Privacy policy
This page describes what the software does with personal data. Where something is not built yet, it says so rather than describing it.
Two different relationships
An estate agency using EstateSchedule decides which of its clients it records, why, and for how long. Those records are the agency's. We supply and run the software that holds them, and we act on the agency's instructions.
Your own account is a separate matter. Your name, your email address, the agencies you belong to and your sign-in history exist because the service cannot be run without them, so those are ours to answer for.
If you are a client of an estate agency and want to know what is held about you, that agency is the place to start. Write to us as well if you would rather, and we will help them answer you.
What an agency records about its clients
An agency types in what it needs in order to run a viewing, and nothing about the software asks for more than that.
Access details for a property — keys, entry codes, the caretaker's number — are held against the property rather than against the person, and are not sent to a client. What reaches the client says where and when to meet.
What is held about a client is, in practice:
- A name, and a company name where the client is a business.
- An email address and a telephone number, where the agency has them.
- The language the client prefers and the channel they prefer to be reached on.
- Notes and tags written by the agency's own staff.
- Appointments: which property, when, which agent, and whether the client confirmed, declined or asked for another time.
- Consent records, one per channel, each with a date and the member of staff who recorded it.
What is held about someone with an account
An account exists so that a person can sign in to an agency and be told apart from their colleagues. It holds:
- Your name and your email address.
- Your password, kept only as a hash. The original is not stored and cannot be read back out.
- The agencies you belong to and your role in each.
- The language you have chosen for the interface.
- Sign-in events and administrative actions in the audit log, with the address the request came from and the browser string it carried.
Where the records sit, and who can reach them
Every record carries the agency it belongs to, and queries are filtered on that at the database layer rather than screen by screen. One agency's client book is not reachable from another agency's session, and an identifier belonging to a different agency answers as not found rather than as refused — which is also why probing tells an outsider nothing.
Inside an agency, five roles decide who sees what. An agent sees their own appointments and the agency diary; an owner and an administrator see everything the agency holds.
Records are addressed in the URL by a public identifier rather than by a database key, so an address cannot be counted upwards to find the next client.
Reminders, and the address one is sent to
When a reminder is scheduled, the whole message is decided at that moment: the wording, the language, the hour it will go out and the address it will go to. Editing a workflow afterwards does not rewrite a message that is already waiting.
That address is encrypted on the record. A one-way hash of the same address is stored beside it, and the hash is what the suppression check reads — so putting a reminder out does not require decrypting a table of addresses.
Email is the channel that sends today. SMS, WhatsApp and Viber are built into the software and have no live provider behind them, so nothing leaves on those.
Consent, and stopping messages
Consent is recorded per channel, with a status, where it came from, the wording that was shown at the time and the date. Silence is treated as an absence of consent rather than as agreement.
An email about an appointment the client themselves arranged rests on that arrangement rather than on consent. SMS and WhatsApp require a recorded opt-in before anything may be sent on them — and neither sends at all today.
Each agency has a suppression list, one entry per channel and destination. An address on it is not messaged again on that channel. It is checked before consent, and it overrides consent.
Consent and suppression are read at the moment a message goes out, not at the moment it was scheduled. A withdrawal at eight in the evening therefore stops the reminder that was queued that morning to leave at nine.
What a client cannot yet do for themselves
There is no page a client can open to unsubscribe on their own. That is a gap, and it is stated here rather than glossed over.
Today a client tells the agency, or writes to us, and the withdrawal is recorded against them — which stops the messages that were waiting to go out on that channel.
Erasing a client
An agency can erase a client from inside the product. The name, company name, email address, telephone number, tags and internal notes are destroyed, the record is left as an unidentifiable stub, and every consent on it is withdrawn in the same step.
The appointments survive without the person on them. The agency keeps its record that a viewing happened, who conducted it and what came of it. The step cannot be undone, because an undo would mean a copy had been kept.
How long records are kept
What an agency puts in stays until the agency erases it or asks us to close the account. No scheduled deletion runs today, and we would rather write that down than describe one that does not exist.
The audit log is append-only. Entries are not edited or removed, and values that look like a password, a token or a key are replaced before an entry is written.
What the application writes down about actions
Administrative actions are recorded: what was done, by whom, to which record, and the values before and after. The entry also carries the address the request came from and the browser string it sent.
Ordinary application logs pass through a filter that strips telephone numbers, email addresses, confirmation links and anything shaped like a token, so a log file does not quietly become a second copy of the data.
Asking for a copy, a correction or an erasure
Where an estate agency holds the record, that agency answers. It can correct the record on screen and erase it on screen.
Where we hold the record — your account with us — write to the address on this page and say what you are asking for.
There is no self-service export. Report figures download as a CSV file from inside the product; a copy of an agency's own records is something we produce by hand when it is asked for.
Who else is involved
Running the service takes somewhere to host the application and its database, and a route out for email. Which suppliers those are is set out in the written agreement we send an agency, and we will tell you on request.
The public pages you are reading request nothing from another company: no analytics, no advertising, no web font, no embedded player. Nothing on them reports your visit to anybody else.
Changes to this page
This describes software that is still being built, so it changes as the software does.
The page is the current statement. Where a change matters to an agency's own arrangements, we tell the agency rather than leave it to be noticed.