Skip to content
CRM

Legal

Privacy Policy

Last updated September 15, 2026

This policy explains what personal data EstateFlow collects when you use it, why, who it is shared with, and the choices you have.

1.Who we are

EstateFlow is a customer relationship tool for real estate agents and agencies, available at estateflow.property.

EstateFlow operates from the Republic of Albania. We handle personal data in line with Albania's law on personal data protection and, where it applies, the EU General Data Protection Regulation (GDPR).

2.Your data and your clients' data

EstateFlow handles two kinds of personal data, and our role is different for each.

  • Data about you. Your account details and subscription. EstateFlow decides how this data is used and is its controller.
  • Data about your clients. The buyers, sellers, tenants, landlords and other people you or your agency add to EstateFlow. Your agency is the controller of this data. EstateFlow processes it only on your agency's behalf, to provide the service.

If an agent or agency added your details to EstateFlow, please contact that agent or agency first. They decide what is kept about you.

3.What we collect

  • Account details: your name, email address, password (stored only as a secure hash), phone number if you add one, and your language preference.
  • Google sign-in: if you sign in with Google, the name, email address, profile picture and account identifier Google shares with us. We never see your Google password.
  • Workspace content: what you add to EstateFlow, including contacts with their phone numbers, email addresses, budgets, preferences and notes; properties with their addresses, prices and photos; deals, tasks, appointments, documents and message templates; and the record of calls and messages with your clients.
  • Team information: who belongs to your workspace, their role, and the invitations you create.
  • Billing information: your plan, number of seats, subscription status and renewal dates. Payments are handled by Stripe, and EstateFlow never receives your full card number.
  • Technical data: when you use EstateFlow, our hosting provider records your IP address, browser type, the pages requested and when. We use it to keep the service running and secure.

EstateFlow does not use advertising trackers and does not sell personal data.

4.How we use it, and why

  • To provide EstateFlow: creating your account, signing you in, storing and showing your workspace, running team features, and sending account emails such as sign-up confirmations. This is necessary to perform our contract with you.
  • To take payment: managing your subscription through Stripe. This is necessary to perform our contract with you.
  • To keep EstateFlow secure: preventing abuse, fraud and unauthorised access, and finding and fixing faults. This is based on our legitimate interest in running a safe and reliable service.
  • To meet legal obligations: keeping billing records and responding to lawful requests from authorities.

We do not use your clients' data for our own purposes. EstateFlow does not make decisions about anyone based only on automated processing that have legal or similarly significant effects on them.

5.Who we share it with

We share personal data only with the service providers EstateFlow needs to work, and only as much as each one needs:

  • Supabase: database, file storage, sign-in and account emails.
  • Vercel: hosting of the website and the application.
  • Stripe: subscription payments and invoices.
  • Google: sign-in, only if you choose to sign in with Google.

These providers are bound by contracts that require them to protect the data. Stripe and Google also act as independent controllers for some of the data they handle, under their own privacy policies.

We may also disclose personal data when the law requires it, or when it is necessary to protect the rights and safety of our users or others.

6.What you choose to share

  • Your team. Members of your workspace see what your workspace shares with them.
  • Share links. Anyone you send a share link to can see the properties on it. The exact location of a property is not shown on share links.
  • WhatsApp. When you message a client from EstateFlow, WhatsApp opens on your device with the message ready, and you send it yourself. EstateFlow records that a message was sent, but does not receive your WhatsApp conversations.

7.Where data is stored

Our providers may store and process data outside Albania, including in the European Union and the United States. When personal data is transferred outside Albania, we rely on the safeguards the law allows, such as transfers to countries with an adequate level of protection or standard contractual clauses.

8.How long we keep it

  • Account and workspace data: for as long as the account is open.
  • After an account is closed: deleted or anonymised within 90 days, unless the law requires us to keep part of it longer. Copies in backups are removed as those backups expire.
  • Billing records: for as long as Albanian tax and accounting law requires.
  • Technical logs: for a short time, no longer than 30 days, unless they are needed to investigate a security incident.

9.How we protect it

All connections to EstateFlow are encrypted. Passwords are stored only as secure hashes. Each workspace's data is separated in the database itself, so one agency cannot read another agency's records, and access to production systems is limited to what is needed to run the service.

No system is perfectly secure. If a breach affects your personal data, we will inform you and the authorities where the law requires it.

10.Cookies

EstateFlow uses only the cookies it needs to work: sign-in cookies that keep you logged in and protect your session. We do not use analytics or advertising cookies.

Pages run by Stripe and Google, such as the payment page and the Google sign-in screen, may set their own cookies under their own policies.

11.Your rights

Under the conditions set by law, you have the right to:

  • access the personal data we hold about you and get a copy of it;
  • have inaccurate data corrected;
  • have your data deleted;
  • restrict or object to how we process it;
  • receive your data in a portable format;
  • withdraw your consent at any time, where we rely on consent.

You can view and correct your account details on the Account page, and export your contacts, at any time. For anything else, contact us as described below. We reply within one month.

You also have the right to complain to Albania's Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale).

12.Children

EstateFlow is a professional tool for people aged 18 and over. It is not directed at children, and we do not knowingly collect personal data from them.

13.Changes to this policy

We may update this policy as EstateFlow changes. The date at the top shows when it was last updated. If a change significantly affects how we use your personal data, we will tell you in EstateFlow or by email before it takes effect.

14.Contact

For questions about this policy, or to exercise your rights, contact EstateFlow through the contact details published on estateflow.property.

See also: Terms of Service