TRUERQ · TRUST & TRANSPARENCY
Privacy notice
Last updated 3 October 2026
Who we are
TrueRQ.ai is a product of UDAI AI Technologies Limited, DIFC AI Campus, DIFC, Dubai, United Arab Emirates. For anything about your personal information, email uday@udai.ai or call +971 50 102 6800 (UAE) / +91 77383 30001 (India).
What this notice covers
This notice covers the TrueRQ.ai website and the signed-in product: Maya, the AI property advisor; the research workspace; and voice calls with her. It describes what is collected today. When we add a service that collects more, we update this notice and, where the law requires it, ask for your consent again.
What we collect, and why
- Your account: first and last name, email address, contact number (country and number), and a password. The password is stored only as a bcrypt hash; we cannot read it. We also record your role, your plan, whether your email is verified, when you last signed in, and when you accepted these documents and which version. Used to create and secure your account and to apply your plan.
- Email verification and password reset codes: a six-digit code sent to your address and kept, hashed, for ten minutes. Used only to prove you control the inbox.
- Your conversations: everything you type or say to Maya, everything she answers, and the sources she fetched for you (videos, places, listings, news, community discussion, social pages) — stored against your account so you can reopen them from the workspace. You can delete any conversation there, which removes it.
- Voice calls: when you press the microphone, your audio is streamed live to our speech-recognition provider and returned as text. We do not record or store the audio; only the transcript becomes part of the conversation.
- Usage: a per-day count of your messages and voice seconds, to apply your plan’s limits.
- Visits: a random visitor identifier in a first-party cookie, with a daily count of visits, so that guests get a fair allowance and we can see how the service is used. This is our own counting; no third-party analytics or advertising tags are loaded.
- Security records: sign-ins, failed sign-ins, sign-outs, password resets, profile changes and administrative actions are logged with the time, the action and your IP address, to detect misuse and investigate problems.
- Waitlist: the email address you give on the coming-soon form, and where you gave it.
- Browser preferences: your theme, sidebar state, call language and privacy-banner choice are kept in your browser’s local storage, not on our servers.
Who processes it for us
We use specialist providers to run the product. Each receives only what it needs for its job, and none of them receives your password. The providers today are:
| Provider | What it receives | Why |
|---|---|---|
| Google Cloud | Everything we store, on our server in the Middle East (Doha) region | Hosting |
| Google (Gemini API) | The text of your conversation: your messages, Maya’s replies, her instructions, and a one-line note of which research card you have open | The AI model that forms Maya’s answers. Google’s API terms govern this processing. |
| Deepgram | Your live microphone audio during a call, in the language you chose | Speech recognition. Returned as text; we keep no recording. |
| ElevenLabs | Maya’s reply text | Turning her words into speech. Never your words. |
| SpatialReal (Spatius) | Maya’s synthesised speech and a short-lived session token | Animating her face in time with her voice. Never your audio. |
| YouTube Data API, Google Places API, Exa | Search queries built from your question — the area, community, developer or topic you asked about | Finding the videos, places, news, community discussion, social pages and listings shown on the cards. Results are cached for up to seven days (one day for videos) so the same question is not sent twice. |
| Our email provider | Your email address and the one-time code | Delivering verification and reset codes. |
Where it is kept
Our servers run on Google Cloud in Doha, Qatar. The providers above process data where they operate, which includes the United States and the European Union; we rely on their contractual terms for those transfers.
How long we keep it
- Account details: for as long as the account exists.
- Conversations: until you delete them, or until the account is deleted.
- Verification and reset codes: ten minutes.
- Usage counts and visit counts: kept as daily records.
- Security records: kept for security and audit purposes. We are setting a fixed retention period and will state it here.
- Waitlist addresses: until you ask to be removed.
Your choices and rights
- See and correct your details on your profile page.
- Delete any conversation from the workspace.
- Sign out on any device; the session cookie expires after seven days in any case.
- Ask us for a copy of your data, or to delete your account and everything stored with it, by emailing the address above. We confirm within 30 days.
- Withdraw your consent at any time by asking us to delete the account.
- Raise a complaint with us first, and with the data-protection authority that applies to you if you are not satisfied.
Security
Connections use TLS. Passwords are hashed with bcrypt. Sessions are kept in an httpOnly cookie that page scripts cannot read. Administrative functions are restricted by role, and administrative actions are logged.
Who the service is for
TrueRQ is for adults making property decisions. We do not knowingly collect information from anyone under 18.
Changes
When this notice changes, the date at the top changes with it. Material changes are announced in the product before they take effect.