Last updated: 6 October 2026
Scope and controller
This policy covers the public Estelamat website and the company account panel opened by the "Customer login" link. Estelamat is a product owned and provided by SellVexa LLC, the controller of personal data collected through the website and the panel.
Controller: SellVexa LLC (SellVexa), an Egyptian limited liability company, Luxor Governorate, Arab Republic of Egypt, Egyptian tax registration no. 780-522-443. Privacy requests go to contact@estelamat.com.
For project, unit and customer data inside each company's instance, the company is the controller and we process that data on its behalf; the "Company instances" section explains what reaches the central site.
Data we collect
Demo, trial and subscription request forms: your name, company name, mobile number, email, expected number of units per year and any details you write, the requested plan if chosen, and your consent to be contacted about the request.
Contact form: name, email or phone number, message text, and organisation name if given.
Company account panel: login email, display name and password (stored as a one-way hash), requests sent from the panel, and the company's subscription periods and payments. When an instance manager moves to the panel through the login link in the instance settings, the panel receives their name, instance user ID and instance address to record and verify the session.
Payment and billing: Paddle, as Merchant of Record for our orders, collects payment and billing data (such as name, email, country, payment method and tax ID if entered) directly on its checkout and processes it under Paddle's privacy policy (opens in a new tab). We receive what we need to manage the subscription: name, email, amount, date and transaction or invoice number. We never receive card details, and the Estelamat website does not collect card or bank account data.
Security data: with each form submission or login we record the IP address (when provided by the trusted proxy) and browser type, in the audit log, the session record and short-lived rate-limit counters.
The website does not ask for sensitive personal data.
Cookies and tracking
The public website pages use no analytics, advertising or tracking cookies.
One session cookie is used when you log in to the company account panel; it is necessary for login, cannot be read by page scripts, and expires on logout, after a period of inactivity, and in any case twelve hours after it starts.
Only the checkout page loads Paddle's payment tool, which may use cookies and similar technologies needed to complete payment and prevent fraud under Paddle's policy.
Purposes and legal basis
Form data is processed to answer and follow up your request, based on your explicit consent in the form. Panel and payment data are processed to provide, manage and charge for your company's subscription. Security data is processed to protect the website and panel from abuse and to evidence operations.
We do not sell your data, do not use it for marketing beyond the request you sent, and make no automated decisions that affect you.
Disclosure and hosting
The central site, the company instances and their databases are hosted with a cloud server provider (currently Contabo); files are stored in the Cloudflare R2 cloud storage service, and website traffic passes through the Cloudflare network. These servers may be located outside the Kingdom of Saudi Arabia.
SellVexa LLC is an Egyptian company whose team operates and supports the service. Any transfer of, or access to, personal data outside the Kingdom for hosting, operation, support or payment is limited to the minimum necessary and follows the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom.
We disclose your data only to those who run the technical infrastructure (hosting and storage) as needed to operate it, to Paddle for payment, billing and refunds, or where the law requires it or a competent authority lawfully requests it.
If you contact us on WhatsApp, or your company's team joins its dedicated support group, messages pass through WhatsApp, a Meta service subject to its own terms and privacy policy, which we do not control.
Company instances
Each subscribing company has a separate instance with its own database, files and keys. Project, unit, record, snag, customer and tenant data stays inside the instance.
The central site receives from the instance only the usage counts needed to apply the plan limits (active units, rental units, internal users, monthly maintenance requests, projects, file storage and software version), and sends it a signed entitlement document with the plan, limits, dates, status and services. No detailed operational data or personal data of the instance's users or customers is sent to the central site.
Company data is never deleted automatically; deletion only happens under the "Data retention and deletion" clause of the Terms & Conditions: at least one month after the subscription ends and after three written notices to the company.
Retention
Website requests and contact messages are kept while needed to answer or follow up the request, and are destroyed or anonymised when no longer needed or at your request, unless the law requires keeping them.
Company account data and its periods and payments are kept for the duration of the subscription and afterwards for the period required by financial and tax rules; Paddle keeps payment records under its own obligations.
The audit log is append-only and is kept for security and evidence. Ended sessions are revoked, used login tokens are deleted after they expire, and rate-limit counters are not used after their window.
Security
Our administrator panel requires a password and a mandatory two-step verification code, repeated failed logins are limited on both panels, and all administrator actions are audited. Company instances offer optional two-step verification to their users.
If a breach or unlawful access affects your personal data, we notify the competent authority and you as required by the Personal Data Protection Law and its regulations.
Your rights
Under the Personal Data Protection Law you have the right to be informed of the legal basis and purpose of processing, to access your data and obtain a copy in a clear format, to request its correction, completion or update, to request its destruction when no longer needed and nothing requires keeping it, and to withdraw your consent to be contacted at any time without affecting earlier processing.
Send requests to contact@estelamat.com. We answer within the statutory period, and you may complain to the competent data protection authority if your rights are not met.
Changes to this policy
We may update this policy; the date of the last update is shown at the top, and subscribing companies are informed of material changes by their registered email.