Privacy Policy

1. Who We Are

EstateEngine ("we", "our", "us") provides an AI-powered sales and operations platform for Dubai real estate brokerages. Two product surfaces are covered by this single policy:

• Voice — compliant AI outbound calls to property owners, past clients, renewals, and handovers, with specialist handoff. Served at app.getestateengine.com (the host voice.getestateengine.com remains attached as an alias for prior partner integrations) and on behalf of brokerage customers.
• DM — AI replies to inbound Instagram and WhatsApp messages, with lead qualification and broker alerts. Served at the apex getestateengine.com.

This policy explains how we collect, use, store, and protect information across both surfaces. For privacy inquiries, contact us at sam@getestateengine.com.

2. Roles: Controller and Processor

This policy applies to two categories of individuals:

• Customer Users — people employed by brokerage customers who use the Service. For Customer Users, EstateEngine is the data controller.
• Call and Message Subjects — property owners, buyers, tenants, and other individuals whose personal data is processed on behalf of a brokerage customer through outbound calls or inbound DMs. For these subjects, the brokerage customer is the data controller and EstateEngine acts as a data processor under the terms of the applicable Data Processing Agreement.

3. Information We Collect

a) Account Information (Customer Users)

When you register, we collect your email address, name (optional), workspace role, and password (hashed — never stored in plaintext). If you sign in with Google, we receive your name, email, and profile picture from Google OAuth. We also log IP address, browser and device metadata, authentication events, and product usage telemetry.

b) Instagram Business Account Data (DM)

When you connect your Instagram Business account via Meta OAuth, we receive and store:

• Instagram user ID and username
• Long-lived access token (encrypted with AES-256-GCM)

We use this data solely to enable AI-powered responses to comments and DMs on your behalf. Tokens are encrypted at rest and never shared with third parties except to make authorized calls to the Meta Graph API on your behalf.

c) WhatsApp Business Account Data (DM)

When you connect your WhatsApp Business account, we receive and store:

• WhatsApp Business phone number ID and display phone number
• WhatsApp Business Account (WABA) ID
• Access token (encrypted with AES-256-GCM)

We use this data solely to enable AI-powered responses to inbound WhatsApp messages on your behalf. Tokens are encrypted at rest and only used for Meta WhatsApp Business API calls.

d) Lead and Conversation Data (DM)

When your AI agent interacts with Instagram or WhatsApp users, we store:

• Instagram username or WhatsApp phone number of the lead
• Full conversation history between the AI agent and the lead
• AI-computed lead score, temperature, and qualification data
• Lead-provided information (budget, timeline, preferences) extracted from conversations
• Contact channel source (Instagram DM, reel comment, WhatsApp message)

e) Voice Call Data

When EstateEngine Voice places or receives a call on behalf of a brokerage customer, we process on the customer's behalf:

• Name and phone number (E.164 normalised) of the call subject
• Community, unit, and listing metadata supplied by the customer
• Consent source and data source statement supplied by the customer
• Call recordings and transcripts
• Structured qualification fields captured during the call, sentiment, outcome, and derived scores
• Do-not-call and suppression status, which is retained after removal so the number is never dialled again

Voice telephony is provided through a third-party voice provider (currently Retell), which EstateEngine engages as a sub-processor under its own account. Audio media does not transit EstateEngine servers; we retain the recording URL and the transcript derived from it.

f) Property Listings

We store property listings you add to the platform (name, location, price, photos, specifications). This data is used by the AI agent to answer property enquiries on both voice and DM surfaces.

g) Usage, Operational and Billing Data

We track subscription status, tier, conversation and call usage counts, billing period dates, audit logs of state-changing actions (launches, pauses, suppressions, exports, deployments), webhook deliveries, and error traces. Payment processing is handled by Stripe — we do not store full card details.

h) Technical Data

Standard server logs including IP address, browser type, and pages visited, used for security monitoring and debugging only. Our marketing site uses Vercel Analytics and Speed Insights in cookieless mode — no tracking cookies, no device fingerprinting, no cross-site profiles.

4. How We Use Your Information

• To operate the AI agent and respond to Instagram and WhatsApp enquiries on your behalf
• To place compliant outbound calls, run specialist handoff, and deliver post-call summaries
• To enforce compliance controls: calling window (09:00–18:00 Asia/Dubai), per-owner cadence (one call per 20 hours across all campaigns in the workspace), suppression, whitelist, and DNCR checks
• To score and qualify leads using AI analysis
• To send in-app and email broker alerts when hot or warm leads are detected
• To enforce trial limits and subscription entitlements
• To display analytics on your dashboard (lead counts, conversation volumes, call outcomes)
• To secure the Service, detect abuse, and investigate incidents
• To provide customer support and operational notices
• To meet legal, regulatory, and audit obligations, including TDRA and RERA record-keeping

We do not sell personal data, and we do not use Call or Message Subject data to train third-party machine learning models.

5. Legal Basis (UAE PDPL, GDPR)

Where UAE Federal Decree-Law No. 45 of 2021 (PDPL) applies, we rely on: performance of a contract with our customer; legitimate interests in operating and securing the Service; compliance with legal obligations under UAE Cabinet Resolution 56/2024 and related TDRA rules; and, where required, consent.

Where the EU or UK GDPR applies, we rely on Article 6(1)(b), (c), (f) and, where necessary, (a). The brokerage customer is responsible for obtaining any consent required at the point of data collection and for the lawfulness of the underlying contact list.

6. Third-Party Services

We share data with the following third parties only as necessary to deliver the service:

The full sub-processor list for Voice customers is maintained in our Data Processing Agreement. We do not sell your personal data to any third party.

7. UAE Compliance Context (Voice)

EstateEngine Voice is designed for operation inside the United Arab Emirates and enforces the following in code and database constraints:

• Marketing calls are placed only within 09:00–18:00 Asia/Dubai.
• One call per owner, per workspace, in any rolling 20-hour window — across every campaign.
• A "remove me" or "do not call" request made during any call is final; the number is suppressed workspace-wide and permanently.
• Brokerage customers must hold valid RERA registration (where applicable) and TDRA prior telemarketing approval before launching outbound campaigns. These controls are enforced at launch time.

8. Data Retention

We retain your account data for the duration of your active subscription plus 30 days after account deletion.

• DM lead and conversation data is retained for 12 months from the date of the conversation, after which it is automatically purged unless you request earlier deletion.
• Call recordings, transcripts, and transcript JSON are retained for the retention period configured by the brokerage customer for their workspace (recording_retention_days, default 180 days). A nightly job clears recording URL, transcript, and transcript JSON on call rows past that window.
• Suppression records (do-not-call) are retained indefinitely to ensure removed numbers are never dialled again.
• Audit logs are retained for the term of the customer agreement.
• Instagram and WhatsApp access tokens are revoked and deleted when you disconnect the respective account or delete your EstateEngine account.

9. Your Rights

Depending on your jurisdiction, you have the right to:

• Access — request a copy of all personal data we hold about you
• Correction — correct inaccurate personal data
• Deletion — request deletion of your account and all associated data
• Portability — receive your data in a machine-readable format
• Restriction — restrict processing of your data in certain circumstances
• Objection — object to processing based on legitimate interests

Call and Message Subjects may exercise rights by contacting the brokerage that initiated the contact; where that is not possible, they may contact us and we will route the request appropriately. A "remove me" request made during a call is honoured immediately and is permanent for that workspace.

To exercise these rights, email sam@getestateengine.com. We will respond within 30 days. For data deletion instructions, see our Data Deletion page.

10. Security

We use industry-standard security measures including AES-256-GCM encryption at rest for sensitive tokens, HTTPS for all data in transit, row-level security in the database, hashed passwords, and tenant isolation enforced at the database layer. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Reporting security vulnerabilities: If you discover a security vulnerability in EstateEngine, please report it responsibly by emailing security@getestateengine.com. We will acknowledge your report within 48 hours and work to resolve verified issues promptly.

11. International Transfers

Personal data is primarily processed in the region configured for the customer's Supabase project (Voice is hosted in Mumbai, ap-south-1). Some sub-processors may process data outside the UAE (for example, in the United States or European Union). Where such transfers occur we rely on appropriate safeguards, including Standard Contractual Clauses where applicable, and equivalent transfer mechanisms recognised under PDPL.

12. Children's Privacy

EstateEngine is intended for business users only. We do not knowingly collect personal information from individuals under 18 years of age.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notice. Continued use of EstateEngine after changes take effect constitutes acceptance of the updated policy.

14. Contact

For privacy questions, data requests, or concerns: