Privacy policy

Last updated 18 October 2026 · Draft for review before the first public release

Who we are

Estate Hub is a residential portal for estates and blocks of flats, made in London. In this policy “we” means the provider of Estate Hub, contactable at support@getestatehub.co.uk.

Your estate's management company or managing agent (the organisation that subscribes to Estate Hub for your estate) decides what Estate Hub is used for on your estate and who is invited. Under UK GDPR it is the controller of the resident data on your estate; we are its processor, acting on its instructions under a written data-processing agreement. For the things we decide ourselves, such as how the service is secured and operated, we are the controller.

What we collect, and why

What	Why	Lawful basis
Your email address, or your Apple or Google sign-in identifier	To sign you in and to send you the emails you ask for (sign-in links, password resets)	Contract: providing the service to you
Your display name and, if you add one, a profile photo	So neighbours and management know who posted or wrote	Contract
Your flat, block, estate and role (leaseholder, tenant, landlord, household member, staff…)	To show you the right content and nothing else; to route your requests to the right people	Legitimate interest of the estate in running itself; contract
Your phone number, only if you enter one	So management can call you about an issue in your flat; it is never shown to other residents unless you choose	Consent, withdrawable in Profile
Issues, inquiries and their photos and updates	So problems can be fixed and the estate keeps a maintenance record	Legitimate interest of the estate; contract
Posts, comments, reactions, listings, parking listings, poll votes and messages	That is the service: the content you choose to share	Contract
Reports you make and moderation actions on your content	To keep the community safe and to show what was done and why	Legitimate interest of the estate and of other residents
Notification settings and, if you allow push, a device token	To send the notifications you turned on, and only those	Consent (push); contract (the inbox)
Technical logs: when you signed in, errors the app reports	To keep the service running and secure	Legitimate interest

We do not use analytics or advertising trackers, we do not profile you, we never sell or share data with advertisers, and we do not read your messages. Crash reports contain the error and the app version, not who you are.

Who can see what

Access rules are enforced in the database itself, by the row, not only in the app:

• Everything on an estate is visible only to members of that estate. Other estates on Estate Hub cannot see it, and nor can the public.
• Block-only posts, notices and listings are visible only to members of that block.
• A private issue in your flat is visible to you and to the estate's management and the staff or contractor assigned to it. Shared issues in common areas are visible to residents in scope.
• Inquiries are private between you and the management company or agent you sent them to.
• Messages are visible to the two people in the chat and nobody else. Moderators see a message only if one of you reports it.
• Your flat number is shown as you choose: to everyone on the estate, to your block only, or to nobody. Management and admins can always see it.
• Leaseholder-only documents and polls are not visible to tenants, and vice versa, unless the leaseholder grants access.
• Admins and management see what their role needs: an estate admin sees the whole estate; a block rep sees their block; a contractor sees only the issues assigned to them, for as long as their access lasts; an observer is read-only.

Who we share it with

Only the companies we need to run the service, each under a contract that limits them to processing on our instructions:

Provider	What for	Where
Supabase	The database, file storage, sign-in and realtime updates	London, United Kingdom
Cloudflare	Serving the web app and this website	Global edge; EU and UK data centres
Google Firebase Cloud Messaging and Apple Push Notification service	Delivering push notifications to your phone, if you turn them on	EU and United States, under the UK–US data bridge and standard contractual clauses
Resend	Sending sign-in and notification emails	EU and United States, standard contractual clauses
Sentry	Crash reports from the apps, with no personal data attached	European Union
Apple and Google	If you sign in with Apple or Google, they confirm who you are; see their own policies	Per their policies

Your estate's management company and managing agent see the data of their own estate through the admin console. They are controllers for that data, under their own obligations to you.

We will disclose data when the law requires it, and we will tell the estate when we are allowed to.

How long we keep it

• Your account and content: for as long as you are a member of an estate, and until you delete your account.
• Photos of expired, withdrawn or removed listings and posts: deleted 90 days after.
• Uploads that never got attached to anything: deleted after 7 days.
• Evidence attached to a report: 1 year after the report is closed.
• Photos on issues: 2 years after the issue is closed.
• Notifications: 1 year.
• Document versions and the estate's audit log: kept, because the estate needs its history.
• Sign-in and technical logs: 30 days.

Your rights

You can see and change your profile and privacy settings in the app at any time. You can also:

• Export your data (More → Settings → Account → Export my data). You receive a file with everything your account holds.
• Delete your account (More → Settings → Account → Delete my account, or by email). This removes your profile, your sign-in, your memberships, your messages, your saved posts and your votes, and takes your name off everything you wrote. Issues and inquiries you raised, notices you acknowledged, and posts and listings you made stay in the estate's records with no name attached, because the estate is entitled to keep its maintenance and community history. If you would rather those were removed as well, ask your estate's management company.
• Ask us or your estate to correct something, to restrict or object to processing, or to complain. You can complain to the Information Commissioner's Office at ico.org.uk, though we would prefer the chance to put it right first.

Write to support@getestatehub.co.uk. We answer within a month, usually much sooner.

Children

Estate Hub is for people aged 16 and over. Household-member accounts for younger people are not offered.

Cookies and storage

This website sets no cookies and loads nothing from third parties. The web app stores your sign-in session and your settings in your browser so that you stay signed in; it uses no cookies for tracking and no analytics.

Security

Data is encrypted in transit and at rest. Access is restricted by row-level rules in the database, so the app cannot show you data your role is not allowed to see even if it is asked to. Backups are encrypted. If we ever have a breach that affects you, we will tell your estate and you without undue delay, as the law requires.

Changes

If this policy changes in a way that matters, the app will show you the new version and ask you to read it. The date at the top is always the date of the current version.