Privacy policy

Who processes your data

The data controller is esti.ma, an independent project published from Morocco. For any question about your data, write to support@esti.ma: it is the only address, and a person reads it.

What we store

Here is everything the database holds about you. Nothing else.

Your account. Username, email address, password, creation date and last login date. The password is never stored as such — only an irreversible cryptographic hash. We cannot read it back, only reset it.

Your profile, if you fill it in. Full name, phone number, default city, language and theme. These five fields are optional: they pre-fill your forms and nothing else. You can clear them at any time from your profile.

What you set aside. Your favourites — the listings you mark — and your alerts, that is, the search criteria you choose to keep. They belong to your account, are visible to you alone, and can be deleted one by one.

The date of your valuations. The criteria you submit to the valuation form are not kept: they produce your result, then are discarded. We record only the date of each valuation, to enforce the daily quota — not what it was about.

Your messages. If you write through the contact form, your name, email address, subject and message are stored, then read in the administration area. Without that, a message would be a message nobody can answer.

Technical logs. IP address, timestamp and requested page, kept to detect abuse and failures.

What we do not collect

No advertising trackers. No social media buttons. No third-party analytics. We do not sell, rent or trade any data.

The site shows its own in-house ad slots, served from our servers and never by an outside ad network. Their impressions and clicks are counted per slot, in aggregate: those counters belong to no account and identify nobody.

The property listings you browse come from public sources and do not concern you personally.

Why, and on what basis

Processing	Purpose	Legal basis
Account and profile	Give you access to the service	Contract performance
Favourites and alerts	Find again what you set aside	Contract performance
Valuation dates	Enforce the daily quota	Legitimate interest
Contact messages	Answer you	Your own request
Technical logs	Security, abuse detection	Legitimate interest

How long

Account, profile, favourites, alerts and the valuation counter are kept while the account exists. Deleting it erases them, and everything attached to them, at once.

Contact messages are kept while they are being handled, and no longer than twelve months. Technical logs, twelve months. Reset and verification links exist in the database only as hashes, and expire by themselves.

Who has access

The people who operate the service, and the technical provider hosting the infrastructure. No other third party. Administrative actions on an account are logged.

Your rights

You have the right to access, correct, object to and delete your data. Most of it needs no one but you: the profile is edited and the account deleted from the “Profile” area, immediately and with no justification to give. For anything else, write to support@esti.ma — we answer within thirty days.

You may also lodge a complaint with the Moroccan data protection authority (CNDP).

Security

Traffic is encrypted in transit. Passwords are hashed. Session tokens expire, and changing your password immediately invalidates every token issued before it. Database access is restricted. No system is impregnable: should a breach affect your data, you will be informed.

Changes

Any substantial change to this policy will be announced on the site before it takes effect. The date at the foot of the page says when this text last changed.