Privacy Policy

Who we are

Estaro Ltd (“Estaro”, “we”, “us”) provides property and tenancy management software to estate and letting agencies.

• Registered office: 2 Tower Square, Tunstall, Stoke-on-Trent, Staffordshire, England, ST6 5AA
• Company number: 17136094
• Contact for data protection matters: estaro@mail.com

This policy explains how we handle personal data. It covers two different situations, and the distinction matters:

1. Data about our own customers — the agencies who subscribe to Estaro and the staff who log in. For this data, Estaro is the data controller.
2. Data about an agency’s tenants and landlords — the records an agency enters into Estaro. For this data, the agency is the controller and Estaro is the processor, acting on their instructions. Tenants and landlords with questions about their data should contact the agency managing their property in the first instance.

Data we hold as controller (our customers)

When an agency uses Estaro, we hold:

• Names and email addresses of staff who log in
• A securely hashed version of each password (we never store passwords in readable form and cannot recover them)
• Agency name, address, phone number and contact email
• Any logo uploaded
• Subscription and trial status
• A record of actions taken in the system — who changed what, and when — kept as an audit trail
• Technical records generated by using the service, such as server logs

Why we hold it

• To provide the service — you cannot log in or use Estaro without an account. Our lawful basis is performance of a contract.
• To keep the service secure — audit logs and login records help us and our customers investigate unauthorised access. Our lawful basis is legitimate interests, namely protecting the service and the data in it.
• To contact you about your account, including reminders about compliance deadlines and rent arrears within your own portfolio. Our lawful basis is performance of a contract.
• To meet legal obligations, such as keeping accounting records.

We do not use your data for advertising, and we do not sell it.

Data we process on behalf of agencies

Agencies use Estaro to record information about their properties, tenants and landlords. This typically includes:

• Tenant names, email addresses and phone numbers
• Tenancy details, rent amounts and payment history
• Deposit amounts and protection scheme references
• Maintenance requests and contractor details
• Landlord names and contact details
• Documents uploaded against a property, such as compliance certificates and tenancy agreements

We process this only as instructed by the agency, under a data processing agreement. We do not use it for our own purposes.

Estaro staff can access an agency’s account to provide support. Where this happens, it is recorded in that agency’s activity log so they can see it took place.

Who else handles the data

We use the following providers to run Estaro. Each processes data on our instructions under a contract:

Vercel is based in the United States. Where personal data is transferred outside the UK, we rely on the safeguards set out in Chapter V of the UK GDPR, including standard contractual clauses where applicable.

We do not share personal data with anyone else, except where required by law.

How long we keep it

• While you are a customer — for as long as your account is active.
• After cancellation — we keep your data for 90 days so you can export it or reactivate, then delete it permanently from our production systems. Backups are removed within a further 30 days.
• Accounting records — retained for six years where required by law.
• Audit logs — retained for the life of the account, as they exist to provide an accurate history.

An agency can ask us to delete their data sooner. We will do so unless we are legally required to keep it.

Keeping data secure

• Passwords are hashed using bcrypt and are never stored or transmitted in readable form.
• All traffic is encrypted in transit using HTTPS.
• Each agency’s data is isolated at the database level, so one agency cannot access another’s records.
• Uploaded documents are stored privately and are only accessible through time-limited links.
• Access to production systems is limited to those who need it.
• Login attempts are rate-limited to protect against password guessing.

No system is completely secure, but we take these measures seriously and review them as the service develops.

Your rights

Under UK data protection law you have the right to:

• Ask what personal data we hold about you and get a copy
• Have inaccurate data corrected
• Ask us to delete your data in certain circumstances
• Object to or restrict how we use it
• Receive your data in a portable format
• Withdraw consent, where we rely on it

To exercise any of these, email estaro@mail.com. We will respond within one month.

If you are a tenant or landlord whose data was entered by an agency, please contact that agency directly — they decide how your data is used, and we can only act on their instructions.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office:

• Website: ico.org.uk
• Helpline: 0303 123 1113

Cookies

Estaro uses a single cookie to keep you logged in. It is essential to the service, contains no tracking information, and expires after seven days. We do not use analytics or advertising cookies.

Changes to this policy

We may update this policy as the service changes. Where changes are significant, we will let account holders know by email. The date at the top shows when it was last revised.