NOA Privacy Policy — Pre-Launch
Effective date: September 2, 2026 Last updated: September 2, 2026
Pre-launch notice: NOA is currently a pre-launch technology project operated through https://noatech.ae. Formal UAE business registration and licensing are pending. This Privacy Policy is intended for development, testing, preview, and pre-launch use and should be reviewed by UAE-qualified legal/privacy counsel before commercial launch.
1. Who operates NOA
NOA is currently operated as a pre-launch technology project through:
Website: https://noatech.ae Privacy contact: noatech.support@gmail.com Country of operation: United Arab Emirates
NOA is not currently represented in this Policy as a registered UAE company.
The final legal controller identity, business name, licence details, and registered address will be updated after formal business registration.
2. Scope
This Policy explains how NOA may collect, use, disclose, store, and protect personal data when users interact with the NOA mobile application, website, smart-home features, Property Manager features, NOA World, AI features, and related services.
3. Data we may collect
Account data
Name, email address, phone number if enabled, authentication identifiers, account role, and account-security information.
Home, property, and tenancy data
Home and property identifiers, addresses, units and rooms, owner/manager/tenant/resident/staff relationships, invitations, and access permissions.
Smart-device and IoT data
NOA device IDs, third-party provider device IDs including Tuya IDs where applicable, device names, categories, room assignments, online/offline status, telemetry made available by the provider, commands, automation events, timestamps, and error states.
Sensitive provider credentials such as Tuya client secrets and access tokens should remain server-side and should not be embedded in the NOA mobile app.
Maintenance and support data
Maintenance requests, descriptions, messages, assigned staff, status history, photos, invoices, certificates, and other files users choose to upload.
Sustainability and NOA World data
Certificate information, verification codes, sustainability information, challenge participation, and community information where enabled.
AI interaction data
If live AI features are enabled, NOA may process prompts, conversation context, relevant device/property context, generated responses, and technical/safety logs.
Where AI runtime is not enabled, the AI interface may be present without sending prompts to a live AI provider.
Technical and security data
IP address, app version, device/operating-system information, session events, crash and diagnostic information, security logs, timestamps, and network/service errors.
Location data
NOA should process location only where a feature requires it, appropriate permission is requested where required, and the purpose is disclosed.
4. How data may be collected
Data may be collected directly from users, from organisations or property managers that lawfully invite users, from connected smart-device providers, through app and website operation, through authentication systems, and from service providers acting on NOA’s behalf.
5. Why personal data may be used
NOA may process personal data to create and secure accounts, authenticate users, provide Home User and Property Manager features, display and control connected devices, manage properties/units/staff/residents/permissions, process maintenance workflows, provide sustainability and analytics features, support users, detect fraud and security incidents, operate and improve the Services, comply with law, defend legal claims, and provide AI features where enabled.
Where consent is required, NOA should request it in an appropriate form.
6. Access controls
NOA uses or intends to use role-based and server-side access controls to limit users to information they are authorised to access.
Property managers and organisations are responsible for assigning appropriate permissions to users they invite.
7. Smart-device providers
When users connect compatible smart devices, NOA may exchange device identifiers, commands, and status information with the relevant provider through server-side integrations.
For Tuya-compatible integrations, sensitive provider credentials should remain in secure server-side secret storage.
8. Supabase and backend services
NOA may use Supabase for authentication, database access, storage, and server-side functions.
Public client credentials may be included in the app only where designed for client use.
Service-role keys and other private backend credentials must not be embedded in the mobile application.
9. AI providers
If live AI functionality is enabled, NOA may use third-party AI providers.
Before production activation, NOA should minimise personal data shared with AI providers, configure retention appropriately where available, and keep private provider credentials server-side.
10. Service providers and recipients
NOA may use providers for cloud database and authentication, hosting, smart-device connectivity, communications, analytics and diagnostics, AI services, security, support, and payment processing if enabled later.
Examples may include Supabase and Tuya-related services.
11. Legal disclosures
Personal data may be disclosed where reasonably necessary to comply with applicable law, court orders, lawful government requests, protect legal rights, investigate fraud or security incidents, or defend legal claims.
12. International transfers
Some providers may process personal data outside the UAE.
Where UAE data-protection rules apply to an international transfer, NOA should use an appropriate lawful transfer mechanism and safeguards as required.
13. Data retention
Personal data should be retained only as long as reasonably necessary for the purpose for which it was collected and for legitimate security, dispute, accounting, or legal requirements.
Before commercial launch, NOA should adopt a written retention schedule covering accounts, security logs, device logs, maintenance records, property records, uploaded files, AI conversations if enabled, and billing records if enabled.
14. Security
NOA uses or intends to use reasonable technical and organisational safeguards, including encrypted network transport, authentication, role-based access, database Row Level Security where applicable, server-side secret management, access logging, secure development practices, separation of public mobile credentials from private service credentials, monitoring, and incident response.
No system can guarantee absolute security.
15. Data breaches
Where required by applicable law, NOA should assess personal-data breaches and notify the appropriate authority and/or affected persons within the applicable legal framework.
16. Privacy rights
Subject to applicable UAE law and lawful exceptions, users may have rights relating to their personal data, including rights to receive information about processing, request access, request correction, request deletion where applicable, restrict or stop certain processing, withdraw consent where processing is based on consent, object to certain automated processing where applicable, request data portability where applicable, and complain to the relevant authority.
Privacy requests should be sent to: noatech.support@gmail.com
Identity verification may be required before completing a request.
17. Children
NOA is not intended to allow children to independently manage smart-home or property-management accounts unless a child-appropriate service is separately introduced with suitable safeguards and legal review.
18. Marketing
If marketing communications are introduced later, NOA should provide appropriate notice and opt-out controls.
Necessary service and security communications may still be sent.
19. Website cookies
The NOA website may use cookies or similar technologies for essential operation, security, preferences, and disclosed analytics.
If non-essential tracking is introduced, appropriate consent and notice controls should be implemented where required.
20. App permissions
NOA may request operating-system permissions only where needed for a feature, such as access to selected photos for certificates or maintenance uploads.
21. Account deletion
Before commercial launch, NOA should provide a clear route for account-deletion or deletion requests.
Some information may need to be retained for legal, security, fraud-prevention, dispute, backup, or property-management reasons.
22. Automated decision-making
NOA should not use solely automated decision-making that produces significant legal or similarly serious effects unless the processing is separately reviewed for legality, transparency, safeguards, and user rights.
AI recommendations should remain advisory unless a separately approved workflow states otherwise.
23. Changes to this Policy
This Policy may be updated as NOA develops, providers change, formal business registration is completed, or applicable requirements change.
24. Contact
NOA — Pre-Launch Technology Project Website: https://noatech.ae Privacy email: noatech.support@gmail.com Country: United Arab Emirates