Privacy Policy

1. Who we are

Yortana ("Yortana", "we", "us") is a rent-to-own real estate platform operated by DOKUZ AI - FZCO, IFZA Business Park, Building A2, Dubai Silicon Oasis, Dubai, United Arab Emirates (licence no. 74215). We are the data controller for personal data processed through the Yortana website (yortana.ai), web app (app.yortana.ai) and mobile apps.

Contact: privacy@dokuz.ai

2. Data we collect

• Account data — name, email address, phone number, profile photo, account role (buyer, seller, agency).
• Listing data — property details, photos, prices and terms you publish.
• Deal and messaging data — offers, negotiations, in-app messages, generated contracts and signatures.
• Identity verification data — where verification is required, identity documents and liveness data are processed by our verification provider (Didit). We store only the verification result and status.
• Payment data — payments are processed by Stripe. We never store full card numbers; we receive transaction status and limited billing metadata.
• Technical data — device type, app version, language, crash reports and usage diagnostics.
• Agency partner application data — contact name, work email, role, agency name, country, service areas, team and listing ranges, website or portal source, intended launch timing, consent record and basic campaign/referrer attribution.

2.1 Agency partner applications

Partner applications are separate from the consumer waitlist and from Yortana accounts. We use the required application fields to review partner fit, contact you about the application and administer any agreed onboarding. The application form records the consent text version and whether you separately opted in to product updates. Marketing consent is optional, can be withdrawn at any time and is not used to decide whether we review an application.

We also use a honeypot, a short-lived rate-limit key and a deterministic duplicate check to reduce automated or repeated submissions. The rate-limit identifier is hashed before storage. A website, feed or portal URL in an application does not by itself authorize Yortana to ingest content from it.

3. Why we process it

• To provide the platform: accounts, listings, offers, deal rooms, contracts (performance of a contract).
• To process payments and prevent fraud (performance of a contract, legal obligation, legitimate interest).
• To verify identity where required (legal obligation, legitimate interest in a safe marketplace).
• To improve stability and fix crashes (legitimate interest).
• To send service communications about your account and deals (performance of a contract).
• To review and administer agency partner applications (your consent and steps requested before entering a possible agreement).
• To protect the partner application service from automated abuse and duplicate submissions (legitimate interest in service security and data quality).
• To send agency product updates only where you gave separate marketing consent (consent).

4. Processors and transfers

We use a small number of processors to run Yortana: Google Firebase (hosting, authentication, database, crash reporting — data hosted in the EU where available), Stripe (payments), Didit (identity verification), Vercel (web hosting), the configured Redis/KV provider (partner application persistence and rate limiting) and Resend (application notifications and email). Where data is transferred outside the EEA, transfers rely on adequacy decisions or Standard Contractual Clauses.

The Yortana web app also uses: Google Gemini (the Tana assistant and the AI listing tools — what you type or upload to those features is sent to Google for processing), Google reCAPTCHA through Firebase App Check (to block automated abuse; it receives technical data about your browser and device), CARTO and OpenStreetMap map tiles (to draw maps; they receive your IP address and the area shown), and Photon by Komoot and OpenStreetMap Nominatim (address search; they receive the address text you type and your IP address).

We do not sell personal data. We do not use your data for third-party advertising.

4.1 Cookies and similar technologies

The Yortana website does not use advertising or tracking cookies. It keeps your theme, language and cookie choice in your browser’s local storage so the pages work as you set them. Visit statistics are collected by our own cookie-free counter and by Vercel Web Analytics and Speed Insights, neither of which uses cookies. Our counter stores only aggregate numbers — a count per day, route, country, referring site, campaign tag, device class and browser language, plus how far down a page visits scrolled, how long a page was in front of someone, and how often the handful of buttons we mark are clicked — and derives the country from the edge network that served your request, so no geo-location lookup is performed and your IP address is never stored. Scroll depth is recorded only as one of four marks, never a precise position; reading time is counted only while the tab is visible and is capped, and is kept as a running total and a count of views rather than as any record of a single visit. Nothing we store can be traced to a visit, so none of it can be replayed. Unique visits are counted with a probabilistic structure that retains no identifiers; the daily token feeding it is derived from your request and a server secret, used once in memory, never written down, and stops matching when the date changes. We honour Do Not Track and Global Privacy Control, and requests sending either are not counted. The resulting aggregates are published openly on our statistics page. Only if you choose Accept in the cookie banner do we load Google’s “preferred source” button from news.google.com; Google may then set or read cookies under its own privacy policy. You can change your choice at any time with “Cookie settings” at the bottom of each page.

5. Retention

Account data is kept while your account is active. Deal documents and transaction records are retained as long as required by contract, accounting and anti-fraud law. Verification results are kept only as long as required for compliance. Partner application data is kept while the application or resulting onboarding is active and then deleted or anonymised under our retention schedule unless law requires longer retention. Short-lived abuse-control keys expire automatically. You can request deletion of your account or partner application data at any time; we delete or anonymise data that we are not legally required to keep.

6. Your rights

Under the GDPR — and, for users in Türkiye, Law No. 6698 (KVKK) — you have the right to access, correct, delete and export your personal data, to restrict or object to processing, and to withdraw consent at any time. To exercise any right, email privacy@dokuz.ai. You may also lodge a complaint with your local supervisory authority (in Italy, the Garante per la protezione dei dati personali; in Türkiye, the KVKK Board).

7. Security

All traffic is encrypted in transit (TLS). Access to production data is restricted and logged. Payment credentials are handled exclusively by Stripe; identity documents are handled exclusively by our verification provider.

8. Children

Yortana is not directed at anyone under 18. We do not knowingly process data of minors.

9. Changes

We will post any changes to this policy on this page and update the date above. Material changes will be announced in the app.