Privacy Notice

1. Who we are

EstateOS is operated by FANTASY ("we", "us"), trading as EstateOS. We are the data controller for personal data processed through the Service. Contact: privacy@estatemg.dev.

2. Data we collect and why

• Account data — name, email address, login credentials and authentication identifiers (including Google sign-in identifiers). Used to create and secure your account. Legal basis: performance of contract.
• Portfolio content you enter — properties, units, leases, tenant names and contact details, rent amounts, transactions, expenses, mortgage terms and documents. Used to provide the Service to you. Legal basis: performance of contract. Where this includes information about tenants or other third parties, you are responsible for having a lawful basis to provide it; we process it on your behalf.
• Support messages — the content of emails and in-app requests. Used to answer you. Legal basis: legitimate interests.
• Usage and technical data — pages viewed, feature usage, device and browser type, IP address, timestamps and error logs. Used for security, fraud prevention, debugging and product improvement. Legal basis: legitimate interests.
• Marketing emails — only where you have opted in. Legal basis: consent, which you can withdraw at any time via the unsubscribe link.

3. Who we share data with

• Supabase — managed Postgres database, authentication and file storage. This is where your account, property, lease, tenancy and transaction records are stored, protected by row-level access rules.
• Lovable — application hosting, infrastructure and transactional email delivery (account, billing and notification emails).
• Google Maps Platform — address autocomplete and map display. Addresses you type into the property form and your approximate location data are sent to Google to return results.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where required by law or to protect our legal rights.

We do not currently use any third-party analytics or advertising service, and we do not sell personal data. If we add one, this list will be updated first.

4. International transfers

Our providers may process data outside your country, including in Canada, the United States and the European Economic Area. Where data leaves the UK or EEA we rely on adequacy decisions or Standard Contractual Clauses together with appropriate technical safeguards.

5. Retention

We keep account and portfolio data for as long as your account is active. After you delete your account, data is deleted or anonymised within 30 days, except where we must keep records longer to meet legal, tax or accounting obligations (typically up to 7 years for billing records). Logs are kept for up to 12 months.

6. Security

We apply appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls so each account can only reach its own records, least-privilege service credentials and audit logging. No system is perfectly secure, but we review these measures regularly.

7. Your rights

Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent where processing relies on consent. Contact privacy@estatemg.dev and we will respond within one month. If you are in the UK or EEA you may also complain to your local supervisory authority; in Canada you may complain to the Office of the Privacy Commissioner.

8. Cookies

We use strictly necessary cookies and local storage to keep you signed in and to remember your in-app preferences. These are required for the Service to work. Google Maps may set cookies during checkout to process your order and prevent fraud. We do not use advertising cookies. You can clear or block cookies in your browser settings, but sign-in will not work without the essential ones.

9. Changes

We will post any changes to this notice on this page and update the date above. Material changes will be notified by email or in the app.