Privacy Policy

EstateOS is an application for managing a residential property portfolio — properties and units, letting, rent and contract administration, financing, bookkeeping, and cashflow and tax estimates. We collect and process only the data needed to provide this service.

1. Data controller

2. Data we process

• Account data (email address, authentication via Supabase Auth).
• Portfolio data: properties, units, tenancies, tenant contact details, contracts, payments and transactions.
• Optionally linked bank transactions (CSV import or banking feed) for bookkeeping.
• Technical log data for security and troubleshooting.

3. Google user data

If you connect your Google Calendar, EstateOS uses Google OAuth to synchronise your tenancies, appointments and tasks as calendar entries. Specifically, EstateOS will:

• create, read and update calendar events that represent your tenancies, tasks and reminders;
• store the OAuth tokens needed to keep that calendar in sync.

EstateOS' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or transfer it to third parties except as needed to provide and secure the calendar-sync feature, or as required by law. Calendar access can be revoked at any time in your Google Account or by disconnecting the calendar in EstateOS, which deletes the stored tokens.

4. Legal basis

Processing is carried out to perform our contract with you and on the basis of your consent (Art. 6(1)(a) and (b) GDPR). You may withdraw consent at any time.

5. Storage location and retention

All personal data is stored in the European Union (Supabase, Frankfurt region, Germany). Data is encrypted in transit (TLS) and at rest. We retain data for as long as your account exists or as required for tax and contractual purposes.

6. Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object to processing. EstateOS supports export and erasure of your data. Send requests to the data controller named above.

7. Sub-processors

We use Supabase (hosting, database, auth, storage; EU) and Google (calendar sync, if you connect it). They process data solely on our behalf.

8. Changes

We may update this Privacy Policy. The current version is always available at this address.