Privacy Policy
Last updated: 15 June 2026
1. Overview
This Privacy Policy explains what personal data Estatz collects, how we use it, how we protect it, and your rights under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). By using Estatz, you agree to the practices described in this policy.
2. Data We Collect
Account information: name, email address, and phone number. CRM data: clients, deals, listings, tasks, follow-ups, commissions, documents, notes, and communications you enter into the platform. Usage data: device information, IP address, browser type, pages visited, and feature usage patterns. Payment data: billing details processed by Stripe. We do not store credit card numbers on our servers.
3. How We Use Your Data
To provide, maintain, and improve the Estatz platform. To process payments and manage your subscription. To send transactional communications such as verification emails, billing receipts, and service alerts. To send marketing communications with your consent. To generate AI-powered features including lead scoring, morning briefs, follow-up suggestions, and deal analysis. To comply with legal obligations under UAE law.
4. Artificial Intelligence
Estatz uses artificial intelligence to power features such as lead scoring, daily briefs, follow-up drafting, deal analysis, and pipeline monitoring. When these features process your data, it is sent to our AI provider (Anthropic via AWS Bedrock, hosted in the United States) for analysis and returned to your account. Your data is processed under Anthropic's API terms, which prohibit using customer data to train AI models. AI processing is subject to the same security controls and tenant isolation as all other data in Estatz.Each user has 100 AI credits a day included in their plan. Where AI credit overage is on (always on the Solo plan; on Agency plans only when the workspace admin turns it on), further use is billed at AED 0.15 per credit, up to a hard limit of 500 credits per user per day.
5. Data Storage and Security
Your data is stored in encrypted databases hosted on Amazon Web Services in Frankfurt, Germany (eu-central-1 region). We enforce row-level security across all tenant data tables, ensuring complete tenant isolation - no other user or organization on the platform can access your data. Access is restricted, audited, and monitored. All connections are encrypted in transit (TLS) and at rest (AES-256). We never sell, rent, or trade your data.
6. International Data Transfers
Your CRM data is stored in AWS Frankfurt, Germany (EU region). When you use AI-powered features, your data is temporarily processed by Anthropic via AWS Bedrock in the United States and returned to your account. Payment data is processed by Stripe (United States). Analytics are processed by PostHog. These transfers are governed by each provider's data processing agreements and comply with the UAE PDPL requirements for international transfers.
7. Third-Party Processors
We share your data only with the following processors, solely for the purpose of providing the service: Stripe for payment processing. Anthropic (AWS Bedrock) for AI features. PostHog for product analytics (cookie-free). Sentry for error monitoring. Resend for transactional email. Cloudflare for content delivery, image hosting, and file storage. Amazon Web Services for infrastructure hosting. We do not share your data with any other third party unless required by law or with your explicit consent. Broker-to-broker features (DealHub) share only the listing and requirement data you explicitly publish.
8. Data Retention
Your data is retained for as long as your account is active. When you cancel your subscription, your account enters read-only mode. After 30 days, we send a reminder email. After 60 days, we send a final warning. After 90 days, the workspace is closed. After 180 days, all CRM data - clients, deals, listings, documents, tasks, follow-ups, commissions, and all associated records - is permanently deleted from our systems. Personal information (name, email, phone) is anonymized. This process is automatic and irreversible. Trashed documents are permanently deleted within 30 days of being trashed.
9. Your Rights
Under the UAE PDPL, you have the right to: access your personal data held by Estatz, correct inaccurate or incomplete personal data, export your CRM data (clients, deals, listings, documents) via CSV at any time from within the platform, request deletion of your personal data by contacting us at privacy@estatz.app, withdraw consent for marketing communications at any time, and object to processing of your personal data for specific purposes. To exercise any of these rights, contact us at privacy@estatz.app. We will respond within 30 days as required by the PDPL.
10. Children
Estatz is designed for licensed real estate professionals and is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will delete it immediately and terminate the associated account.
11. Cookies
We use essential cookies for authentication and session management. PostHog, our analytics provider, operates without cookies - no tracking data is stored on your device. For full details on our use of cookies and similar technologies, see our Cookie Policy.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email at the address associated with your account at least 14 days before the changes take effect. We will also update the date at the top of this page. Continued use of Estatz after the effective date constitutes acceptance of the updated policy.
13. Contact
For privacy inquiries, data access requests, or complaints, contact us at privacy@estatz.app.