Terms of Service

KeyFlow Technology Ltd

1. Who we are, and who these Terms bind

1.1 These Terms of Service (“Terms”) are an agreement between KeyFlow Technology Ltd (“KeyFlow”, “we”), a company licensed in the Dubai International Financial Centre under Commercial Licence CL-12435, with its registered address at Unit GA-00-SZ-01-FX-07, Level 1, Gate Avenue South Zone, DIFC, Dubai, UAE, and the real-estate agency that subscribes to the Services (the “Agency”, “you”).

1.2 The Services are business software. The Agency is our customer. Individuals access the Services under the Agency's subscription: the Agency's staff and contractors (“Authorised Users”) and, through the Keys application, the Agency's own clients — owners, tenants, buyers and sellers (“Clients”). These Terms bind the Agency, and the Agency is responsible for the acts and omissions of its Authorised Users as if they were its own. Clients' use of Keys is enabled by the Agency's subscription and governed by these Terms and the notices presented in the product.

1.3 Visitors browsing our websites (Section 3.4) without an account are bound by Sections 3.4, 5, 9, 12, 13 and 15 of these Terms and by our Privacy Policy at keyflowae.com/privacy-policy.

2. Acceptance

2.1 The Agency accepts these Terms when a person acting for it clicks to accept them in the product or signs an order or agreement referencing them. The person accepting warrants that they are authorised to bind the Agency.

2.2 The products present a versioned consent gate. Where we update these Terms (Section 14), the Agency's continued use after notice constitutes acceptance of non-material updates; material updates must be re-accepted through the consent gate before continued use.

3. The Services

3.1 “Services” means the KeyFlow software services made available to the Agency, in three tiers:

• (a) The next-generation Keyflow platform — six surfaces (Arc for opportunities, Atlas for property and listing operations, Connect for client messaging, Ledger for cheques and payments, Console for organisation administration, and Keys for the Agency's Clients), with companion iOS applications. The platform is pre-launch: it currently operates in a staging environment and becomes generally available at production launch (target September 2026). Pre-launch access is beta access and Section 11 applies.
• (b) The first-generation products LeaseFlow and LeadsFlow — operational and in use today, and being wound down in Q4 2026 following the Agency's migration to the next-generation platform. We will support the migration and dispose of residual first-generation data in accordance with the Data Processing Addendum (Section 8).
• (c) DealsFlow — discontinued on 15 July 2026 and no longer offered.

3.2 Certain capabilities are described in the products or our materials as planned or pending activation — including WhatsApp messaging, AI-assisted drafting, production payment collection through our open-banking provider, and Dubai Land Department data integrations. These form part of the Services only if and when we activate them, and activation of any capability involving new data flows is subject to the safeguards described in the Data Processing Addendum and our Privacy Policy.

3.3 We may improve, extend or modify the Services. We will not materially degrade the core functionality the Agency has subscribed to without the notice described in Section 14.

3.4 “Websites” means our public websites, including keyflowae.com. The Websites are provided for information; product descriptions on them do not form part of any contract unless confirmed in an order.

4. Accounts and UAE PASS identity

4.1 Next-generation platform. Sign-in is through UAE PASS, the UAE's national digital identity. Identity is verified at the source: KeyFlow does not set, hold or manage passwords for the platform. Each account is bound to a verified individual identity, and actions taken in the platform are attributed to that identity in the audit record.

4.2 UAE PASS is operated by Digital Dubai as an independent government service under its own terms and privacy policy. Authentication and digital signing occur at the individual's initiation; KeyFlow is not responsible for the availability of UAE PASS or for its handling of personal data.

4.3 First-generation products use email-and-password credentials until wind-down. The Agency must ensure its Authorised Users keep credentials confidential and must notify us promptly at privacy@keyflowae.com of any suspected unauthorised access to any account.

4.4 The Agency controls access for its organisation through Console — inviting and removing Authorised Users and granting or revoking capabilities. The Agency is responsible for keeping those grants current, including removing leavers without delay.

5. Acceptable use

The Agency must not, and must ensure its Authorised Users and Clients do not:

• (a) use the Services in breach of any applicable law, including UAE and DIFC law and RERA rules;
• (b) upload or transmit unlawful, infringing or malicious content, or instruct the processing of Special Categories of Personal Data through the Services;
• (c) attempt to access another agency's data, probe, scan or test the vulnerability of the Services, or circumvent authentication, tenant isolation or capability controls;
• (d) reverse-engineer, copy or resell the Services, or access them to build a competing product;
• (e) use the Services to send spam or unsolicited communications in breach of applicable law;
• (f) impose an unreasonable load on the Services through automated means, or use scraping tools against the Services or Websites; or
• (g) misrepresent an identity, or sign or submit documents without authority to do so.

6. Agency responsibilities

6.1 Lawful basis. The Agency determines the purposes of processing its Clients' personal data in the Services. The Agency warrants that it has a lawful basis for the processing it instructs, that it has given its clients the information required by applicable data protection law, and that its instructions to KeyFlow are lawful (this mirrors clause 2.2 of the Data Processing Addendum).

6.2 Accuracy. The Agency is responsible for the accuracy and completeness of the data it and its Authorised Users enter into the Services, and for correcting it when it learns of inaccuracy.

6.3 Regulatory compliance. The Agency remains solely responsible for its own regulatory obligations as a real-estate business — including RERA licensing and advertising rules, Ejari registration obligations, and anti-money-laundering obligations. The Services support these workflows; they do not discharge the Agency's obligations.

6.4 Its people. The Agency is responsible for its Authorised Users' compliance with these Terms and for the consequences of the capabilities it grants them.

7. Fees

7.1 The Agency's current use of the Services is under an unpaid pilot / beta arrangement: no fees are payable until the parties agree a paid plan in writing. Commercial terms to be settled before or at general availability:

• pricing plans and included usage;
• invoicing cycle and payment terms;
• taxes: fees exclusive of VAT and similar taxes, which the Agency bears;
• consequences of late payment (interest, suspension after notice).

7.2 We will give the Agency reasonable advance written notice before any transition from unpaid pilot terms to paid terms, and paid terms take effect only on the Agency's acceptance of an order or updated Terms.

8. Data protection

8.1 The Data Processing Addendum published at keyflowae.com/dpa (the “DPA”) forms an integral part of these Terms. It is incorporated into these Terms by reference, and, in respect of the processing of personal data, the DPA prevails over these Terms to the extent of any conflict.

8.2 For personal data the Agency's business puts into the Services (“Agency Personal Data” as defined in the DPA), the Agency is the Controller and KeyFlow is the Processor, acting on the Agency's documented instructions under the DPA. For platform account identity, security and audit records, KeyFlow acts as Controller as described in our Privacy Policy at keyflowae.com/privacy-policy.

8.3 The Services are hosted in AWS ap-southeast-1 (Singapore), an adequate jurisdiction under the DIFC Data Protection Law. Sub-processors, international transfers and security measures are as set out in the DPA. UAE PASS / Digital Dubai and the Dubai Land Department are independent controllers of their own government services and are not sub-processors of KeyFlow.

8.4 On the end of the Services, clause 4(g) of the DPA governs the return or deletion of Agency Personal Data, subject to the statutory retention carve-outs in KeyFlow's Retention & Erasure Schedule (including the 7-year audit log and 15-year signed-document horizons).

9. Confidentiality

9.1 Each party must keep confidential the non-public information it receives from the other in connection with the Services (including, for KeyFlow, the Agency's business data; and, for the Agency, non-public product, security and pricing information), use it only for the purposes of these Terms, and protect it with at least reasonable care.

9.2 These obligations do not apply to information that is public through no fault of the recipient, already lawfully held, independently developed, or required to be disclosed by law or a competent authority — in which case the recipient gives prompt notice where lawful. They survive termination for five years, and indefinitely for personal data.

10. Intellectual property

10.1 KeyFlow and its licensors own the Services, the Websites, and all software, designs and documentation, including improvements. The Agency receives a non-exclusive, non-transferable licence to use the Services for its internal business during the term, for its Authorised Users and Clients.

10.2 The Agency owns its data. The Agency grants KeyFlow a licence to host, process, transmit and display Agency data solely to provide and secure the Services, as instructed under the DPA.

10.3 If the Agency gives us feedback or suggestions, we may use them without restriction or obligation, provided doing so never identifies the Agency or discloses its confidential information.

10.4 “KeyFlow”, the product names (Arc, Atlas, Connect, Ledger, Console, Keys, LeaseFlow, LeadsFlow) and associated logos are trademarks of KeyFlow. No rights in them are granted beyond what these Terms state.

11. Service levels and beta status

11.1 Pre-launch surfaces are beta. Until general availability, the next-generation platform is provided “as is” and “as available”: features may change or be withdrawn, data models may evolve, and availability is not guaranteed. We will take reasonable care, but beta access is provided without warranties or service-level commitments.

11.2 The first-generation products are mature but in wind-down; they are maintained on a reasonable-efforts basis until migration completes in Q4 2026.

11.3 A production service-level commitment for the next-generation platform will be published at or before general availability, covering target uptime, support channels and response times.

11.4 We may perform maintenance, with advance notice where it is planned and material. Nothing in this Section limits our obligations under the DPA.

12. Suspension and termination

12.1 Suspension. We may suspend some or all access — giving prior notice where practicable, and otherwise notice as soon as practicable — where: (a) the Agency materially breaches these Terms (including Section 5) and, where curable, fails to cure within 14 days of notice; (b) suspension is necessary to protect the security or integrity of the Services or other customers' data; (c) we are required to do so by law or a competent authority; or (d) undisputed fees (once payable) remain unpaid after notice. We will limit suspension in scope and duration to what is necessary.

12.2 Termination. Either party may terminate: (a) for convenience on 30 days' written notice (during the unpaid pilot, either party may terminate on 14 days' notice); or (b) immediately for a material breach that is not cured within 14 days of notice, or that is incapable of cure.

12.3 Effect. On termination or expiry: access ends; each party returns or destroys the other's confidential information on request; and Agency Personal Data is returned or deleted at the Agency's choice in accordance with clause 4(g) of the DPA and the Retention & Erasure Schedule, save where statute requires retention (in which case the data is isolated and processed for no other purpose). Sections 8 (in respect of surviving processing), 9, 10, 12.3, 13, 15 and 16 survive.

13. Liability

13.1 Nothing in these Terms excludes or limits liability for fraud or wilful misconduct, or any liability that cannot be excluded or limited under applicable law. Consistent with clause 6.1 of the DPA, nothing limits a party's liability for its own breach of the DIFC Data Protection Law that results in an administrative fine or Data Subject compensation attributable to that party's non-compliance.

13.2 Subject to Section 13.1, neither party is liable for indirect or consequential loss, loss of profits, revenue, goodwill or anticipated savings, or loss or corruption of data to the extent caused by the other party's failure to follow documented backup or export guidance.

13.3 Subject to Sections 13.1 and 13.2, each party's aggregate liability arising out of or in connection with these Terms in any 12-month period is capped at the greater of (a) the fees paid or payable by the Agency for the Services in the 12 months preceding the first event giving rise to liability, and (b) AED 10,000.

13.4 The Services depend on third-party services outside our control — including UAE PASS, government registries, app stores, and telecommunications networks. We are not liable for their unavailability or acts, without prejudice to our obligations for our sub-processors under the DPA.

14. Changes to these Terms

14.1 We may update these Terms. We will give the Agency at least 14 days' notice of changes by email to the Agency's registered administrative contact and in-product notice, identifying the new version and its effective date.

14.2 Material changes — changes that reduce the Agency's rights, expand its obligations, introduce or increase fees, or alter the data-protection position — take effect for the Agency only on re-acceptance through the in-product consent gate. If the Agency does not accept, it may continue on the prior version until the end of its then-current term or 60 days, whichever is longer, and may terminate under Section 12.2(a) without penalty.

14.3 Non-material changes take effect on the stated date; continued use after notice constitutes acceptance. The version and effective date are always displayed at keyflowae.com/terms-of-service.

15. Governing law and jurisdiction

These Terms, the DPA and any dispute or claim arising out of or in connection with them (including non-contractual disputes) are governed by the laws of the Dubai International Financial Centre, and the parties submit to the exclusive jurisdiction of the DIFC Courts.

16. General

16.1 Entire agreement. These Terms, the DPA, the Privacy Policy (in respect of personal data as it describes) and any signed order form the entire agreement between the parties regarding the Services and supersede all prior versions, including Version 1.x published under the keyflow.me domain.

16.2 Order of precedence. A signed order prevails over these Terms; the DPA prevails over both in respect of personal data processing.

16.3 Assignment. Neither party may assign these Terms without the other's prior written consent, except that KeyFlow may assign them to a successor in a merger, acquisition or sale of substantially all its assets, with notice to the Agency.

16.4 Notices. Notices to the Agency go to its registered administrative email and are effective when sent; notices to KeyFlow go to privacy@keyflowae.com or by post to the registered address in Section 1.1.

16.5 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, provided it notifies the other and uses reasonable efforts to mitigate.

16.6 No waiver; severability. A failure to enforce a right is not a waiver. If a provision is held invalid, the remainder continues in effect, and the provision is modified to the minimum extent needed to make it valid.

17. Contact

Data-subject rights and privacy questions are handled as described in the Privacy Policy at keyflowae.com/privacy-policy, which also explains how to contact the DIFC Commissioner of Data Protection.

Document Control

Review Schedule: Annually at minimum, or when Services or regulatory requirements change materially.

Next review date: 22 July 2027

KeyFlow Technology Ltd — Terms of Service v2.0 — effective 22 July 2026. Supersedes all v1.x terms. The Data Processing Addendum at keyflowae.com/dpa forms an integral part of these Terms.

KeyFlow Technology Ltd | DIFC Commercial Licence CL-12435