1. Status of this document
This is an unapproved draft. It describes the behaviour of the website as it is built today, but it has not been checked by a lawyer and the business has not approved it.
Where a decision belongs to the business rather than to the website, this document says so instead of guessing.
2. Who operates this website
Cairo Elite Services is the trading name used on this site, and Mustafa Raafat is the personal contact named throughout it. The legal details below are not yet confirmed and must be completed before this notice can be relied on.
Until they are, the practical contact route is the WhatsApp number published on this website.
- Legal name of the operating entity
- Registered address
- Company or commercial registration number
- Country whose law applies to this notice
- Written contact address for privacy questions
- Whether a data protection officer or representative is required, and who it is
3. The short version
This website has no accounts, no sign-up, no newsletter, no payment and no form that sends your details to us.
It runs no analytics, no advertising and no tracking of any kind. The only cookie it ever sets is the sign-in cookie for the protected Property Desk, and it is set only after someone signs in there.
4. Enquiries through WhatsApp
The contact dialog assembles a message inside your browser from the services you select, the package you pick and a name if you choose to type one. Nothing is transmitted to us while you do this: the text stays in your browser and is placed into a WhatsApp link.
WhatsApp is an external service. It is not operated or controlled by us, it receives the message text and your WhatsApp account details when you open the link, and it applies its own privacy policy. Opening the link is your action and your decision.
Once a conversation starts, the recipient sees your phone number, your WhatsApp profile name and whatever you write. That conversation lives in WhatsApp, not on this website.
- The name field is optional — an enquiry without it works exactly as well.
- The message is visible in the link before you send it, so you can read and edit it in WhatsApp first.
- This website keeps no copy of the message, no lead record and no contact list.
5. Property Desk sign-in
The Property Desk is protected by one shared password. There are no personal accounts, so signing in identifies a session and not a person.
A correct password sets one cookie, ce_property_access. It contains only the time it was issued, the time of the most recent request, a random session identifier and a signature — no name, no address and nothing derived from the password itself.
- HttpOnly, Secure and SameSite=Strict, and limited to the /property-desk path, so it is never sent to the rest of the site or to anyone else.
- It ends after 30 minutes without activity and after 12 hours in total, whichever comes first.
- The Sign out button clears it immediately.
- It is strictly necessary for the protected area to work, so no consent is asked for it.
6. Protecting that sign-in
Because the password sits on a public address, failed attempts are counted so that it cannot simply be guessed. The counter is stored in a Cloudflare D1 database.
The key is a one-way, salted HMAC-SHA256 fingerprint of the connecting IP address. The address itself is never written down: a row holds that fingerprint and four numbers, and nothing else.
- A record is deleted 75 minutes after the last failed attempt, or 75 minutes after a lock on that source runs out, whichever is later.
- A successful sign-in deletes that source's record immediately.
- The fingerprint cannot be reversed into an address, and rotating the salt makes old fingerprints meaningless.
7. Logs
The application writes one structured line per security event: a sign-in granted, refused or throttled, a rejected session, a sign-out, and failures of the protection described above.
These lines deliberately exclude the submitted password, anything derived from it, the session cookie or token, the IP address, the browser user agent, query strings and the text of any enquiry.
Separately, Cloudflare — the platform this site is served from — processes connection data including IP addresses in order to deliver and protect the site. That happens at the platform level under Cloudflare's own terms, not in this application's code.
- How long application security events are retained, and who may read them
- The Cloudflare log retention and access settings chosen for production
8. Property Desk content and images
When the desk is connected to our listing system, the listings and their photographs come from that system. Images are fetched by our server and delivered from this website's own address, so your browser never contacts the storage provider and no image address can be guessed or shared.
Those responses are never cached and never indexed. When no listing system is connected, the desk shows clearly labelled demonstration entries that are not real properties.
A listing record may name a property owner or instructing party. That is business information about a property, not information about you as a visitor.
10. How long things are kept
Only two things are stored by this website at all, and both expire on their own:
- Property Desk sign-in cookie — in your browser; 30 minutes of inactivity or 12 hours in total, and immediately on sign-out.
- Failed sign-in counters — in Cloudflare D1; 75 minutes after the last failure, longer while a lock is still running, and immediately after a successful sign-in.
- A WhatsApp conversation lives in WhatsApp with the person you wrote to; how long the business keeps such conversations is a business rule that is not set here.
- Application security events and platform request logs are kept for a period that is still to be decided (section 7).
- How long WhatsApp enquiry conversations are kept by the business, and who may read them
11. Your rights and how to reach us
Which rights you have — access, correction, deletion, objection, portability, complaint to a supervisory authority — depends on the law that applies, and that depends on the operating entity and jurisdiction that section 2 leaves open.
Today the practical route for any request or question is the WhatsApp number published on this website. A written contact address will be added when the details in section 2 are confirmed.
- The rights process: who answers, within what time, and by which channel
- The competent supervisory authority, once the jurisdiction is fixed
12. Changes to this notice
The version and the date at the top of this page identify the text you are reading. A material change raises the version, records a new date, and is reviewed by the accountable owner before publication.
Once in force, this notice is reviewed at least once every 12 months even if nothing has changed.