Privacy Policy

ReEst("we", "us", "our") is a property management platform that helps landlords automate rent collection, manage leases, and track their property portfolios. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our website and services.

For questions about this policy, contact us at privacy@reest.app.

We use your information to:

• Create and manage your account and provide the ReEst services
• Process rent payments and disbursements through Stripe Connect
• Send transactional emails — invoices, payment confirmations, lease reminders, and maintenance updates
• Provide customer support and respond to your enquiries
• Improve platform performance, diagnose bugs, and develop new features
• Comply with legal obligations, including fraud prevention and financial regulations
• Send product updates and service announcements (you can opt out at any time)

We do not sell your personal data to third parties. We do not use your data for advertising targeting.

We share your information only in the following circumstances:

• With your tenants and property managers: contact details and payment status are shared as necessary to operate the landlord-tenant relationship you set up through the platform.
• With service providers: we use Stripe (payments), AWS S3 (document storage), Redis (session management), and error monitoring services. These providers process data on our behalf under strict data processing agreements.
• With Google: if you use Google Sign-In, Google shares your name and email address with us under their OAuth terms.
• Legal requirements: we may disclose information if required by law, court order, or to protect the rights, property, or safety of ReEst, our users, or the public.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before this occurs.

We retain your personal data for as long as your account is active or as needed to provide the services. If you close your account:

• Account data is deleted within 30 days of your request
• Financial records (invoices, payment histories) are retained for 7 years to comply with accounting and tax regulations
• Backups may retain data for up to 90 days after deletion

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Correction: update or correct inaccurate data via your account settings
• Deletion: request deletion of your account and associated data
• Portability: receive your data in a machine-readable format
• Objection: object to processing based on legitimate interests
• Withdraw consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, email privacy@reest.app. We will respond within 30 days.

We protect your data using industry-standard security measures:

• All data transmitted between your browser and our servers is encrypted via TLS (HTTPS)
• Passwords are hashed using bcrypt with a minimum cost factor of 12
• Authentication tokens are short-lived (15 minutes) and stored in memory only — not in localStorage
• Refresh tokens are stored in HttpOnly cookies, inaccessible to JavaScript
• Access to production databases is restricted to authorised personnel only
• We use rate limiting and suspicious pattern detection to prevent brute-force attacks

No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact us immediately at privacy@reest.app.

We use the following types of cookies:

• Essential cookies: required for authentication and platform functionality. Cannot be disabled.
• Preference cookies: remember your language and UI settings.
• Analytics cookies: help us understand how the platform is used (e.g. Sentry error tracking).

You can disable non-essential cookies in your browser settings. This may affect some platform features.

ReEst operates globally. Your data may be processed in countries outside your own, including countries that may not have the same data protection laws. Where we transfer data internationally, we use appropriate safeguards such as standard contractual clauses.

ReEst is not directed at children under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a prominent notice in the platform at least 14 days before the changes take effect. Continued use of ReEst after the effective date constitutes acceptance of the updated policy.

For privacy-related questions, requests, or complaints:

ReEst
Email: privacy@reest.app