Privacy Policy — EstateOS™

1. Data controller and contact

The data controller for personal information collected through the Services is the operator of EstateOS™. For privacy and rights requests: privacy@estateos.pl. General inquiries: kontakt@estateos.pl.

If we appoint a Data Protection Officer (DPO), contact details will be published in this Policy.

2. Services covered by this Policy

This Policy covers data processing related to:

• property map and listing search;
• listing publication and management;
• Investment Radar, alerts, and analytics tools;
• agency CRM, partner plans, and portal import (/dolacz);
• Open House, messaging, and user-to-user contact;
• account verification, moderation, and admin tools;
• subscriptions (Investor Pro, Partner plans), Stripe payments, and in-app purchases (IAP);
• push notifications, email, and product analytics.

3. Categories of personal information

Depending on how you use the Services, we may process:

• Identifiers and contact data — name, email, phone number, company/agency details (name, tax ID, address), account IDs.
• Authentication data — passwords (hashed), session tokens, Passkeys, device identifiers, push tokens.
• User content — listing descriptions, photos, property metadata, messages, agent/agency profiles, portal-imported materials.
• Location data — GPS or approximate device location when using the map, “Locate me”, or location-based features, per device settings and consent.
• Transaction data — plan/subscription info, Stripe or app store payment identifiers (we do not store full card numbers on EstateOS unless stated otherwise).
• Technical and analytics data — IP address, browser/device type, OS, diagnostic logs, in-app events, cookies and similar technologies.
• Moderation data — abuse reports, moderation history, PENDING listing status, verification outcomes.

4. Purposes and legal bases (GDPR)

We process personal information to:

• Provide Services and perform our contract (Art. 6(1)(b) GDPR) — registration, login, listings, CRM, Radar, messaging, Open House.
• Legitimate interests (Art. 6(1)(f) GDPR) — security, abuse prevention, moderation, claims, reasonable product analytics, Platform maintenance and development.
• Consent (Art. 6(1)(a) GDPR) — optional location, certain marketing notifications, optional analytics cookies where required.
• Legal obligation (Art. 6(1)(c) GDPR) — tax/accounting, responses to authorities, mandatory record-keeping.
• You may object to processing based on legitimate interests — see Your rights.

5. Cookies and similar technologies

The website may use cookies and similar technologies for session management, language preferences, security, and — with your consent where required — traffic analytics.

You can manage cookies in browser settings. Disabling essential cookies may limit some features.

The mobile app may use on-device storage and system identifiers per Apple and Google policies.

6. Location and geospatial data

Location data may be processed when you use the map, nearby search, Radar calibration, or other location-based features. Precise location is collected only with your consent in device or browser settings.

Property coordinates in listings come from publisher-submitted data and may be visible to other users per listing settings.

7. Sharing of personal information

We may share personal information with:

• Processors — hosting, email, analytics, support, Stripe (online payments), map providers (e.g. Mapbox), push infrastructure — under data processing agreements and safeguards.
• Other users — when you publish a listing, agent/agency profile, send messages, or organize Open House.
• Public authorities — when required by law or necessary to protect rights and safety.
• Legal successors — in case of reorganization, with GDPR-consistent guarantees.
• We do not sell your personal information.

8. International transfers

Some providers (e.g. cloud infrastructure, Apple, Google, Stripe) may process data outside the EEA. We use appropriate GDPR safeguards such as EU Standard Contractual Clauses.

9. Retention

We retain data as long as necessary to provide Services, perform contracts, meet legal obligations, and defend claims.

After account deletion, data may be anonymized or removed with technical and legal delay (e.g. backups, billing, moderation). Listings may be archived for evidence for a limited time.

10. Security

We implement technical and organizational measures including HTTPS encryption, access controls, password hashing, and security monitoring. No transmission or storage method is fully secure.

11. Your rights (GDPR)

Where GDPR applies, you may have rights of access, rectification, erasure, restriction, portability, objection to legitimate-interest processing, and withdrawal of consent at any time (without affecting prior lawful processing).

To exercise rights, contact privacy@estateos.pl. We respond without undue delay within GDPR timelines.

You may lodge a complaint with a supervisory authority — in Poland: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

12. Children

The Services are not directed to children below the age requiring parental consent for data processing in your region. We do not knowingly collect such data.

13. Third-party services

The Services may include links or integrations with third parties (listing portals, maps, app stores). Their processing is governed by their own policies.

Mobile payments and app distribution may be subject to Apple App Store and Google Play policies. Stripe processes payment data under its privacy policy.

14. Changes

We may update this Privacy Policy. We will post the updated version on this page with the “Last updated” date. Material changes will be communicated appropriately.

15. Contact

Privacy questions: privacy@estateos.pl. General complaints: kontakt@estateos.pl.