Privacy Policy

1. Data Controller

EstiaHub (“we”, “us”, or “our”) is the data controller responsible for your personal data processed through this platform. If you have questions about how we handle your data, please contact us at [email protected].

2. Information We Collect

We collect information that you provide directly to us, including when you create an account, add properties, manage tenants, or use any features of EstiaHub. This may include:

• Identity data: name, email address, profile picture
• Account credentials: hashed passwords or OAuth tokens
• Property and tenancy data: addresses, lease terms, rental amounts
• Financial data: payment records, transaction history (processed via Stripe)
• Communication data: messages sent through the platform
• Usage data: log files, IP addresses, browser type, pages visited, and timestamps
• Device data: device identifiers and operating system information

We do not intentionally collect sensitive personal data (such as health, racial origin, or political opinions). Please do not submit such data through the platform.

3. Third-Party Authentication (OAuth)

You may create an account or sign in using third-party OAuth providers. We currently support:

• Google OAuth — provided by Google LLC. When you sign in with Google, we receive your name, email address, and profile picture from your Google account. Your use of Google sign-in is subject to Google's Privacy Policy.
• Microsoft OAuth — provided by Microsoft Corporation. When you sign in with Microsoft, we receive your name, email address, and profile picture from your Microsoft account. Your use of Microsoft sign-in is subject to Microsoft's Privacy Statement.

We do not receive your OAuth provider password. We only store the information returned by these providers at the time of authentication.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR) — to create and manage your account, process payments, and deliver the services you signed up for.
• Legitimate interests (Art. 6(1)(f) GDPR) — to secure the platform, prevent fraud, and improve our services, where such interests are not overridden by your rights.
• Legal obligation (Art. 6(1)(c) GDPR) — to comply with applicable laws and regulations, including tax and financial record-keeping requirements.
• Consent (Art. 6(1)(a) GDPR) — for marketing communications and non-essential cookies. You may withdraw consent at any time.

5. How We Use Your Information

We use the information we collect to:

• Create and maintain your account
• Provide, operate, and improve the platform
• Process payments and send transaction notifications
• Send service-related communications (e.g., lease reminders, maintenance updates)
• Provide customer support and respond to enquiries
• Detect, prevent, and investigate fraud or security incidents
• Comply with legal and regulatory obligations
• Send marketing communications where you have opted in

6. Third-Party Service Providers

We share your data with trusted third-party processors who help us operate the platform. All processors are bound by data processing agreements and may only use your data as instructed:

• Stripe — payment processing. Stripe handles payment card data directly and is PCI-DSS compliant. See Stripe's Privacy Policy.
• Google LLC — authentication (Google OAuth) and email delivery.
• Microsoft Corporation — authentication (Microsoft OAuth).
• Hosting & infrastructure providers — cloud hosting and database services for storing your data securely.

We do not sell, trade, or rent your personal information to third parties for marketing purposes.

7. International Data Transfers

Some of our service providers, including Google and Microsoft, may process your data outside the EEA. Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent mechanisms under applicable data protection law.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law:

• Account data is retained for the duration of your account and deleted within 30 days of account closure upon request.
• Financial and transaction records are retained for a minimum of 7 years to comply with tax and accounting obligations.
• Log and usage data is retained for up to 12 months.
• Backup copies may persist for up to 90 days after deletion.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encryption in transit (TLS) and at rest, access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. We will notify you and relevant authorities of a personal data breach where required by law.

10. Cookies and Tracking

We use cookies and similar technologies for the following purposes:

• Essential cookies — required for the platform to function (e.g., session authentication).
• Preference cookies — remember your settings such as theme preference.
• Analytics cookies — help us understand how the platform is used (only with your consent).

You can manage your cookie preferences via our cookie consent banner or your browser settings. Disabling essential cookies may affect platform functionality.

11. Your Rights Under GDPR

If you are in the EEA, UK, or another jurisdiction with applicable data protection laws, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) — request deletion of your personal data where there is no legitimate reason for continued processing.
• Right to restriction — request that we limit processing of your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format and transfer it to another controller.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making — we do not make solely automated decisions with legal or significant effects on you.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.

12. Children's Privacy

Our platform is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date above. For significant changes, we may also notify you by email. Continued use of the platform after changes constitutes acceptance of the revised policy.

14. How to Complain

If you have concerns about how we handle your personal data, please contact us first at [email protected]. If you remain unsatisfied, you have the right to lodge a complaint with your local data protection supervisory authority. In the EU, you can find your authority at edpb.europa.eu. In the UK, the relevant authority is the Information Commissioner's Office (ICO).