Esta política de privacidad está disponible actualmente en inglés.
Privacy
Updated: 1 November 2026. Please use the contact email below for enquiries about your data.
Property photos
Photos uploaded from your device are stored in Supabase Storage. Anyone with a direct image URL can view them, including recipients of client selections. Do not upload documents or private photos. Images are resized before upload; original metadata, including GPS, is not copied. Uploaded photos are included in encrypted backup archives alongside the database. Images linked from external websites are not copied.
Service owner
Estario is an AMAR Studio product. Owner: AMAR SYSTEMS ARTSIOM MAROZAU, Poland, NIP 1182273536. Data enquiries: amar.studio.eu@gmail.com.
Data used
Sign-in uses your email and profile information supplied by your chosen authentication method. The workspace stores contacts, requests, properties, notes and actions entered by the agent. Technical requests may contain an IP address and browser information.
Purposes and grounds
Account data provides access to the service (GDPR Article 6(1)(b)). Technical requests and support enquiries are processed for security and operation, the owner’s legitimate interests (Article 6(1)(f)). An email is necessary for workspace access; the demo needs no registration.
Agents’ client records
The agent or their organisation determines the purposes and legal basis for client records. Estario provides the technical processing tool. Do not enter sensitive or unnecessary information. Property matching supports the agent and does not make legally significant decisions about clients.
Providers and external requests
Supabase supplies the database and authentication. Vercel hosts the current application. Netlify was used previously; older deployments may remain accessible. Google sign-in uses Google. Location searches send the entered place query, selected country and interface language to Geoapify/OpenStreetMap; listing imports contact the selected website. External images may load from listing websites, which receive browser technical data. If you send an invitation through email, WhatsApp or Telegram, that service receives the recipient and message with the link; you confirm sending. Do not enter clients’ personal information in geocoding queries. The primary Supabase database is in Ireland (eu-west-1). This does not mean all processing by other providers is confined to the EU; international processing is governed by the relevant providers’ terms. International transfer arrangements depend on the provider, agreement and plan. Vercel’s published DPA applies to Pro and Enterprise; the link below does not establish DPA coverage for the current Hobby plan. Links to those documents are provided below.
Teams and selection links
Workspace owners can invite colleagues and grant role-based access. The change log records the acting user. An agent-created selection allows anyone with its link to view selected properties until expiry or revocation. Descriptions and photos are also visible: check them for personal information before sharing. Recipient responses and comments are stored in the agent’s workspace. A link does not verify the client’s identity.
Cookies and preferences
Authentication and preference cookies, such as language, and local interface preferences support sign-in and remember user choices. Language, country, currency, time zone and display name are stored in the account profile; cookies and local preferences restore the browser interface. Unsaved note drafts may temporarily remain in browser session storage. Avoid using a shared browser profile for private workspace data.
Retention and deletion
Workspace data is stored to operate your database; archiving and moving to Trash are not permanent deletion. Trashed contacts can be restored; contact the support email to request permanent data deletion. Request account deletion or a copy of your data by email. Settings provides account records in JSON and contacts and properties in CSV. Keep downloaded exports private. Account data is retained while the account is used, until a deletion request is fulfilled; individual records may be needed longer to meet legal obligations or defend legal claims. Support correspondence is retained while needed to resolve an enquiry or related dispute. Technical log and backup availability depends on the provider’s plan; deletion may follow a separate lifecycle. The current free database plan does not include daily backups for user-initiated recovery.
Backups
Administrative database backups are scheduled every 6 hours using GitHub Actions. They are encrypted before upload to private Backblaze B2 storage in the EU; the recovery key is kept separately. GitHub Actions temporarily processes data before encryption; EU-only processing is not guaranteed. Automatic backup deletion is currently not configured: copies are retained pending a separate decision by the owner. Erasure requests may require separate consideration for backup copies. Recovery is performed by the administrator; Settings exports are not full database backups.
Your rights
Where applicable under the GDPR, request access, correction, erasure, restriction or portability, or object to processing, by emailing us. Requests about agent-entered data involve the relevant agent as controller. You may complain to Poland’s UODO or another competent EU data protection authority.
Supabase DPA · Vercel DPA · Netlify DPA · Backblaze · GitHub · Google · Geoapify · OpenStreetMap