Estata Privacy Policy

Last updated: 7 November 2026

Version 2026-10-24

This Privacy Policy explains how KMT TECHNOLOGIES FZCO collects, uses, shares and protects personal data in connection with Estata, the property management platform available at https://estata.app (the "Service"), and what rights you have.

1. Who we are

1.1 Controller. KMT TECHNOLOGIES FZCO is a Free Zone Company registered in the Dubai Multi Commodities Centre (DMCC), licence number DMCC 821264, registration number DMCC190245, with its registered address at Unit 3298, DMCC Business Centre, Level 1, Jewellery & Gemplex 3, Dubai, United Arab Emirates ("KMT", "we", "us" or "our"). Estata is a brand of KMT.

1.2 Contact. For any question about this Privacy Policy or to exercise your rights, contact us at support@estata.app.

1.3 Representatives and data protection officer.

1.4 Who this Policy covers. This Policy covers the personal data for which KMT is the controller, mainly:

users of the Service whom our business customers invite to their workspaces, including administrators, property managers, staff and property owners ("Users");
billing and account contacts of our customers;
people who contact us, request a demonstration or correspond with us about the Service; and
visitors to our website and sign in pages.

2. Data our customers put into the Service

2.1 Our customers decide. Our customers, such as property managers and property owners, use the Service to manage their properties, units, bookings, leases, renters, guests, finances, receipts, maintenance, cleaning and messages. When they do, they decide what personal data to record and why. For that data, the customer is the controller (in Israel, the database controller) and KMT acts only as a processor (in Israel, a holder) on the customer's instructions, under our Data Processing Addendum with the customer.

2.2 Which privacy notice applies. If you are a renter, guest, property owner, staff member, contractor or any other person whose data a customer has recorded in the Service, the privacy notice of that customer applies to your data, not this Policy. Please contact the relevant property manager or owner with questions or requests about your data.

2.3 If you contact us. If you send us a request about data held by one of our customers, we will forward it to the relevant customer where we can identify them and will not respond to it ourselves except as the customer instructs or the law requires.

3. Personal data we collect as controller

3.1 Account and profile data. Your name, email address, optional phone number, role and workspace, preferred language, password (stored only as a secure hash, never in readable form), and, for platform administrators, multi factor authentication settings. Usually your workspace administrator provides your name, email address and role when inviting you, and you complete the rest.

3.2 Billing and transaction data. For customers that subscribe to a paid plan: the billing contact's name and email address, billing address, company name, tax or VAT number, plan, subscription status, invoices and payment history. Payments are processed by Stripe. We never receive or store full payment card numbers or card security codes. Stripe shares with us only limited information such as the card brand, the last four digits, the expiry date and whether a payment succeeded.

3.3 Usage, device and log data. When you use the Service, our servers record technical information such as your IP address, browser and device type, operating system, date and time of requests, the pages and functions accessed, and error information. We also keep a security and activity record of actions such as sign in, sign out, password changes and changes made within a workspace, which records who acted and when but not the personal data values that were changed. To show our website and the Service in the language spoken in your country, we look up the country of your IP address in a copy of the DB-IP country database kept on our own servers. Only the country is used, for that request only, and your IP address is not stored or shared for this purpose.

3.4 Security data. Records of failed sign in attempts, account lockouts, multi factor authentication events and suspected abuse. Where bot protection is enabled, Cloudflare Turnstile evaluates technical signals from your browser on sign in, registration and password reset pages to tell people and automated programs apart.

3.5 Push notification data. If you allow notifications on your device, Google Firebase Cloud Messaging issues a device token that we store so we can send you notifications about your workspace, such as new tasks or bookings.

3.6 Communications and support data. The content of emails and messages you send us, support requests, feedback, and records of our replies.

3.7 Sales and enquiry data. If you request a demonstration, a trial or information, your name, business contact details, company, role, the size of your portfolio and the content of your enquiry. If you send the trial request form on our website after accepting cookies, we also receive the campaign source details described in Section 3.10.

3.8 Website analytics data. Only if you accept analytics cookies on our public website: information about your visit collected by Google Analytics, such as the pages you view, how you arrived at the website, the approximate region, the type of device and browser, and the actions you take, such as playing the demo video or sending the trial request form. See Section 4.5.

3.9 Website advertising data. Only if you accept marketing cookies on our public website: information about your visit and the actions you take there, such as viewing a page, sending the trial request form or completing a signup, together with the identifiers stored in advertising cookies. Google, LinkedIn and Meta use this information to measure the results of our advertising and to show our advertisements to people who visited our website. See Section 4.6.

3.10 Campaign source data. Only if you accept analytics or marketing cookies on our public website: the address of the first page you visited, the website you came from (its domain name only), the campaign parameters in the link you followed (utm_source, utm_medium, utm_campaign, utm_term and utm_content) and the click identifiers that advertising platforms add to their links (gclid, gbraid, wbraid, fbclid, li_fat_id and msclkid). We keep them with your trial request or with the workspace you create, so that we know which campaign brought you to us. See Section 4.7.

3.11 AI feature data. Only if your workspace uses contract import or the assistant: the contract files that are uploaded and the data read from them, which may include the names, contact details and identification numbers of renters, owners and other parties to the contract; and the questions asked to the assistant, its answers, and the records of the workspace it looked up to answer them. An admin can switch these features off for the whole workspace.

4. Cookies and similar technologies

4.1 Strictly necessary session cookie. In the signed in Service we use a single cookie: a strictly necessary session cookie that keeps you signed in securely. It is HttpOnly (it cannot be read by scripts in the page), Secure (sent only over encrypted connections) and SameSite Strict (not sent with requests from other websites), and it is sent only to the authentication endpoints of the Service. It lasts for up to 30 days and is removed when you sign out.

4.2 Local storage on your device. The Service stores a small amount of information in your browser's local storage: your language preference, your text size preference, and a technical identifier of the last user who signed in on that browser, which the Service uses to manage sessions safely when users change. This information stays on your device. If you choose a language in the language menu of our website or the Service, a first party cookie named estata_lang remembers that choice for one year, so that our pages open in the language you chose rather than the language of your country. It holds only the language code.

4.3 Offline storage. To let you keep working when your connection is unreliable, the Service may keep a temporary copy of some workspace information (such as properties, bookings and calendar data) and a queue of changes made while offline in your browser's storage. This data is deleted when you sign out.

4.4 Bot protection. Where enabled, Cloudflare Turnstile runs on sign in, registration and password reset pages to protect them from automated attacks.

4.5 Website analytics, only with your consent. On our public website (the pages of estata.app outside the signed in Service), we use Google Analytics 4 only if you accept analytics cookies in the cookie banner, by choosing "Accept all" or "Accept analytics", or by switching on the Analytics category. Until you do, no analytics cookie is set and your browser sends nothing to Google. If you accept, Google Analytics sets the first party cookies _ga and ga followed by an identifier, which last up to 2 years, to recognise repeat visits. We have switched off Google signals and the use of the data for advertising or ad personalisation, Google Analytics 4 does not log or store IP addresses, and we keep analytics data for 14 months. Your choice is stored in your browser's local storage, for 13 months if you accept at least one optional category and for 6 months if you reject all of them, and you can change it at any time with "Cookie settings" at the bottom of every page of the website. Withdrawing consent deletes the analytics cookies.

4.6 Advertising cookies, only with your consent. On our public website, and never in the signed in Service, we use the advertising technologies below only if you accept marketing cookies in the cookie banner, by choosing "Accept all" or by switching on the Marketing category. Until you do, none of them is loaded and your browser sends nothing to these companies.

Google Ads (Google LLC, and Google Ireland Limited for visitors in the European Economic Area and Switzerland): measures which of our advertisements on Google lead to visits, trial requests and signups, and lets us show our advertisements to people who visited our website. It sets cookies on our domain whose names start with _gcl, such as _gcl_au, which last up to 90 days.
LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company for visitors in the European Economic Area and Switzerland, and LinkedIn Corporation elsewhere): measures which of our advertisements on LinkedIn lead to visits, trial requests and signups, gives us aggregated reports about the professional characteristics of our visitors, such as industry and job function, and lets us show our advertisements on LinkedIn to people who visited our website. It sets cookies on our domain such as li_fat_id, which lasts up to 30 days.
Meta Pixel (Meta Platforms Ireland Limited for visitors in the European Economic Area and Switzerland, and Meta Platforms, Inc. elsewhere): measures which of our advertisements on Facebook and Instagram lead to visits, trial requests and signups, and lets us show our advertisements on Facebook and Instagram to people who visited our website. It sets the cookies _fbp and, after a click on one of our advertisements, _fbc on our domain, which last up to 90 days.

These companies also use cookies on their own domains under their own policies. For the collection of data through the LinkedIn Insight Tag and the Meta Pixel on our website and its transmission to LinkedIn and Meta, we act as joint controllers with LinkedIn Ireland Unlimited Company and with Meta Platforms Ireland Limited respectively, under Article 26 of the GDPR and on the terms of the joint controller addendum each of them offers to advertisers. Under those arrangements we are responsible for asking for your consent and for informing you, and LinkedIn and Meta are responsible for their own further processing, for which they are independent controllers; you can also exercise your rights directly with them. Google receives data through Google Ads as an independent controller under Google's controller terms for its advertising services.

You can withdraw your consent at any time with "Cookie settings" at the bottom of every page of the website. Withdrawing deletes the advertising cookies set on our domain and stops these technologies from loading. Cookies that these companies set on their own domains are controlled by them, by the settings of your browser and by the settings of your accounts with them. If your browser sends a Global Privacy Control signal, we treat it as a rejection of marketing cookies.

4.7 Campaign source. If you accept analytics or marketing cookies, our website keeps the campaign source details described in Section 3.10 in your browser's local storage for up to 90 days, and adds them to the trial request form and to the signup form of the Service when you send them. They are deleted from your browser when you reject both optional categories.

4.8 The signed in Service. The signed in Service does not use analytics or advertising cookies or similar technologies. Apart from website analytics, advertising cookies and the campaign source, which need your consent, the technologies described in this Section are strictly necessary to provide the Service you request, so we do not ask for your consent to them.

5. Why we use personal data and our legal bases

Where the EU or UK GDPR applies, we rely on the legal bases set out below. Under other laws, such as the UAE PDPL and the Israel Protection of Privacy Law, we process personal data on the bases those laws provide, which include performance of a contract, compliance with legal obligations, our legitimate interests where recognised, and consent where required.

To provide the Service, including creating accounts, authenticating Users, giving access according to roles, sending password reset, invitation and service emails, and sending push notifications you have allowed. Legal basis: performance of our contract with the customer and, for Users, our legitimate interest in providing the Service our customer has ordered for them (GDPR Article 6(1)(b) and (f)).
To manage subscriptions, billing and payments, including trials, renewals, invoices, taxes and collection. Legal basis: performance of a contract and compliance with legal obligations (Article 6(1)(b) and (c)).
To keep the Service secure, including preventing fraud, abuse and unauthorised access, detecting and investigating security incidents, enforcing rate limits and account lockouts, and keeping security and activity records. Legal basis: our legitimate interests in protecting the Service, our customers and their data, and compliance with legal obligations on security (Article 6(1)(f) and (c)).
To provide support and respond to enquiries. Legal basis: performance of a contract and our legitimate interests in responding to you (Article 6(1)(b) and (f)).
To measure and improve our public website with Google Analytics, if you accept analytics cookies. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time with "Cookie settings" on the website.
To measure and improve our advertising with Google Ads, the LinkedIn Insight Tag and the Meta Pixel, including showing our advertisements to people who visited our website, if you accept marketing cookies. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time with "Cookie settings" on the website.
To know which campaign brought a customer, by keeping the campaign source details with a trial request or a new workspace. Legal basis: your consent for storing and reading them on your device (Article 6(1)(a)), and our legitimate interests in measuring the effectiveness of our marketing for keeping them with your enquiry or workspace (Article 6(1)(f)).
To show our website and the Service in your language, by using the country of your IP address and your browser's language when you have not chosen one. Legal basis: our legitimate interests in presenting our website and the Service in a language you understand (Article 6(1)(f)).
To maintain and improve the Service, including monitoring performance and errors and understanding how features are used in aggregated form. Legal basis: our legitimate interests in operating and developing a reliable product (Article 6(1)(f)).
To send service announcements, such as changes to the Service, these policies or our Terms. Legal basis: performance of a contract and our legitimate interests (Article 6(1)(b) and (f)).
To send product news and offers to business contacts. Legal basis: our legitimate interests in promoting our Service to business customers, or your consent where the law requires it (Article 6(1)(f) or (a)). You can opt out at any time.
To comply with law and protect our rights, including tax and accounting record keeping, responding to lawful requests from authorities, and establishing, exercising or defending legal claims. Legal basis: compliance with legal obligations and our legitimate interests (Article 6(1)(c) and (f)).

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for more information about this balancing. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

6.1 Service providers. We share personal data with service providers that process it on our behalf and under our instructions, bound by contract to protect it:

Google Cloud (Google LLC and its affiliates): hosting, databases, file storage and backups, in the United States.
Google Workspace (Google LLC and its affiliates): sending transactional emails such as invitations, password resets and reminders, and operating our support mailbox, in the United States and other locations where Google operates.
Google Firebase Cloud Messaging (Google LLC): delivering push notifications to devices that have allowed them.
Google Analytics (Google LLC, and Google Ireland Limited for visitors in the European Economic Area and Switzerland): statistics about the use of our public website, only for visitors who accept analytics cookies.
Cloudflare Turnstile (Cloudflare, Inc.), where enabled: protecting sign in and registration pages against bots.
Sentry (Functional Software, Inc.), where enabled: error monitoring, configured to remove passwords, tokens, request bodies and similar sensitive values from error reports.
Anthropic (Anthropic, PBC), only for workspaces that use contract import or the assistant: reading uploaded contracts and answering questions asked to the assistant, in the United States. Anthropic processes this data under commercial terms that do not allow it to use the data to train its models, and keeps it only for a limited period for safety and abuse monitoring.

6.2 Stripe. Stripe processes payments for us. Stripe also acts as an independent controller of some payment data for its own purposes, such as fraud prevention and compliance with financial regulations, under its own privacy policy available on its website.

6.3 Your workspace. Information about your account, such as your name, role and the changes you make, is visible to other Users of the same workspace according to their roles, and to the customer that controls the workspace.

6.4 Affiliates. We may share personal data with companies in our corporate group where needed to operate, support or administer the Service, under appropriate safeguards.

6.5 Professional advisers and authorities. We may share personal data with our lawyers, accountants, auditors and insurers, and with courts, regulators, law enforcement or other public authorities where required by law, or where necessary to establish, exercise or defend legal claims, to protect the rights, property or safety of KMT, our customers or others, or to prevent fraud.

6.6 Business transfers. If we are involved in a merger, acquisition, financing or sale of all or part of our business, personal data may be transferred to the other party, subject to confidentiality obligations and this Policy.

6.7 No sale of personal data. We do not sell personal data for money. If you accept marketing cookies, information about your visit to our website is shared with Google, LinkedIn and Meta as described in Section 4.6, which some laws, such as the California Consumer Privacy Act, treat as sharing for cross context behavioural advertising or as targeted advertising. This happens only with your consent, and you can stop it at any time with "Cookie settings" on the website or by sending a Global Privacy Control signal. The signed in Service never shares personal data for advertising.

6.8 Advertising partners. With your consent to marketing cookies, Google, LinkedIn and Meta receive the data described in Section 3.9, as set out in Section 4.6, and use it under their own privacy policies, which are available on their websites.

7. International transfers

7.1 Where data is processed. KMT is established in the United Arab Emirates. The Service is hosted on Google Cloud in its Iowa region in the United States, and our service providers may process data in the United States and other countries where they or their subprocessors operate.

7.2 Safeguards. Where the law of your country restricts transfers of personal data abroad, we rely on appropriate safeguards, including:

for transfers from the European Economic Area, the European Commission's Standard Contractual Clauses, or the EU and US Data Privacy Framework where the recipient is certified under it;
for transfers from the United Kingdom, the UK International Data Transfer Addendum to those clauses, or the UK extension to the Data Privacy Framework;
for transfers from Switzerland, the Standard Contractual Clauses as adapted for Swiss law, or the Swiss and US Data Privacy Framework;
for transfers from Israel, the conditions of the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761 (2001), including written undertakings from recipients; and
for transfers from the United Arab Emirates, the grounds permitted by Articles 22 and 23 of Federal Decree Law No. 45 of 2021 on the Protection of Personal Data, including contractual safeguards.

You can request a copy of the relevant safeguards by contacting us.

8. How long we keep personal data

We keep personal data only for as long as needed for the purposes described in this Policy:

Account and profile data: for as long as the User account is active, and then deleted together with the workspace under the deletion timeline in our Terms (within 90 days after the subscription ends, with residual backup copies removed in the normal backup cycle).
Billing and transaction records: for as long as required by tax and accounting laws, generally up to 7 years after the end of the relevant financial year.
Security and activity records: for as long as the workspace exists and for up to 12 months after the related account is closed, unless needed longer to investigate an incident or defend a claim.
Error monitoring data: for up to 90 days.
Website analytics data: for 14 months in Google Analytics, and only for visitors who accepted analytics cookies.
Website advertising data: on our domain for the cookie lifetimes stated in Section 4.6, and within Google, LinkedIn and Meta for the periods set out in their own policies.
Campaign source data: in your browser for up to 90 days; with a trial request for as long as we keep the enquiry correspondence, and with a workspace for as long as the workspace exists.
AI feature data: uploaded contract files and the data read from them are kept with the records they were used for, for as long as those records and the workspace exist; a contract that was read but not used is deleted when it is discarded, and in any case 30 days after it was uploaded. Conversations with the assistant are deleted 30 days after they were last used.
Support and enquiry correspondence: for up to 3 years after our last interaction.
Marketing preferences: until you opt out, after which we keep a record of the opt out so we respect it.

9. How we protect personal data

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration and disclosure. These include encryption in transit using TLS 1.2 or higher with HSTS, encryption at rest provided by our hosting provider, strict separation of each customer's workspace data, role based access, password hashing with bcrypt, multi factor authentication for platform administrators, refresh token rotation with reuse detection, login lockout and rate limits, private storage of receipts accessible only through short lived signed links, daily backups, least privilege access for our systems, uptime monitoring, and security testing in our development process. No system is completely secure, but we work to protect your data and will notify you and the relevant authorities of a personal data breach where the law requires.

10. Your rights

10.1 General. Depending on where you live and the law that applies, you may have some or all of the rights below. To exercise them, contact us at support@estata.app. We may need to verify your identity before acting on your request. We will respond within the time the law requires, normally within one month or 30 days. We do not charge a fee unless a request is manifestly unfounded or excessive. If your request concerns data that one of our customers put into the Service, see Section 2.

10.2 European Economic Area, United Kingdom and Switzerland. Under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection, you have the right to: access your personal data; correct inaccurate data; erase your data; restrict processing; receive your data in a portable format; object to processing based on legitimate interests, and at any time to direct marketing; and withdraw consent where processing is based on consent. You also have the right to complain to the data protection authority in the country where you live or work or where an alleged infringement took place, or in the UK to the Information Commissioner's Office.

10.3 United Arab Emirates. Under Federal Decree Law No. 45 of 2021 on the Protection of Personal Data, you have the right to: obtain information about the processing of your data and access it; request transfer of your data; request correction or erasure of your data; request restriction of processing; object to processing, including for direct marketing; and object to decisions based solely on automated processing that have legal or similarly significant effects. You may also file a complaint with the UAE Data Office.

10.4 Israel. Under the Protection of Privacy Law, 5741 (1981), including Amendment 13 (2025), you have the right to review the information about you held in a database, to request correction or deletion of information that is incorrect, incomplete, unclear or out of date, and to ask to be removed from lists used for direct mailing. You may also complain to the Privacy Protection Authority.

10.5 United States. If you are a resident of a US state with a comprehensive privacy law, such as California, you may have the right to know what personal data we collect and how we use and disclose it, to access, correct and delete your personal data, and to opt out of the sale or sharing of personal data or its use for targeted advertising. We do not sell personal data. Information about visits to our website is shared for targeted advertising only if you accept marketing cookies, and you can opt out at any time with "Cookie settings" on the website or with a Global Privacy Control signal, which we honour. We will not discriminate against you for exercising your rights. You may use an authorised agent to make a request where the law allows, and we may ask the agent for proof of authority.

11. Marketing communications

We send product news and offers only to business contacts and only where the law allows. Every marketing email includes a link to unsubscribe, and you can also opt out by contacting us. Opting out does not stop service messages that we need to send to operate your account, such as password resets, billing notices and important changes to the Service.

12. Automated decisions

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Automated security controls, such as temporary sign in lockouts after repeated failed attempts, are used only to protect accounts and can be reviewed on request.

13. Children

The Service is intended for business use by adults. We do not knowingly collect personal data, as controller, from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it. Data about minors that a customer records in the Service, for example guests travelling with their families, is the responsibility of that customer as controller.

14. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new version number and date, and where changes are material we will notify Users and customers by email or within the Service before they take effect.

15. Contact

KMT TECHNOLOGIES FZCO, Unit 3298, DMCC Business Centre, Level 1, Jewellery & Gemplex 3, Dubai, United Arab Emirates.

Email: support@estata.app

Cookies auf dieser Website