Privacy notice

Last updated 3 November 2026

Yajar is an app for residential apartment buildings. It gives owners, tenants, household members and the people who run a building one place for notices, issues, general meetings, service charges, decisions and everyday life in the building. This notice explains what personal data Yajar holds, why, who can see it, where it is kept and the rights you have.

Who is responsible

Each building on Yajar is managed by an organization, such as its developer, its management company or its owners’ association. That organization is responsible for the personal data of its building’s members, of the contacts in its directory, and of the visitors its residents register, as the data manager under Bahrain’s Personal Data Protection Law (Law No. 30 of 2018). Its building managers add people to the building, decide requests to join it, keep its directory, its documents and its maintenance calendar, raise its service charges and confirm its payments, keep its accounts, run its notices, issues and general meetings, keep its parking spaces and its amenities’ bookings, and, with its building staff, log its parcels, receive its visitors and look up car plates.

Yajar is run by XGENO Solutions W.L.L., Unit 2064, Building 2648, Road 5720, The Lagoon, Amwaj 257, Kingdom of Bahrain (“XGENO”, “we”). We process the personal data in Yajar on behalf of each building’s organization, under an agreement with it, and only to provide Yajar. You can reach us at yajar@xgeno.com.

One account can belong to buildings of different organizations, so XGENO is responsible, as the data manager, for your account itself: your login, your sessions, the phones registered for your push notifications, and the record of the messages we send you.

Who Yajar is for

Yajar is for people aged 18 or over, household members included.

What we collect

Your account

• Your mobile number, which is how you log in.
• Your full name.
• Your email address, if you give one. It is optional.
• Whether you want push notifications and emails.

Your place in the building

• The buildings and units you belong to, your role in each (owner, tenant, household member, building manager, board member or building staff), and when each started and ended.
• For an owner, whether you live in the unit. For a household member, whom you live with.
• Your requests to join a unit, and who approved or rejected them.
• If you were added by your mobile number, the name and number entered by whoever added you: your building’s managers, or the owner or tenant of your unit. They tell you that they added you.

What you add

• The notices, issues and comments you publish, the photos and files you attach to them, your replies to general meetings, and the minutes you publish.
• When you first opened each notice, which the building’s managers and board members see as its read receipts.
• If you are a building manager, the documents you add to the building, such as its by-laws, insurance policies, contracts and warranties, and that you added each one.
• If you are a building manager, the maintenance tasks you keep, such as the lift’s yearly inspection, and when you mark one done, the date, note and files you record and that you marked it.
• If you are an owner, the payments you record for your unit: the amount, the date paid, the method, any reference and the proof of transfer you attach, and that you recorded each one.
• If you are a building manager, the service charges you raise and cancel, and the payments you record, confirm, reject or reverse, with the reasons you give, and that you did each.
• If you are a building manager, the building’s income, expenses and transfers you record, with any files you attach, the entries you void, with the reasons you give, and the budget you set, and that you did each.
• If you are an owner, your answer to each poll, and the ballot you cast for your units in each vote, and when you gave each.
• If you are an owner, whether your unit was marked present at each general meeting, because only the units present vote there.
• If you are a building manager or board member, the polls and votes you create, open, close or cancel, the units you mark present at a general meeting, and the ballots you enter there for owners who do not use the app, and that you did each.
• If you are an owner, tenant or household member, your ratings of your building’s contacts: the stars, any comment, and when you gave, changed or withdrew each.
• If you are a building manager, the comments you hide on the contacts’ ratings, with the reasons you give, and that you hid each.
• If you live in a unit, the parcels the front desk logs for it: the carrier, the number of items, any note and photo, and, when one is handed over, whether you collected it.
• If you live in a unit, the visitors you register: their name, the day of the visit, any expected time, car plate and note, and when they arrived.
• If you live in a unit, the vehicles you register for it: the plate, any make and color, the unit’s parking space it uses, and that you registered, edited or removed each.
• If you are a building manager, the building’s parking spaces you keep, and the vehicles you register, edit or remove for any unit, and that you did each.
• If you live in a unit, the bookings you make of the building’s amenities: the amenity, the day and time, the unit, any note, and that you made or cancelled each.
• If you are a building manager, how the building’s amenities are booked, the closures you add or cancel, with their reasons, the bookings you make for any unit, and the bookings you confirm, reject or cancel, with the reasons you give, and that you did each.
• If you live in a unit and join your building’s resident directory, that you are in it and when you joined and left it, the messages you write to other units, each with your name and the unit you wrote as, when you last read each conversation, and the units you block or unblock, and that you did each.
• If you live in a unit and join your building’s resident directory, the posts you put on its community board: the kind, title, text and photos, any price, or an event’s date, time and place, the unit you posted as, and that you posted, edited or closed each.
• The community posts you report, with the reason you give.
• If you are a building manager, the community posts you hide, with the reasons you give, the reported posts you keep, and the building’s move-in and move-out checklists, and that you did each.
• If you live in a unit, the items you tick on your building’s move-in and move-out checklists.
• If you are a building manager or a member of the building staff, the parcels you log, hand over, return or cancel, with the notes and reasons you give, the visitors you mark arrived, and the vehicle alerts you send, and that you did each.

If you are in a building’s directory

• A building’s managers can add service contacts to its directory, such as a plumber, an electrician, a driver, the building staff’s work numbers and emergency numbers. Each has a trade, a name, a phone number, an email address if one is given, whether the number takes WhatsApp, and notes, such as when to call.
• A building manager enters each contact by hand. It is never taken from an account on Yajar or from anyone’s phone, so your number is in a directory only if a building manager enters it.
• The building’s owners, tenants and household members can rate each contact, with 1 to 5 stars and a comment, which every member of the building sees.

If you visit a building

• A resident can register you before you come: your name, the day of your visit and, if they give them, the time they expect you, your car plate and a note. The building’s front desk sees them, and marks when you arrive.
• On the day of your visit, the front desk can find it from your car plate, and ask whoever registered you to have the car moved, without naming you or the plate.
• Your name and car plate are erased 30 days after the day of your visit. The rest of the visit, such as its day and the unit you visited, stays as the building’s record.

Your phone

• An identifier that Google’s Firebase gives the app on your phone, so that we can send it push notifications, and whether the phone is an Android phone or an iPhone.

For security

• Login codes and session tokens, which we keep only in a form that cannot be turned back into the code or the token.
• Your network address when you ask for a login code, kept in the same form, to limit how many codes can be asked for.
• A record of each SMS, push notification and email we send: whom it went to, when, and whether it was delivered. For an SMS it keeps the number, encrypted, and never the text.
• Server logs of each request’s address within Yajar, its result and how long it took. They hold no names, mobile numbers, email addresses or content.

What we do not collect

We do not collect your location or your phone’s contacts. Yajar has no advertising, no analytics and no tracking. The app uses the camera only when you scan a unit’s QR code or take a photo to attach, and a photo leaves your phone only when you attach it. On Android, the app can read a login code from its SMS only when you allow it, for that one message, and it reads no other messages.

Why we use it

• To log you in and keep you logged in.
• To give you access to your buildings and units, and to show you what your role allows.
• To carry your building’s notices, issues and general meetings, and to tell you about them by push notification, in the app’s inbox and, for general meetings, by email.
• To keep your building’s directory, so that its members can call its contacts or write to them on WhatsApp.
• To let your building’s residents rate its contacts, so that a good one is easy to find.
• To keep your building’s documents in one place, such as its by-laws, insurance policies and contracts.
• To keep your building’s maintenance calendar, and to remind its managers of the work due.
• To keep your building’s service charges and payments, and to remind owners of what is due, by push notification, in the app’s inbox and by email, with the unit’s overdue amount and balance and how to pay.
• To keep your building’s accounts: its income, expenses, budget and funds.
• To run your building’s polls and votes among its owners, online or at a general meeting, and to tell owners when one opens and how a vote ended.
• To tell your building’s residents about their parcels, and to let its front desk receive the visitors they register.
• To let your building’s front desk find whose car it is from its plate, and ask for it to be moved.
• To let your building’s residents book its amenities, and its managers decide the bookings that need approval and close an amenity when needed.
• To let the residents in your building’s resident directory write to each other’s units without sharing their numbers, and to tell the other unit of a new message.
• To let the residents in your building’s resident directory sell, give away and find things, and announce community events, on its community board, and its managers hide a post reported to them.
• To give your building’s residents its checklists for moving in and moving out.
• To keep Yajar secure, for example by limiting login codes, and to look into problems.
• To meet our legal obligations.

We use your data for these purposes only, on behalf of your building’s organization, because it is needed to provide the service that you and your building use. We do not sell it, and we do not use it for advertising.

Who can see it

• Other members of your building see your name with your unit number, or with your role, on what you publish, report or comment, and the people of a unit see each other. Residents never see another person’s mobile number or email address.
• Your building’s managers see your name, mobile number, email address, units and roles in the admin site, to run the building.
• Building managers and board members see who has opened a notice, and each owner’s reply to a general meeting.
• Every member of a building sees the contacts in its directory, with their phone numbers and email addresses, until a building manager switches one off.
• Every member of a building sees the ratings of its contacts and their comments, each shown with the rater’s units, such as Unit 12, never their name. The building’s managers see who gave each rating, by name, and can hide a comment.
• Members of a building see the documents its managers add: every member those for everyone, and owners and board members those for owners only. Once a document is archived, only the building’s managers see it. A document can hold personal data, such as the names in a contract.
• Building managers and board members see the building’s maintenance calendar, with the notes and files recorded on each task, which can hold personal data, such as a contractor’s name.
• The owners of a unit see its statement: its charges and payments, each payment with who recorded it and its proof of transfer. The building’s managers and board members see every unit’s. A statement or receipt names the unit, never a person. A proof of transfer can hold personal data, such as the name and account number on a bank transfer.
• Owners, board members and building managers see the building’s accounts, with each entry and the files attached to it, which can hold personal data, such as a contractor’s name on an invoice. Service charges collected are shown in total, never by unit.
• Owners, board members and building managers see the building’s polls and votes. The building’s managers see each owner’s answer to a poll and who cast each unit’s ballot, by name, and board members see them as the unit’s owner, such as Unit 12 Owner, unless they own the same unit. Other owners see a poll’s counts, never your answer, and the owners of your unit see its ballot and who cast it.
• Building managers and board members see which units are present at a general meeting, and can enter there the ballot of a unit present whose owner does not use the app.
• The front desk, which is the building staff and the building managers, sees every parcel and every visitor, with the visitor’s name and car plate until they are erased. It finds a registered vehicle, or the car of a visitor expected that day, by its plate, and sees its unit, make, color and space, never a name. The building’s managers also see who registered each visitor and each vehicle.
• The residents of a unit see its parcels logged since they joined it, with who collected each, and its parking spaces and vehicles. Owners who do not live in the unit see neither. A visitor is seen by whoever registered them, and not by the rest of the unit.
• The building’s managers see every booking of its amenities, with its unit, who made it and its note. Other residents see only whether a slot is free or taken, never who booked it.
• Residents in your building’s resident directory see each other’s names, with the units they live in, and nothing else about each other. A conversation between two units is seen only by the residents of those units who are in the directory, each message with who wrote it, by name. Each sees the messages written since they became a resident of their unit, so someone who moves in after you does not read what you wrote. Nobody else sees it, not the building’s managers and not XGENO’s platform admins. Once you leave the directory, you no longer see your unit’s conversations.
• Every member of a building sees the open posts on its community board, each with its author’s name and the unit it was posted as. A closed or hidden post is seen only by its author and the building’s managers, who also see who reported a post and why. A post’s text and photos can hold personal data.
• Only you see the items you tick on your building’s checklists.
• XGENO’s platform admins can see a building’s data, except the conversations between units and the items residents tick on their checklists, to set the building up and to help when something goes wrong.
• Our service providers, who handle data for us only as needed to run Yajar: Microsoft Azure runs the Yajar service and Amazon Web Services keeps its database and files, both in Germany; Brevo sends login codes by SMS, and general meeting and dues reminder emails; Google’s Firebase Cloud Messaging and Apple’s push notification service deliver push notifications.
• Authorities, where the law requires it.

Where it is kept

Yajar’s database and files are kept in the European Union, in Frankfurt, Germany. The European Union is on the list of countries that Bahrain recognizes as protecting personal data adequately.

To deliver an SMS, an email or a push notification, the number, address or phone identifier and the message pass through the provider that delivers it, which may handle them outside the European Union. A notification’s text never includes a name, a mobile number, an email address or what a neighbor wrote.

How it is protected

• Names, mobile numbers and email addresses, the directory’s included, visitors’ names, the plates of vehicles and visitors’ cars, and the messages between neighbors, are encrypted in the database, and the keys are kept apart from the data, with a different cloud provider.
• The database and the files are encrypted where they are stored, and every connection uses HTTPS.
• Only the Yajar service can reach the database and the files. The app and the admin site reach them only through it, and it checks every request against the person’s role in the building.
• On your phone, your session is kept in the phone’s secure storage.
• If a breach exposes your personal data, we tell the Personal Data Protection Authority within 72 hours of finding it, and you within 30 days.

How long it is kept

• Your account is kept until you delete it. Your memberships and roles, and what you add, are kept as the building’s record, with no end date. An ended membership or role is kept as history, so that it stays clear who owned or rented a unit, and when.
• If your building stops using Yajar, its data stays on Yajar as the building’s record, and only XGENO can reach it.
• A contact in a building’s directory is kept as the building’s record too. A building manager switches it off rather than removing it, and members then no longer see it.
• A visitor’s name and car plate are erased 30 days after the day of the visit.
• A vehicle’s plate is erased when the vehicle is removed. A vehicle you registered for your unit is removed when you no longer live there.
• The messages between neighbors are never deleted. Once you delete your account, they stay without your name.
• A community post closes 30 days after it was posted, or a community event at the end of its day, and your open posts close when you leave the resident directory, or when you no longer live in the unit you posted them as. A closed post is kept as the building’s record.
• Login codes are deleted after 24 hours, and sessions 30 days after they end.
• Notifications are deleted after 90 days, and the records of messages sent after 30 days.
• Server logs are deleted after 30 days, and database backups after 7 days.
• Your phone’s push identifier is deleted when you log out, when you delete your account, or when it stops working.

Your rights

Under Bahrain’s Personal Data Protection Law you can:

• ask what personal data Yajar holds about you, and for a copy of it;
• ask for it to be corrected, or erased or blocked where the law allows;
• object to how we use it;
• complain to the Personal Data Protection Authority.

You can change your name and email address in the app, under Profile, and switch push notifications and emails off there. For anything else, write to your building’s management, or to us at yajar@xgeno.com, and we answer for your building’s organization. If you are in a building’s directory, or a resident registered you as a visitor, write to that building’s management, or to us. We may ask you to confirm that the request is yours, and we answer within 30 days.

Deleting your account

You can delete your account in the app: open More, then Profile, and choose Delete account. It is deleted at once. Your name, mobile number and email address are erased, your memberships and roles end, and your sessions, push identifiers and notifications are deleted. The household members who live with you leave the unit too, you leave the resident directory, which closes your open community posts, the visitors you expect and your upcoming bookings are cancelled, and the vehicles you registered for your units are removed. What you published, reported or commented stays in your building’s record, without your name, shown as “Deleted account”. Erased data stays in database backups until they are deleted, after 7 days.

If you no longer have the app, Delete your account explains how to ask us instead.

Changes to this notice

We publish any change on this page, with a new date at the top.

Contact

XGENO Solutions W.L.L.
Unit 2064, Building 2648, Road 5720, The Lagoon, Amwaj 257, Kingdom of Bahrain
yajar@xgeno.com