Privacy Policy

Last updated: 9 September 2026

Match & Close is a business-to-business marketplace for licensed real-estate brokers in Dubai, operated from Dubai, United Arab Emirates. This policy explains what we collect, why, how long we keep it, and how you get it deleted. It covers the web application at www.mcclose.com and the API at api.mcclose.com.

Who this policy is for

Our users are licensed brokers and the brokerages that employ them. We do not operate a consumer product and we do not knowingly collect data from anyone under 18.

What we collect

• Account data — name, work email, phone number, BRN, role, the company and branch you belong to, and a hashed password. Provided by you or by your company administrator when they invite you.
• Content you create — property listings, client requirement requests, offers, chat messages, viewing appointments and deal records.
• Your clients' details — you may enter notes about the people you represent. You are responsible for having a lawful basis to enter them; we process that content on your instruction and never sell it.
• Google account data — only if you connect Google Calendar. See the section below.
• Operational data — your last sign-in time, your network address held briefly to rate-limit sign-in attempts, and server logs kept for security and debugging.

Google Calendar — what we access and why

Connecting Google Calendar is optional. Nothing about it is required to use Match & Close, and disconnecting it does not affect the rest of your account.

When you connect, you grant exactly three OAuth scopes:

• openid and userinfo.email — so we can show you which Google account is connected on your profile page. We store that email address and nothing else from your Google profile.
• https://www.googleapis.com/auth/calendar.events — so we can put your confirmed property viewings on your calendar.

What we actually do with that access:

• We create an event on your primary calendar when a viewing you are part of is confirmed, update it if the time or place changes, and delete it if the viewing is cancelled.
• Each event contains only the counterparty broker's name, the viewing location, the start and end time, and a link back to the Match & Close chat.
• We never read your calendar. We do not list, search, or import your existing events, and we do not see any event we did not create.
• We do not add attendees, so connecting the calendar sends no email to anyone.

Match and Close's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as needed to provide the calendar feature, we do not use it for advertising, we do not sell it, and no human at Match & Close reads it except where you ask us to for support, where we are legally required to, or for a security investigation.

How to disconnect and delete Google data

• In the app: Profile → Google Calendar → Disconnect. This immediately deletes our stored refresh token, the connected email address and the links between your viewings and your calendar events.
• Directly with Google: myaccount.google.com/permissions → remove access for Match and Close. Our token stops working at once.
• Events already written to your calendar are left in place — they are your own appointments. Delete them in Google Calendar if you do not want them.

How we store and protect it

• Your Google refresh token is encrypted at rest with a per-environment key and is never shown in the interface, in logs, or through the API.
• Passwords are stored only as salted hashes; we cannot read them.
• All traffic runs over HTTPS.
• Data is hosted on Railway cloud infrastructure; transactional email is sent through Postmark and images are served from Cloudinary.
• Every listing and request is scoped to your company. Brokers at other companies see only what is deliberately published to the marketplace, with client notes and unit numbers withheld.

Who we share it with

We do not sell your data and we run no advertising. We share it only with the infrastructure providers named above, who process it on our instruction, and where the law requires it. Other brokers see only what you publish to the marketplace and what you send in a chat you joined.

How long we keep it

• Account and business records: for as long as your account is active.
• Google Calendar tokens and connection data: until you disconnect, at which point they are deleted immediately.
• Server logs: a rolling short-term window for security and debugging.
• After account closure we delete or anonymise personal data, keeping only what we must for legal, tax or dispute-resolution reasons.

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Write to hello@mcclose.com and we will respond within 30 days. If your account was created by your company administrator, some records belong to that company and we will coordinate with them.

Changes

If we change this policy we update the date at the top of this page. Material changes to how we handle Google user data will be announced in the app before they take effect.

Contact

Match & Close, Dubai, United Arab Emirates — hello@mcclose.com