Privacy Policy

1. Introduction and scope

Estate Atlas ("Estate Atlas", "we", "us", "our") provides a global real estate intelligence platform. We are committed to protecting the personal information of the investors, analysts, institutions, and other users who use our platform.

This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, how we protect it, and the rights and choices available to you. It applies to our website, dashboard, applications, and related services (together, the "Platform").

We operate globally and aim to meet the standards of the major privacy frameworks that apply to our users, including the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA) and other US state privacy laws, the Australian Privacy Act 1988 and Australian Privacy Principles (APPs), and comparable laws in the other regions where we operate. Where a specific law gives you stronger rights than those described here, those rights apply.

2. Who we are and how to contact us

For the purposes of applicable data protection law, the controller of your personal information is Estate Atlas.

Privacy and data protection inquiries: [email protected]

3. Information we collect

We practice data minimization: we collect only the information we need to operate the Platform and serve you.

Information you provide to us

• Account information: your name, email address, password (stored only as a secure hash, never in plain text), and, for business or enterprise accounts, your company name and role.
• Billing information: your subscription plan and billing records. We do not store full card numbers, CVV codes, or full expiry dates. Payments are handled by our PCI-compliant payment processor (Stripe). We retain only non-sensitive details such as the card brand, the last four digits, the expiry month and year, and the processor's customer and subscription identifiers, so we can display and manage your subscription.
• Communications: information you provide when you contact support or respond to our messages.

Information we collect automatically

• Usage and behavioral data: how you interact with the Platform, including which countries, cities, asset classes, datasets, charts, and reports you view, and your in-product preferences.
• Technical data: IP address, browser type, device information, operating system, and login timestamps, used for security, fraud prevention, and Platform stability.
• Cookies and similar technologies: see our Cookies Policy for detail.

We do not intentionally collect special category or sensitive personal information, and we ask that you do not provide it.

4. How we use your information and our lawful bases

Where the GDPR or similar laws apply, we rely on the following lawful bases:

You can opt out of marketing communications at any time using the unsubscribe link in any marketing message or by contacting us. Opting out of marketing will not affect essential service communications.

5. Automated processing, profiling, and artificial intelligence

Transparency about our use of AI is a priority, and we expect to meet emerging requirements under the Australian Privacy Act reforms and the EU AI Act.

We use automated algorithms and AI to analyze how you use the Platform in order to:

• recommend markets, asset classes, and emerging trends that may match your interests;
• personalize your dashboard and the insights you see; and
• improve the accuracy of our market and sentiment analysis using aggregated and de-identified data.

The categories of personal information used for this automated processing are your usage and behavioral data (such as the markets and datasets you view) and your stated in-product preferences.

This processing is used to personalize your experience and our marketing. It is not used to make decisions that produce legal effects concerning you or similarly significantly affect you, and we do not use it to make automated lending, eligibility, or pricing decisions about you. You can object to, or opt out of, profiling for marketing purposes at any time by contacting [email protected]. Where required by law, we will provide further information about the logic involved and the significance of any such processing on request.

6. Cookies and similar technologies

We use cookies, pixels, beacons, and local storage to operate, secure, analyze, and personalize the Platform, and for limited marketing. You can control non-essential cookies through our cookie banner and your browser settings. Full detail is in our Cookies Policy.

7. How we share your information

We do not sell your personal information for money.

We share personal information only with the categories of recipients below, under contracts that require them to protect it:

• Payment processing: Stripe, to manage billing and subscriptions.
• Cloud infrastructure and hosting: our database and application hosting providers, located in the United States.
• Email and communications: our email delivery provider, to send transactional and subscribed messages.
• Analytics and product measurement: PostHog and Google Analytics 4, only after you accept Analytics cookies, to understand how the Platform is used. If you reject them, or you have not chosen yet, they do not load. Session recording is not used.
• Advertising platforms: LinkedIn and Google, where you have consented to marketing/retargeting cookies (see the note below on US "sharing").

PostHog runs on PostHog's US cloud (us.i.posthog.com). Google Analytics 4 is loaded through Google Tag Manager (container GTM-5C7ZZ676). When you have accepted Analytics cookies, these tools record page views and these product events: pricing viewed, plan selected, signup started or blocked, email confirmed, checkout started or completed, a country or lens opened, support chat opened, a support ticket created, and analytics consent status. A lens is a price, mortgage, rent, or house-price view. We do not send email addresses, names, form text, message bodies, or payment or customer identifiers. Cookie names are in our Cookies Policy.

We may also disclose personal information where required to comply with the law, enforce our agreements, protect our rights or safety or those of others, or in connection with a corporate transaction such as a merger or acquisition (with appropriate safeguards). A current list of our sub-processors is available on request at [email protected].

A note for US residents on "selling" and "sharing": Under California's CPRA and some other US state laws, using advertising cookies to show you targeted ads can be treated as "sharing" personal information for cross-context behavioral advertising, even though no money changes hands. You can opt out of this "sharing" through our cookie banner, by enabling a Global Privacy Control (GPC) signal in your browser, or by contacting us. See Section 11.

8. International data transfers

Estate Atlas operates globally. Your personal information is stored and processed in the United States, and may be processed in other countries where our service providers operate.

When we transfer personal information out of the EEA, the UK, or Switzerland, we use an approved transfer mechanism such as the European Commission's Standard Contractual Clauses (and the UK Addendum / International Data Transfer Agreement), together with supplementary safeguards where appropriate. When we disclose personal information overseas from Australia, we take reasonable steps consistent with Australian Privacy Principle 8 to ensure it is handled in line with the APPs. You can request more information about these safeguards at [email protected].

9. Data retention

We keep personal information only for as long as we need it for the purposes set out in this policy, after which we securely delete or de-identify it.

• Account and profile data: for the life of your account, then deleted or de-identified within 90 days of account closure, unless we must keep it longer.
• Billing and transaction records: retained for 7 years to meet tax and accounting obligations.
• Usage and analytics data: retained in identifiable form for up to 24 months, then aggregated or de-identified.
• Support communications: retained for 24 months after resolution.

10. How we protect your information

We use a layered security program, including:

• encryption in transit (TLS/SSL) and at rest;
• passwords stored only as salted, one-way hashes (never in plain text);
• support for two-factor authentication (2FA) and enforced 2FA for internal admin access;
• role-based access control and the principle of least privilege;
• rate limiting, security headers, and monitoring/logging that excludes sensitive data;
• encrypted, separately stored backups; and
• regular dependency scanning and periodic third-party security testing.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information using commercially reasonable measures.

Data breaches: If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the relevant authorities as required by law, including under Australia's Notifiable Data Breaches scheme and the GDPR's 72-hour notification rule where applicable.

11. Your privacy rights

Subject to your location and applicable law, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct inaccurate or incomplete information;
• delete your personal information ("right to be forgotten"), subject to records we must keep by law;
• restrict or object to certain processing, including profiling for marketing;
• data portability, to receive your data in a portable format;
• withdraw consent at any time, without affecting prior lawful processing; and
• lodge a complaint with a regulator (see Section 13).

For residents of the EU, UK, and Switzerland (GDPR): all of the rights above apply. We will respond within one month, extendable where permitted.

For California and other US state residents: you may request access, deletion, and correction; you may opt out of the "sale" or "sharing" of personal information and of targeted advertising; and you have the right not to be discriminated against for exercising these rights. We honor browser-based Global Privacy Control (GPC) signals as an opt-out of "sharing" where required. We do not knowingly sell or share the personal information of anyone under 16.

For Australian residents: you have rights of access and correction under the Australian Privacy Principles. If you are not satisfied with how we handle a privacy issue, you can complain to the Office of the Australian Information Commissioner (OAIC).

For residents of other regions (including New Zealand, Singapore, Japan, South Korea, Hong Kong, India, China, and the wider EU and EEA): you may have additional or differing rights under your local law, such as those under the New Zealand Privacy Act 2020, Singapore's PDPA, Japan's APPI, South Korea's PIPA, India's DPDP Act, or China's PIPL. Some of these laws impose specific requirements (for example, local consent, registration, or data-localization rules) that may affect how we handle your information. We will honor the rights available to you under your applicable local law.

To exercise any right, email [email protected]. We will verify your identity before acting and will not charge a fee except where the law allows.

12. Children

The Platform is intended for professional and institutional users and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Complaints and supervisory authorities

If you have a concern, contact us first at [email protected] and we will try to resolve it. You also have the right to complain to a regulator:

• Australia: Office of the Australian Information Commissioner (OAIC), oaic.gov.au
• EU/EEA: your local Data Protection Authority
• UK: Information Commissioner's Office (ICO), ico.org.uk
• California: California Privacy Protection Agency / Attorney General
• Other regions: your local data protection authority

14. Changes to this policy

We may update this Privacy Policy to reflect changes to our Platform, technology, or legal obligations. We will post the updated policy here and update the "Last updated" date, and for material changes we will provide more prominent notice (such as an in-product notice or email).

15. Contact us

Questions about this policy or your personal information: [email protected]