Privacy Policy

1. Dual Controller & Processor Framework

To provide transparent data protection compliance (including GDPR and the Kenya Data Protection Act, 2019), EstateTrack operates under a distinct dual responsibility model:

EstateTrack as Data Controller:

We act as the authoritative Data Controller for account authentication profiles, credential security, landlord subscription billing records, edge security telemetry, and user legal consent logs.

EstateTrack as Data Processor (Landlords as Controllers):

The landlord or executive management firm is the Data Controller for all operational tenancy records (tenant contact records, lease agreements, unit assignments, rent invoices, maintenance logs, and in-app communications). EstateTrack processes this data solely on the landlord's instruction within strict organizational boundaries.

Seeker Inquiry Data:

EstateTrack collects prospective tenant inquiries upon one-time email confirmation as initial Controller, and securely delivers confirmed leads to the listing landlord and assigned staff for vacancy fulfillment.

2. Information We Collect Across Roles

Landlords & Property Managers

Name, verified email, telephone number, display title, organization trade name, country, pricing tier, and subscription payment history.

Caretakers & Field Staff

Name, verified email, phone number, role assignment, and associated property assignment identifiers.

Tenants & Residents

Name, verified email, phone number, assigned unit, lease terms, payment claim references, and maintenance submissions.

Public Seekers & Visitors

Email address (one-time confirmed), inquiry message, search text criteria, and session security tokens. Zero account credentials created.

3. Intra-Organizational Access Boundaries (Scope)

Data visibility within an organization is strictly partitioned by role (Master Blueprint §1.7):

Landlord: Complete visibility across all properties, units, staff, and financial ledgers within their organization only. Never sees data of other landlords.
Property Manager: Scoped strictly to assigned properties; cannot inspect unassigned properties or create organizations.
Caretaker: Operational access to maintenance work orders and turnaround inspections on assigned properties; zero access to rent invoices or bank claims.
Tenant: Access strictly restricted to their own unit, active lease, billing invoices, receipts, and personal maintenance requests.

4. Trusted Infrastructure & Sub-Processors

We partner exclusively with SOC-2 and ISO 27001 certified infrastructure providers. We do not sell, rent, or trade telemetry to advertising data brokers:

Database & Auth: Supabase Inc. (AWS Data Centers with AES-256 encryption at rest).
Hosting & Edge Delivery: Vercel Inc. (TLS 1.3 edge termination).
Sign-In Authentication: Google LLC (OAuth token identity verification).
Mapping & Search: CartoDB (map tiles) and Google Gemini (natural language search text only; no personal records shared).
Subscription Billing Gateways: Paddle.com Inc. (cards/wallets, merchant of record) and Safaricom PLC (Daraja M-Pesa API).
Transactional Email: Resend Technologies Inc. (account setup and password reset emails only).

For a complete sub-processor registry, review our Service Providers Directory.

5. Authoritative Retention Schedule

We retain personal records only as long as necessary to provide platform services and satisfy statutory obligations (Master Blueprint §19.10):

Data Category	Retention Duration	Post-Retention Action
Active Tenancy & Portfolios	Life of active account	Retained while active
Closed Landlord Organization	30-day reversible window	Permanent purge on Day 30
Media Uploads (Purged Account)	Purged immediately on Day 30	Permanent storage erasure
Financial Ledger Entries	3 Years in compliance archive	Permanent erasure after 3 yrs
Tenant Move-Out Profile	Login ends immediately	Email freed platform-wide
Seeker Vacancy Inquiries	12 Months	Automated record purge
Legal Consent Audit Records	Life of account + 6 years	Statutory evidentiary archive

6. Your Data Protection Rights

Every user retains fundamental data autonomy rights under applicable privacy legislation:

Right to Access & Portability: Landlords may export all tenant rosters and financial ledgers at any time in standardized CSV/JSON formats on every plan tier.
Right to Rectification: Account holders can update incorrect contact data via Account Settings.
Right to Erasure (“Right to be Forgotten”): Users can request account deactivation. Statutory accounting standards require anonymized ledger lines to be retained for 3 years before final deletion.

To exercise any privacy right, contact our Data Protection desk. We respond to all formal requests within thirty (30) calendar days.

7. Privacy Inquiries & Contact

For questions regarding data processing, cross-border transfers, or to file an inquiry, reach out to our dedicated privacy office:
privacy@myestatetrack.com • Data Protection Desk, XILFANX LLC