Sales Desk
Privacy Policy
Last updated 12 October 2026
Sales Desk ("the service") is operated by Davar Real Estate & Consultancy, Sulaymaniyah, Kurdistan Region, Iraq ("we", "us"). It is software for property developers and their sales and marketing teams ("business customers"): it holds their projects and payment plans, manages their leads, and lets them answer the people who write to them on WhatsApp, Instagram and Facebook Messenger ("their clients").
This policy explains what data the service handles, why, who it is shared with, and how to have it deleted.
Our role
For the messages, contact details and lead records of a business customer's clients, the business customer decides how that data is used and we process it on their behalf. For the accounts of the people who use the service (the business customer's staff), we are responsible for that data.
What data we handle
| Whose | What |
|---|---|
| Staff who use the service | Name, email address, optional phone number, role, password (stored only as a one-way hash), language, sign-in times, and the IP address of sign-in attempts (to stop password guessing). |
| Business customers | Company name and settings; projects, unit types, payment plans, photos and documents they upload; the Facebook pages, Instagram accounts and WhatsApp numbers they connect, with the access tokens Meta issues for them. |
| Their clients | Name, phone number, the Messenger/Instagram/WhatsApp identifier Meta provides, the messages and files they send and receive, the ad or post that led them to write, and the lead details staff or the assistant record (what they are looking for, their budget in their own words, viewings, reservations, offers, notes). |
Data from Meta (Facebook, Instagram, WhatsApp)
When a business customer signs in with Facebook, we receive the list of pages they manage and, for the pages and Instagram accounts they choose, access tokens that let the service receive and send messages on their behalf. When a business customer connects WhatsApp, we receive their phone number ID, account ID and an access token. Meta then sends us the messages and delivery statuses of those pages, accounts and numbers.
We use data received from Meta only to provide the service to that business customer: to show their chats, send their replies, record their leads and send the broadcasts they create. We do not use it for advertising, do not sell it, and do not share it with other customers. Access tokens are encrypted at rest and are removed when a page or number is disconnected. We follow the Meta Platform Terms and Developer Policies.
The AI assistant
If a business customer switches the assistant on, the recent messages of a conversation and the relevant project data are sent to Google's Gemini API to write a reply. Figures in the reply are filled in from the business customer's own data, and the conversation can be handed to a person at any time. Google processes this data under its Gemini API terms; we do not send it for any other purpose.
Who we share data with
- Meta Platforms: to receive and send messages on the business customer's pages, accounts and numbers.
- Google (Gemini API): only when the assistant is switched on, as described above.
- DreamHost: our hosting provider, in the United States, which stores the service and its database.
We do not sell personal data. We disclose data to authorities only when the law requires it.
Cookies
The service sets one cookie: a session cookie that keeps a signed-in user signed in. There are no advertising or tracking cookies.
How long we keep data
- Staff accounts: while the business customer's account is active.
- Client messages and lead records: until the business customer removes them or closes their account, or a deletion request is made.
- Access tokens: until the page or number is disconnected, or Meta revokes them.
- Sign-in attempt records: kept for security for a limited time.
When data is deleted, personal details are removed or anonymised; records that hold no personal data (for example, counts used in reports) may remain.
Security
Connections use HTTPS. Passwords are hashed; access tokens are encrypted. Each business customer can see only its own data, and within a business customer, salespeople see only the leads assigned to them unless their manager allows more.
Your choices and rights
You can ask to see, correct or delete personal data about you. If you are a client of one of our business customers, you can ask that business directly, or ask us and we will pass your request to them. See Data deletion for how to remove your data, including when you remove the app from your Facebook account.
Children
The service is for businesses and is not meant for anyone under 18.
Changes
If this policy changes, the date at the top changes, and business customers are told of significant changes.
Contact
Davar Real Estate & Consultancy, Sulaymaniyah, Kurdistan Region, Iraq. Write to us at the contact details at davarmulk.com.