin actions logged with user ID, action, and timestamp.
Automated daily database backups with a minimum 7-day retention period and tested restoration procedures.

No method of electronic transmission or storage is entirely secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and applicable regulatory authorities in accordance with UAE PDPL requirements and, where applicable, within 72 hours as required under GDPR Article 33.

8. INTERNATIONAL DATA TRANSFERS

The Platform is operated by Famplanr LLC, registered in Sharjah, UAE. Our core service providers — including Vercel, Render, Neon, Stripe, Cloudflare, and Resend — are headquartered in the United States and process data on servers primarily located in the United States.

For UAE users: Cross-border data transfers to our US-based service providers are conducted in accordance with UAE Federal Decree-Law No. 45 of 2021 (PDPL), including by ensuring that appropriate contractual safeguards are in place with each processor.

For EEA/UK users: Transfers of personal data from the EEA or UK to our US-based processors are conducted under applicable transfer mechanisms, including Standard Contractual Clauses (SCCs) as adopted by the European Commission, where required. We are in the process of executing or confirming SCCs with all relevant processors.

Neon database region: Our PostgreSQL database is currently hosted primarily in the United States. We are in the process of confirming our final production database region following infrastructure migration. If EEA users are onboarded at scale, we will evaluate EEA-region database deployment to minimise cross-border transfer obligations. We will update this Policy once the database region is confirmed.

9. CHILDREN'S PRIVACY

The Platform is not directed at, and is not intended for use by, individuals under the age of 18. We do not knowingly collect personal data from anyone under 18.

At registration, users must confirm they are 18 or older. If we discover that a user under 18 has registered an account, we will immediately suspend and permanently delete that account and all associated data.

If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us immediately at support@prop-irr.com. We will investigate and, if confirmed, delete such data promptly.

This Section reflects best-practice child safety standards consistent with the US Children's Online Privacy Protection Act (COPPA) and UAE child protection obligations, even though the Platform is not primarily directed at minors.

10. YOUR RIGHTS & CHOICES

To exercise any of the rights below, please contact us at support@prop-irr.com. We will acknowledge your request within 5 business days and respond in full within 30 days (or such shorter period as required by applicable law). We may need to verify your identity before fulfilling your request.

10(a). Access, Correction & Deletion

Right of Access: You may request a copy of the personal data we hold about you.
Right of Rectification: You may request correction of inaccurate or incomplete data. You can also update your profile directly through the Platform's Profile Management section.
Right of Erasure: You may request deletion of your personal data. Account deletion is also available directly through the Platform and is permanent and irreversible. We will delete your data subject to retention obligations imposed by UAE law.

10(b). Opt-Out of Marketing

If you have opted in to marketing communications, you may opt out at any time by clicking the "Unsubscribe" link in any marketing email or by contacting us at support@prop-irr.com. Opting out of marketing does not affect transactional communications necessary for platform operation.

10(c). Do Not Sell / Share (CCPA)

We do not sell or share your personal data with third parties for cross-context behavioural advertising. If this practice ever changes, we will provide prior notice and a prominent opt-out mechanism. See Section 11 for California-specific disclosures.

10(d). Data Portability

You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format where technically feasible. Contact us at support@prop-irr.com to make this request.

Additional rights for EEA/UK users — including restriction of processing, objection to processing, and rights related to automated decision-making — are set out in Section 12.

11. CALIFORNIA-SPECIFIC DISCLOSURES (CCPA / CPRA)

This Section applies to California residents and supplements the rest of this Privacy Policy in accordance with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

11.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following CCPA categories of personal information:

Identifiers: Name, email address, IP address.
Commercial Information: Subscription plan, billing history, promo code usage.
Internet or Network Activity: Log data, usage data, device data, cookie data.
Geolocation Data: Approximate location inferred from IP address.
Professional Information: Self-declared role (investor / agent).

11.2 No Sale or Sharing of Personal Information

We do not sell personal information to, or share it for cross-context behavioural advertising with, any third party.

11.3 California Privacy Rights

California residents have the right to: know what personal information we collect and how it is used; request deletion of their personal information; request correction of inaccurate information; opt out of sale or sharing (not applicable here); limit use of sensitive personal information; and be free from discrimination for exercising these rights.

To exercise your California rights, contact us at support@prop-irr.com.

12. EEA / UK-SPECIFIC DISCLOSURES (GDPR)

This Section applies to users in the European Economic Area (EEA) or United Kingdom (UK) and supplements this Policy to address compliance with the General Data Protection Regulation (GDPR) and the UK GDPR.

12.1 Data Controller

The data controller for personal data processed in connection with the Platform is Famplanr LLC, Sharjah Media City (Shams), Sharjah, United Arab Emirates. Contact: support@prop-irr.com.

12.2 Additional Rights for EEA/UK Users

In addition to the rights in Section 10, EEA/UK users have the following rights:

Right to Restriction: You may request that we restrict processing of your data in certain circumstances (e.g., while we verify a rectification request).
Right to Object: You may object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. The Platform does not make such automated decisions.

12.3 Right to Lodge a Complaint

If you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with your local supervisory authority. In the EU: edpb.europa.eu. In the UK: ico.org.uk.

12.4 Data Protection Officer (DPO)

Based on our current scale and processing activities, the formal appointment of a DPO is not mandatory at this stage. We will review this assessment as our user base grows. For all data protection enquiries, contact us at support@prop-irr.com.

13. HOW TO CONTACT US

For any questions, requests, or concerns related to this Privacy Policy or your personal data, please contact us at:

Data Controller: Famplanr LLC (trading as Prop-IRR.com)

Email: support@prop-irr.com

Website: www.prop-irr.com

Registered Address: Sharjah Media City (Shams), Sharjah, United Arab Emirates

Response Time: Acknowledgement within 5 business days; full response within 30 days.

14. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or Platform features. For material changes, we will:

Post the revised Policy on the Platform with an updated "Effective Date."
Notify you by email to your registered address at least 14 days before material changes take effect.

Your continued use of the Platform after the effective date constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.