1. Who we are and our role
EstateFlow is a real-estate sales and contract management platform. It is operated by Mohamad El Ghali (“EstateFlow”, “we”, “us”, or “our”). This Privacy Policy explains how we handle personal data when you use our website, web application, and mobile applications (together, the “Service”).
Two different roles apply. When a real-estate developer or agency (a “Company”) uses EstateFlow to manage its own clients, units, contracts, and payments, the Company decides why and how that data is processed and is the data controller; EstateFlow acts as a data processor on the Company's behalf. For account data of Company staff and for operating, securing, and improving the Service, EstateFlow is the data controller.
This policy does not replace any privacy notice a Company may give you about your purchase. If you are a buyer, your developer is the primary point of contact for requests about your purchase records.
2. Personal data we collect
We collect the following categories of personal data:
- Account and identity data: your name, email address, phone number, user ID, role, and profile photo. Passwords are handled and stored in hashed form by our authentication provider; we never see your plain password.
- Contract and financial data: contracts, unit and property details, purchase price, payment plans, installment schedules, recorded payments, receipts, and documents or files you upload.
- Client records: for Companies, information about their buyers, including names, contact details, date of birth, national or registry numbers, address, and uploaded documents.
- Device and notification data: device type, operating system, app version, and the Firebase Cloud Messaging (FCM) device token used to deliver push notifications.
- Usage, log, and diagnostic data: IP address, browser or app information, pages or screens viewed, timestamps, and error reports.
- Support data: messages and categories you submit through the in-app bug-report and support features.
3. How we use personal data
We use personal data to run and improve the Service. In particular, we use it to:
- Provide, operate, and maintain the Service, including creating and storing contracts, payment plans, receipts, and PDFs.
- Create accounts, authenticate users, and manage access to Company workspaces.
- Send transactional messages, such as invitations, password-reset emails, contract notifications, payment reminders, and push notifications.
- Provide customer support and respond to your requests.
- Detect, prevent, and address fraud, security incidents, abuse, and technical errors.
- Comply with legal, tax, and accounting obligations.
- Analyse usage and improve the features, reliability, and performance of the Service.
4. Legal bases for processing
Where the General Data Protection Regulation (GDPR) or similar law applies, we rely on the following legal bases:
- Performance of a contract: processing needed to provide the Service and to perform our agreement with you or your Company.
- Legitimate interests: securing and improving the Service, preventing abuse, and supporting our business, balanced against your rights.
- Legal obligation: retaining and disclosing information where the law requires it, including tax and accounting records.
- Consent: where we ask for your consent, for example for optional notifications. You may withdraw consent at any time.
6. International data transfers
We and our providers may store and process personal data in countries other than your own. Where personal data is transferred internationally, we take steps designed to ensure it receives an adequate level of protection, such as relying on standard contractual clauses or equivalent safeguards.
7. How long we keep data
We keep personal data for as long as your account is active or as needed to provide the Service. When an account is deleted, we delete or anonymise the associated personal data, except where we must retain it to comply with legal, tax, or accounting obligations, to resolve disputes, or to enforce agreements. Contract and payment records may therefore be retained after account deletion for the period required by applicable law.
8. How we protect data
We protect personal data with technical and organisational measures, including encryption in transit (HTTPS/TLS), authentication and access controls, and row-level security in our database so users can only reach data they are permitted to see. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, to receive a portable copy, and to withdraw consent. To exercise these rights, contact us using the details below. If you are a buyer, some requests may need to be directed to the Company that holds your purchase records. You may also have the right to complain to your local data protection authority.
11. Children
The Service is intended for businesses and adult property buyers. It is not directed to children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.
13. Contact us
For any question, request, or complaint about this Privacy Policy or your personal data, email us at [email protected].
Questions or requests?
Email us at [email protected] and we will respond as soon as possible.