Privacy policy

• When you ask us to keep you posted: your name, your WhatsApp number, whether you want to rent, buy or list a property, the area you prefer if you pick one, the language you read the site in, and where you came from: the tags in the link you arrived from, such as an advert's campaign, and the website that sent you, if any.
• When you book a viewing of a home: your name, your WhatsApp number, the home you want to see, the day and time you chose, the language you read the site in, and where you came from, as above.
• When you apply for a job: your name, email, phone and WhatsApp numbers, gender, nationality, age, whether you hold a Qatar ID, your CV, any portfolio link or file, your note to us, your answers to the role's questions, and where you came from, as above. Our staff add their own notes, a rating and the stage your application has reached.
• When you message or comment on our Facebook page or Instagram account: what you send us, and the name and profile details Meta shares with the owners of a page.
• When you visit the site: our hosting provider keeps standard server logs, such as your IP address and browser type, to run the site and protect it.
• When you browse the site: Meta's pixel records the pages you open, when you tap to call, email or WhatsApp us, and whether you ask us to keep you posted, book a viewing or send a job application, along with your IP address and browser type. When you send one of these three forms, our server also reports it to Meta, scrambling your name and the contact details you gave first (SHA-256 hashing) so they are not sent as written. This lets Meta tell whether you came from one of our adverts.

• To call or message you back about the property you asked about, and to arrange the viewings you book.
• To consider your job application, contact you about it and write to you at each stage.
• To reply to your messages and comments, publish our posts and run our adverts on Facebook and Instagram.
• To keep the site secure, stop abuse of our forms and fix errors.
• To measure which of our adverts on Facebook and Instagram bring enquiries, viewing bookings and job applications.

We use your data with your consent, given when you send a form or a message, and to take the steps you asked for. We never sell it, and we do not use it for anything other than the reason you gave it, except to measure our adverts as this page explains.

When you apply, an AI model reads your CV and your answers against the role and suggests a score with a short note for our team. It never shortlists or rejects anyone: a person reads every application and makes every decision. The model is not given the age, gender or nationality you enter on the form.

When you add your CV, a model also reads your name, contact details, age and nationality from it to fill in the form for you. You see every detail, and can change it, before you send.

Both requests go through our agency's service and OpenRouter, which passes them to the model's provider. Your CV is shared as a link that stops working within ten minutes.

We share your data only with the companies that run the site and our pages for us. Each may use it only to do that work for us, apart from Meta's own use, explained below.

• Socialize, our marketing agency in Doha, which builds and runs the site and our pages.
• Supabase, which stores our database and uploaded files, in Mumbai, India.
• Vercel, which hosts the site.
• Sentry, which records technical errors, with sign-in links and cookies removed.
• Google Workspace, which carries our email.
• Resend, which sends our emails to job applicants.
• GitHub, which keeps our encrypted backups.
• Telegram, which brings our staff the alerts about new enquiries, viewing bookings and job applications.
• OpenRouter and the AI providers it reaches, for job applications only.
• Meta, for anything you send us on Facebook or Instagram, and to measure our adverts. Meta also uses this information for its own purposes under its own privacy policy, such as choosing which adverts to show you.

Some of these companies process data outside Qatar, under their own security commitments.

The site keeps a few small things on your device. Your language sits in a cookie, and light or dark display in your browser's storage. Neither identifies you. The homes you save with the heart are kept in your browser's storage too: a list of homes, nothing about you, and it never leaves your device. When a link with tags brings you here, such as one of our adverts, your browser keeps those tags and the website that sent you until you close the tab, so a form you send later still says where you came from. They reach us only if you send one. Our staff panel uses sign-in cookies, for our staff only.

To measure our adverts, the site also uses Meta's pixel, which sets two of Meta's advertising cookies on your device: _fbp, which tells your browser apart from others, and _fbc, which records the click that brought you here when you arrive through a link on Facebook or Instagram, such as one of our adverts. The pixel and our server send these cookie values to Meta with the information listed under "What we collect". Meta uses that information, under its own privacy policy, to measure adverts and to choose which adverts to show you and others.

You can block or delete these cookies in your browser's settings, and the site still works without them. If you have a Facebook or Instagram account, your Meta ad preferences let you control how Meta uses your activity on other websites, such as ours, to show you adverts.

We keep your data only while we need it for the reason you gave it, then we delete it. A job application we turn down is erased six months after our answer, and any application sooner if you ask. One you start but never send is deleted within a day. Copies in our encrypted backups are replaced within 14 days.

You can ask to see the data we hold about you, to correct it, to have it deleted, or to withdraw your consent, at any time. Write to info@xcapital.qa and we will reply within 30 days. To have your data deleted, follow these steps.

If you are not satisfied with our answer, you can complain to the National Data Privacy Office at Qatar's National Cyber Security Agency.

Your data travels encrypted and is stored in systems that only our authorised staff can open, each with their own login.

When we change this policy, we change the date at the top of the page.