Privacy Policy

EstatesAI Ltd ("EstatesAI", "we", "us") is the data controller for personal data collected through the EstatesAI platform and website (www.estatesai.uk).

We are registered with the Information Commissioner's Office (ICO) under the Data Protection Act 2018.

Contact: privacy@estatesai.uk

We collect only what is necessary to provide the service:

Account data: Your name, email address, and password (stored as a hashed value — we never store your actual password).

Usage data: Pages visited, features used, and timestamps — used to improve the platform and for security monitoring.

Asset register data: The spreadsheet content you upload. This typically contains building and equipment information. If your upload contains personal data (for example, an engineer's name associated with an asset), you are responsible for ensuring you have the appropriate basis to process it.

Communications: Any emails you send to support@estatesai.uk or other contact addresses.

We process your personal data under the following lawful bases (UK GDPR Article 6):

Contract performance: Processing your name and email to create and manage your account, and to deliver the service you have subscribed to.

Legitimate interests: Security monitoring, fraud prevention, platform improvement, and communicating about service changes — balanced against your rights and freedoms.

Legal obligation: Retaining certain records as required by UK tax and company law.

Consent: Where we send optional marketing emails, we rely on your explicit consent. You can withdraw consent at any time.

We use your personal data only for the following purposes:

— To create and manage your account and organisation workspace

— To provide the EstatesAI platform services

— To send transactional emails (account confirmation, notifications, password reset)

— To respond to support queries

— To maintain security and investigate abuse

— To comply with legal obligations

We share personal data only with the following sub-processors, under appropriate data processing agreements:

Microsoft Azure (UK): Cloud hosting and database storage — data remains in the United Kingdom.

Postmark: Transactional email delivery (name and email address only).

We do not sell, rent, or share your personal data with third parties for marketing purposes.

When we send data to our AI provider for asset enrichment, only non-personal asset data is transmitted (asset names, building types, technical parameters). Personal data is never sent to AI systems.

We retain your data for as long as your account is active and for a period afterwards as required by law or our legitimate interests:

— Account data: retained for the duration of your subscription plus 2 years

— Asset and compliance data: retained for the duration of your subscription; deleted or exported within 90 days of termination on request

— Security and audit logs: 12 months

— Server access logs: 90 days

You can request deletion of your account and data at any time by emailing privacy@estatesai.uk.

Under UK GDPR, you have the following rights:

Access: Request a copy of the personal data we hold about you.

Rectification: Ask us to correct inaccurate data.

Erasure: Ask us to delete your data ("right to be forgotten").

Restriction: Ask us to pause processing of your data in certain circumstances.

Portability: Receive your data in a portable format.

Object: Object to processing based on legitimate interests.

To exercise any of these rights, contact: privacy@estatesai.uk

We will respond within one calendar month. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office at ico.org.uk.

We use only a single strictly necessary session cookie (refresh_token) to keep you logged in. We do not use tracking, advertising, or analytics cookies.

For full details, see our Cookie Policy.

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, and full audit logging.

For details of our security measures, see our Security page.

We may update this Privacy Policy from time to time. We will notify you of material changes via the platform or by email. The current version is always available at www.estatesai.uk/privacy.

EstatesAI Ltd

Email: privacy@estatesai.uk

Website: www.estatesai.uk

Data Protection contact: dpo@estatesai.uk

ICO: If you have a concern you cannot resolve with us, contact the Information Commissioner's Office at ico.org.uk or 0303 123 1113.