How we protect your data across borders
Last Updated: July 29, 2026
Jawudi, Inc. ("Jawudi," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect your information when you use our platform at jawudi.com and all associated services (the "Platform").
Jawudi operates across multiple jurisdictions — primarily the United States, the European Union (with a significant user base in France), and the Republic of Guinea. This Privacy Policy is designed to comply with the requirements of all applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and Guinea's Law on Cybersecurity and Personal Data Protection (Loi L/2016/037/AN).
By using the Platform, you acknowledge that you have read and understood this Privacy Policy.
The data controller responsible for your personal data is:
Jawudi, Inc. 85 East 125th Street New York, NY 10035 United States Email: privacy@jawudi.com
Jawudi's local operating entity in Guinea is Jawudi SARL, which processes personal data on behalf of Jawudi, Inc. in connection with local operations including field verification, property coordination, and transaction management.
EU Residents: If you are located in the EU/EEA, Jawudi, Inc. is your data controller. We are in the process of appointing an EU representative under GDPR Article 27. Until that appointment is finalized, you may direct any data protection inquiries to privacy@jawudi.com.
We collect the following categories of personal data in connection with your use of the Platform:
| Category | Data Types | Source |
|---|---|---|
| Identity & KYC | Full legal name, date of birth, nationality, government-issued identification documents (passport, national ID, driver's license), selfie/photograph for identity verification, tax identification numbers | Directly from you |
| Contact & Account | Email address, phone number(s), WhatsApp number, mailing address, preferred language, account credentials (stored in hashed form) | Directly from you |
| Financial | Payment card details (tokenized via payment processors), bank account details for wire transfers, transaction history, deposit and disbursement records from Jawudi Safe, invoices and receipts | Directly from you; payment processors |
| Communications | WhatsApp messages, email correspondence, SMS/text messages, in-platform messaging, support ticket content | Directly from you; messaging platforms |
| Property & Transaction | Property search history, saved listings, listing data submitted by Sellers, uploaded documents (title deeds, surveys, plans), transaction stage progression, valuation data | Directly from you; field agents; public records |
| Technical & Behavioral | IP address, device type and operating system, browser type, GPS/location data, cookies and tracking identifiers, session duration, page views, click patterns, referral source, push notification tokens | Automatically collected |
| Third-Party Enrichment | Identity verification results (from verification providers), credit assessment data (for pre-qualification), social login data (if using Google/Apple sign-in) | Third-party service providers |
We use your personal data for the following purposes:
Service Delivery: To create and manage your account, process property listings, facilitate transactions, operate Jawudi Safe escrow, coordinate construction oversight, and deliver property management services.
Identity Verification & KYC: To verify your identity in compliance with applicable anti-money laundering (AML) and know-your-customer (KYC) regulations, and to prevent fraud.
Communications: To communicate with you about your account, transactions, platform updates, and to respond to your inquiries. This includes communications via email, SMS, WhatsApp, and in-platform messaging.
Payment Processing: To process payments, manage escrow deposits and disbursements, generate invoices, and maintain financial records.
Platform Improvement: To analyze usage patterns, diagnose technical issues, improve the Platform's features and functionality, and develop new services.
Marketing: To send you information about Jawudi's services, promotions, and events, subject to your consent where required by applicable law. You may opt out of marketing communications at any time.
Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests, and to establish, exercise, or defend legal claims.
Safety & Security: To protect the security and integrity of the Platform, detect and prevent fraud, and enforce our Terms of Use.
If you are located in the EU/EEA, we process your personal data on the following legal bases under Article 6 of the GDPR:
| Purpose | Legal Basis |
|---|---|
| Account creation and service delivery | Contract performance — processing is necessary to perform our contract with you (Art. 6(1)(b)) |
| Identity verification / KYC | Legal obligation — processing is necessary to comply with AML/KYC regulations (Art. 6(1)(c)) |
| Payment processing and escrow | Contract performance (Art. 6(1)(b)) |
| Transaction-related communications | Contract performance (Art. 6(1)(b)) |
| Marketing communications | Consent — you may withdraw consent at any time (Art. 6(1)(a)) |
| Platform improvement and analytics | Legitimate interest — improving our services (Art. 6(1)(f)) |
| Fraud prevention and security | Legitimate interest — protecting our platform and users (Art. 6(1)(f)) |
| Legal claims and compliance | Legal obligation (Art. 6(1)(c)) and Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You may request details of these assessments by contacting us at privacy@jawudi.com.
Your personal data may be transferred to, stored in, and processed in countries outside of your country of residence, including:
United States: Our primary data infrastructure is hosted on AWS in the us-east-1 (Northern Virginia) region. Data may also be processed in additional AWS regions, including EU-based regions, for redundancy and performance. All regions maintain equivalent security standards.
Republic of Guinea: Personal data is shared with our local operating entity, Jawudi SARL, for field operations and transaction coordination.
For transfers of personal data from the EU/EEA to countries that have not received an adequacy decision from the European Commission (including the United States and Guinea), we rely on the following safeguards:
Standard Contractual Clauses (SCCs): We have implemented the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with our data processors and sub-processors to provide appropriate safeguards for cross-border transfers.
Supplementary Measures: Where necessary, we implement additional technical and organizational measures, including data encryption in transit and at rest, access controls, and pseudonymization, to ensure an essentially equivalent level of protection.
You may request a copy of the applicable SCCs by contacting us at privacy@jawudi.com.
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our general retention periods are:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account data | Duration of account plus 3 years | Contract performance; limitation periods |
| Transaction records | 7 years from transaction close | Tax and financial regulatory requirements |
| KYC/identity documents | 5 years after end of relationship | AML regulatory requirements |
| Jawudi Safe records | 10 years from final disbursement | Financial record-keeping; dispute resolution |
| Communications | 3 years from last communication | Legitimate interest; dispute resolution |
| Technical/analytics data | 24 months from collection | Legitimate interest (platform improvement) |
| Marketing consent records | Duration of consent plus 3 years | Legal obligation (proof of consent) |
When the retention period expires, we will securely delete or anonymize your personal data unless we are required by law to retain it for a longer period.
For California residents, the following table maps CCPA statutory categories to retention periods:
| CCPA Category | Jawudi Data | Retention Period |
|---|---|---|
| Identifiers | Name, email, phone, account ID | Account duration + 3 years |
| Customer Records (Cal. Civ. Code § 1798.80(e)) | Address, payment details, government ID | 5–7 years (KYC/financial regulatory) |
| Protected Classification Characteristics | Nationality, date of birth | 5 years after end of relationship |
| Commercial Information | Transaction history, deposits, invoices | 7–10 years (financial/escrow records) |
| Internet/Electronic Network Activity | IP address, session data, click patterns | 24 months from collection |
| Geolocation Data | GPS/location data | 24 months from collection |
| Audio/Electronic/Visual Information | Property photographs, selfie for KYC | 5 years (KYC); account duration + 3 years (property photos) |
| Professional/Employment Information | Occupation (if provided) | Account duration + 3 years |
| Sensitive Personal Information | Government ID numbers, precise geolocation, financial accounts, racial/ethnic origin | 5–7 years (per applicable regulatory requirement) |
| Inferences | User preferences, risk profiles | Account duration + 3 years |
If you are located in the European Union or the European Economic Area, you have the following rights under the GDPR:
Right of Access (Art. 15): You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about how it is processed.
Right to Rectification (Art. 16): You have the right to request correction of inaccurate personal data and completion of incomplete personal data.
Right to Erasure (Art. 17): You have the right to request deletion of your personal data where, among other grounds, the data is no longer necessary for the purposes for which it was collected, you withdraw consent, or the data has been unlawfully processed. This right is subject to exceptions, including where retention is necessary for legal compliance or the establishment, exercise, or defense of legal claims.
Right to Restriction (Art. 18): You have the right to request restriction of processing in certain circumstances, including where the accuracy of the data is contested or where processing is unlawful but you do not wish to request erasure.
Right to Data Portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where processing is based on consent or contract and is carried out by automated means.
Right to Object (Art. 21): You have the right to object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. You have an absolute right to object to processing for direct marketing purposes.
Right to Withdraw Consent (Art. 7): Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority. For residents of France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (www.cnil.fr).
To exercise any of these rights, please contact us at privacy@jawudi.com. We will respond within 30 days (extendable by a further 60 days for complex requests, with notification).
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, provides you with the following rights:
Right to Know: You have the right to know what personal information we collect, use, disclose, and sell or share.
Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
Right to Correct: You have the right to request correction of inaccurate personal information.
Right to Opt Out of Sale/Sharing: Jawudi does not sell or share your personal information as those terms are defined under the CCPA/CPRA.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
Right to Limit Use of Sensitive Personal Information: You have the right to limit our use and disclosure of sensitive personal information to uses that are necessary to perform services you request.
To exercise your California privacy rights, please contact us at privacy@jawudi.com or by mail at Jawudi, Inc., Attn: Privacy, 85 East 125th Street, New York, NY 10035.
We will verify your identity before processing your request and will respond within 45 days (extendable by an additional 45 days with notice).
You may designate an authorized agent to submit a request on your behalf. To do so, you must provide the authorized agent with written permission signed by you, and we may require you to verify your own identity directly with us before we process the agent's request. Alternatively, an authorized agent may submit a request using a power of attorney executed under California Probate Code §§ 4000–4465.
In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA: Identifiers, Customer records, Protected classification characteristics, Commercial information, Internet or electronic network activity information, Geolocation data, Audio/electronic/visual information, Professional or employment-related information, and Inferences drawn from the above.
Under the CPRA, certain data qualifies as "Sensitive Personal Information" and is subject to additional protections. Jawudi collects the following categories of Sensitive Personal Information: government-issued identification numbers (passport, national ID, driver's license numbers), precise geolocation data, financial account information (payment card and bank account details), and racial or ethnic origin (where voluntarily provided or collected as part of identity verification). We use Sensitive Personal Information only as necessary to provide the services you request, to verify your identity, to prevent fraud, and to comply with applicable legal obligations. You may exercise your right to limit our use of Sensitive Personal Information by contacting us at privacy@jawudi.com.
Jawudi does not disclose personal information to third parties for those third parties' own direct marketing purposes. If our practices change in the future, we will update this Policy and provide you with an opt-out mechanism as required by California Civil Code § 1798.83.
The Republic of Guinea has enacted Loi L/2016/037/AN on cybersecurity and personal data protection, which establishes a framework for the protection of personal data processed within Guinea.
Jawudi SARL, as a data processor operating in Guinea, complies with the requirements of this law, including notification obligations to the Autorité Nationale de Protection des Données Personnelles (ANPDP) for relevant processing activities.
If you have questions regarding the processing of your personal data in Guinea, please contact us at privacy@jawudi.com.
The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete that data as promptly as possible. If you believe that a child has provided us with personal data, please contact us at privacy@jawudi.com.
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify you without undue delay, in accordance with GDPR Article 33 and Article 34.
No method of transmission over the Internet or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee its absolute security.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will notify you through the Platform or by email at least thirty (30) days before the changes take effect.
For EU-resident Users, material changes affecting your rights or the legal basis for processing will require your affirmative consent before taking effect.
We encourage you to review this Privacy Policy periodically. The "Last Updated" date at the top of this page indicates when this Policy was most recently revised.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:
Jawudi, Inc. Attn: Privacy 85 East 125th Street New York, NY 10035 United States Email: privacy@jawudi.com
We are evaluating the appointment of a Data Protection Officer (DPO) and an EU representative under GDPR Article 27. This section will be updated upon such appointments.