Privacy Policy

This Privacy Policy describes how EstateFlow (“EstateFlow,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards personal information in connection with our websites, web applications, mobile applications, APIs, and related services (collectively, the “Service”). It applies to agency users, administrators, and visitors, and explains how agencies use the Service to process customer and lead data.

By accessing or using the Service, you acknowledge this Policy. If you do not agree, do not use the Service. This Policy should be read with our Terms of Service, Cookie Policy, and Refund Policy.

1. Scope & Roles

EstateFlow is a multi-tenant software-as-a-service (SaaS) platform for real-estate agencies and related businesses. In relation to personal data:

• EstateFlow as controller. We determine the purposes and means of processing for: platform accounts; authentication; subscriptions and billing; product analytics and security; support tickets addressed to us; and website/marketing content we operate under the EstateFlow brand (including app.estateflow.pk, api.estateflow.pk, and our mobile applications).
• Your agency as controller (or equivalent). The organization that subscribes to EstateFlow typically controls Customer Data it (and its users) enter or import—including leads, buyers, sellers, property listings, deals, visits, maps, documents, notes, media, and public website content. When we host and process that Customer Data on the agency’s instructions, we act as a processor / service provider.
• Individuals dealing with an agency. If you are a lead, buyer, or seller interacting with an agency’s listings, forms, or communications, the agency’s privacy practices and legal obligations apply to how they use your information. Contact that agency for those questions; we will assist the agency with technical access and deletion where we act as processor.

Employees and agents of a subscriber organization use the Service under that organization’s authority. The organization is responsible for informing its staff of workplace monitoring/use of the platform where required by applicable employment or data-protection law.

2. Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information.

2.1 Account, organization & billing data

• Identifiers and contact details: name, email address, phone number, job title/designation, organization name, and related profile fields;
• Authentication data: credentials (passwords are stored using industry-standard hashing; we do not store plaintext passwords), session tokens, and security events;
• Organization and access configuration: roles, permissions, seat assignments, departments, and invitation records;
• Commercial data: plan type, invoices, payment status, renewal dates, and bank-transfer or payment references (card data, where applicable, is typically processed by a payment provider and not stored in full by us);
• Support content: messages, attachments, and metadata related to support requests you send to us.

2.2 Customer Data processed for agencies

• CRM and pipeline data: leads, buyers, sellers, assignees, stages, budgets, notes, and communications logs entered by users;
• Property and transaction data: listings, media (photos/videos), maps, documents, visits, deals, offers, commission/token/payment records configured in the product;
• Agency website content: branding, published listings, contact details, and inquiry forms;
• Inbound lead payloads from connected channels (for example advertising lead forms or messaging integrations), as configured by the agency.

Agencies control what Customer Data they submit. We process it to provide the Service features they enable.

2.3 Technical, device & usage data

• Device and network data: IP address, device type/model, operating system, browser type, app version, language, and approximate location derived from IP where relevant for security or diagnostics;
• Logs and diagnostics: access logs, error reports, performance metrics, and security/anti-abuse signals;
• Usage data: feature interactions, pages or screens viewed, and timestamps, used to operate and improve the Service;
• Cookies and similar technologies on web properties (see our Cookie Policy);
• Mobile push tokens and notification delivery metadata when you enable push notifications;
• Media you choose to capture or upload (for example property photos/videos), which may include location metadata embedded in files if present in the original media.

2.4 Information we do not intentionally collect

We do not require special categories of personal data (such as health data, political opinions, or biometric identifiers for identity) to use EstateFlow. Please do not upload sensitive special-category data unless necessary and lawful, and only where you have a valid legal basis. We do not sell personal information for monetary consideration.

3. Sources of Information

• Directly from you when you register, update a profile, contact support, or use forms on our sites;
• From your organization when an administrator creates your user account or assigns roles;
• Automatically when you use the web or mobile Service (logs, cookies, SDKs);
• From integrations you or your organization connect (for example advertising or messaging platforms);
• From public or commercial sources only where permitted (for example to detect fraud or enforce security).

4. How We Use Information

We use personal information for the following purposes:

• Provide, maintain, host, and improve the Service, including multi-tenant isolation, search, media storage, and collaboration features;
• Authenticate users, manage sessions, enforce roles and seat limits, and protect accounts;
• Process subscriptions, trials, invoices, and related billing communications;
• Deliver transactional and service messages (for example security alerts, invitations, billing notices, and product announcements about the Service);
• Provide customer support and respond to inquiries at contact@estateflow.pk;
• Monitor, prevent, and investigate security incidents, abuse, fraud, spam, and violations of our Terms;
• Comply with law, regulate inquiries, and enforce our agreements;
• Analyze aggregated or de-identified usage to improve product design (where reasonably practicable, without re-identifying individuals);
• Send marketing communications about EstateFlow only where permitted by law and, where required, with consent or an easy opt-out.

When we act as a processor for Customer Data, we process it according to the agency’s instructions and the functionality of the Service (for example storing a lead, sending an inquiry to the assigned organization, or displaying a public listing the agency chooses to publish).

5. Legal Bases

Where data-protection law requires a “legal basis” (including, where applicable, the GDPR/UK GDPR), we rely on one or more of the following:

• Contract — to provide the Service you or your organization request;
• Legitimate interests — including securing the Service, preventing abuse, improving reliability, and communicating about the Service, balanced against your rights;
• Consent — where we ask for it (for example certain non-essential cookies or optional marketing), which you may withdraw without affecting prior lawful processing;
• Legal obligation — where we must retain or disclose information to comply with law or lawful requests.

Agencies are responsible for establishing their own lawful bases for Customer Data they control (for example contracts with clients, legitimate interests in managing inquiries, or consent for marketing messages).

6. Disclosure of Information

We may disclose personal information in the following circumstances:

• Within your organization — to other users and administrators according to roles and permissions you configure;
• Service providers — vendors who process data on our behalf (hosting, storage, email delivery, push notifications, analytics, and payment facilitation), under contractual confidentiality and limited-use obligations;
• Integrations you enable — third parties the organization connects, under that party’s terms and the agency’s configuration;
• Legal and safety — to competent authorities or other parties when we reasonably believe disclosure is required by law, regulation, legal process, or to protect the rights, safety, or security of EstateFlow, our customers, or the public;
• Business transfers — in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality and notice where required;
• With your direction — when you ask us to share information or use a feature that necessarily discloses it (for example publishing a public listing or generating a share link).

We do not sell personal information for money. We do not share Customer Data with other tenants except as directed by the controlling organization or as required to operate a feature that organization enables. We do not use Customer Data for third-party advertising of unrelated products.

7. Service Providers & Subprocessors

We engage carefully selected subprocessors to help operate the Service. Categories typically include:

• Cloud infrastructure and database hosting;
• Object/file storage for media and documents;
• Transactional email delivery;
• Mobile push notification and messaging infrastructure (for example Firebase Cloud Messaging);
• Error monitoring or product analytics tools, if enabled;
• Payment or billing facilitation partners, where used.

These providers may process personal information only to perform services for us and must implement appropriate security measures. A current list of key subprocessors can be requested by writing to contact@estateflow.pk.

8. Agency Websites, CRM & Mobile App

8.1 Public agency websites

Agencies may publish listings and content on EstateFlow-hosted websites (subdomain or custom domain). Content marked public may be visible on the internet. Inquiries submitted on those sites are delivered to the relevant organization. Agencies are solely responsible for privacy notices, cookie banners, marketing consents, and lawful collection practices on their public sites.

8.2 Mobile applications

Our mobile apps for iOS and Android may request permissions such as camera, photo library, microphone (for video with audio), and notifications. These permissions are used only to provide requested features (for example attaching listing media or receiving deal/visit alerts). You can revoke permissions in system settings; some features may not work without them. Push tokens are associated with your login session for delivery of notifications you are entitled to receive.

8.3 Share links and public pages

Where the product generates shareable links or public property pages, anyone with the link may access the content the organization chooses to expose. Organizations should treat share links as non-confidential unless additional controls are applied.

9. Third-Party Integrations

If an organization connects third-party tools (for example Meta Lead Ads, WhatsApp-related flows, maps, or storage providers), personal data may be transmitted between EstateFlow and those tools. Each third party’s terms and privacy policy govern their processing. We store connection credentials, tokens, and metadata only as needed to maintain the integration. Disconnecting an integration stops new syncs according to product design; records already created in EstateFlow remain until the organization deletes them.

10. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including:

• Account and organization data — for the life of the subscription relationship and a reasonable period thereafter for backup, dispute resolution, fraud prevention, and legal compliance;
• Billing records — for periods required by tax, accounting, and commercial law;
• Customer Data — while the organization account is active, and thereafter as instructed by the organization or for a limited wind-down/backup period, subject to legal holds;
• Logs and security data — for shorter operational periods appropriate to security monitoring, unless needed longer for investigations.

When retention ends, we delete or irreversibly anonymize information, subject to residual copies in encrypted backups that rotate out on a limited cycle.

11. Security

We implement administrative, technical, and organizational measures designed to protect personal information, including access controls, encryption in transit (TLS), hashed credentials, multi-tenant logical isolation, and monitoring for abuse. No method of transmission or storage is completely secure. You and your organization are responsible for safeguarding credentials, configuring user roles carefully, and using strong passwords and device security.

If we become aware of a personal-data breach affecting us as controller, we will notify affected parties and competent authorities as required by applicable law. For breaches limited to Customer Data we process for an agency, we will notify the organization without undue delay so they can fulfill their own notification duties.

12. International Transfers

EstateFlow is operated from Pakistan and may use infrastructure and subprocessors in other countries. Your information may be processed and stored outside your country of residence. Where required by law, we use appropriate transfer safeguards (for example contractual clauses or equivalent mechanisms recognized for the relevant regime). By using the Service from outside Pakistan, you understand that your information may be transferred to and processed in Pakistan and other countries where our providers operate.

13. Your Rights & Choices

Subject to local law, you may have rights to:

• Access a copy of personal data we hold about you as controller;
• Correct inaccurate data;
• Request deletion or restriction of processing;
• Object to certain processing based on legitimate interests;
• Receive a portable copy of data you provided, where applicable;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with a supervisory authority where one exists for your jurisdiction.

Platform account holders. To exercise rights regarding EstateFlow account/billing/support data, email contact@estateflow.pk from the email associated with your account and describe your request. We may need to verify your identity and will respond within a reasonable period (and within any deadline imposed by applicable law).

Individuals in an agency’s CRM. Contact the agency first. If you contact us, we may forward your request to the controlling organization and assist them as processor.

Marketing. You may opt out of EstateFlow marketing emails using the unsubscribe link (where provided) or by emailing us. You will still receive essential service/transactional messages.

Cookies. See our Cookie Policy for browser controls and non-essential cookie choices.

14. Account & Data Deletion

Organization administrators may remove users and delete many categories of Customer Data within the product. To request closure of an organization account or deletion of associated platform personal data we control, contact contact@estateflow.pk from an authorized admin email, stating the organization name and the scope of the request.

Mobile app users who wish to delete their user account should use in-app profile/settings tools where available, or email contact@estateflow.pk. Deletion of a user account does not automatically purge organization-owned Customer Data (for example listings or deal history) retained for the agency under its controllership. We will complete verified deletion requests within a reasonable time, subject to legal retention obligations and residual backup cycles.

15. Children

The Service is a business tool intended for adults capable of forming a binding contract and for professional use by real-estate organizations. It is not directed to children under 16 (or the higher age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact contact@estateflow.pk and we will take appropriate steps to delete it.

16. Additional U.S. State Notices

If you are a California resident (or a resident of another U.S. state with similar privacy laws), you may have additional rights regarding access, deletion, correction, and opt-out of certain “sales” or “sharing” of personal information for cross-context behavioral advertising. We do not sell personal information for money and do not share it for cross-context behavioral advertising as those terms are commonly defined in such laws. To exercise applicable rights, contact contact@estateflow.pk. We will not discriminate against you for exercising rights afforded by law.

Business-to-business information and employment-related information may be subject to limited exemptions under some state laws.

17. Do Not Track

Some browsers offer a “Do Not Track” signal. There is no uniform industry standard for responding to such signals. Our Service does not currently respond to Do Not Track browser signals. You can manage cookies as described in the Cookie Policy.

18. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” (and, where stated, Effective date) will change when we do. Material changes will be notified via the Service, by email to account contacts, or by a prominent notice on our website, as appropriate. Continued use of the Service after the effective date of a revised Policy constitutes acceptance of the revised Policy, except where consent is required by law for a particular change.

19. Contact Us

For privacy questions, data subject requests, security reports, or any other privacy-related matter relating to EstateFlow:

• Email: contact@estateflow.pk
• Call / WhatsApp: 03001239961 · Chat on WhatsApp
• Web: https://app.estateflow.pk

Please do not send passwords or full payment card numbers by email.