Privacy policy - Estimake

This policy explains what personal data Estimake collects, why, who we share it with, how long we keep it, and what you can do about it. It covers our website at https://estimake.it and the Estimake application.

1. Who we are

Estimake is operated by Cytec BG Ltd., a company registered in Bulgaria under UIC (ЕИК) 202835086, VAT BG202835086, with its registered address at zh.k. Trakia, block 327, entrance V, floor 7, apartment 20, Plovdiv, Bulgaria.

Cytec BG Ltd. is the data controller for the personal data we collect about users of Estimake and visitors to our website. That means we decide what is collected and why, and we are responsible to you for it.

There is one important exception. The content you put into Estimake — your estimates, customers, projects and the people you name in them — is yours. Where that content contains personal data about other people, you are the controller and we act as your processor, handling it only on your instructions in order to run the Service for you. Business customers can request a Data Processing Agreement covering this.

Privacy questions, requests and complaints: support@estimake.it, or write to us at the address above.

2. What we collect, why, and on what legal basis

Data	Why we process it	Legal basis
Account data — your name, email address, password (stored hashed, never in plain text), profile picture, language and timezone	To create and secure your account, sign you in, and identify you to colleagues in a shared workspace	Performance of a contract
Workspace content — estimates, customers, projects, rates, comments, uploaded files and logos	To provide the Service: store, display, collaborate on, export and share your estimates	Performance of a contract (and, for personal data about third parties inside your content, on your instructions as processor)
Subscription data — which plan a workspace is on, its status, renewal date, billing interval, and identifiers linking it to your Paddle billing account	To run your subscription and give the workspace the features it has paid for	Performance of a contract
Usage and technical data — IP address, browser type and version, pages visited, timestamps, referrer, and application error logs	To keep the Service secure, detect and investigate abuse and fraud, diagnose faults, and understand which features are used so we can improve them	Legitimate interests — running a secure, reliable service and improving it
Share-link activity — when a shared estimate is opened, and from what approximate location	To notify the estimate's owner that their client has viewed it — a feature of the product	Legitimate interests of the workspace owner
Support messages — what you write to us and your contact details	To answer you and keep a record of the issue	Legitimate interests — supporting our customers
Marketing preferences and any newsletter subscription	To send product updates you have asked for	Consent, which you can withdraw at any time
Records of transactions and correspondence required by law	Accounting, tax and compliance obligations	Legal obligation

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you can object — see section 7.

You do not have to give us personal data, but some of it is necessary to have an account at all. We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

3. Payment information

We never see or store your card details. Payments for Estimake subscriptions are processed by Paddle.com Market Ltd , which acts as the merchant of record for every purchase. Paddle collects your payment details, billing address, country and (where applicable) VAT identification number directly, uses them to take payment, calculate tax and issue your invoice, and is an independent controller of that data — see Paddle's privacy policy . We receive from Paddle only what we need to run your subscription: which plan you bought, its status and renewal date, and an identifier for your billing account. How billing, refunds and cancellation work is set out in our refund and payment policy.

4. Who we share your data with

We do not sell your personal data, and we do not share it for advertising. We share it only with the following categories of recipient:

Paddle — as merchant of record, for the sale itself, subscription management, payments, refunds, tax compliance and invoicing.
Amazon Web Services — hosting, file storage, content delivery and outbound email delivery for our transactional messages.
Google — only if you choose to sign in with Google. Google confirms your identity and gives us your name and email address; we do not receive your Google password. If you sign in with an email and password instead, no data goes to Google.
Our own analytics — a self-hosted Umami instance we run at analytics.cytec.bg. It is not a third-party advertising product; the data stays with us. See our cookie policy.
People in your workspace — the members of a workspace can see each other's names, email addresses and contributions to shared estimates. Anyone holding a share link can see the estimate it points to unless you password-protect it.
Professional advisers — our accountants, auditors and lawyers, where they need it and under a duty of confidence.
Authorities and courts — where we are required to by law, or where it is necessary to establish, exercise or defend legal claims, or to protect the rights and safety of our users.
A buyer of the business — if we are acquired or merge, your data may transfer as part of that. We will tell you, and the acquirer stays bound by this policy or one no less protective.

Our service providers act on our instructions under written contracts that require them to keep your data secure and to use it only for the services they provide to us. We review a provider's privacy practices before we engage it.

5. International transfers

We host Estimake in the European Union, and we choose EU regions for storage and email delivery. Some processing still takes place outside the EEA:

our content delivery network serves static files from edge locations worldwide, so a page may be delivered from a server near you;
Paddle operates from the United Kingdom and the United States for payments and tax compliance;
Google processes sign-in requests outside the EEA if you use Google sign-in.

Where personal data leaves the EEA, we rely on an adequacy decision of the European Commission where one covers the country concerned (as it does for the United Kingdom), and otherwise on the European Commission's Standard Contractual Clauses together with additional safeguards where needed. You can ask us for details of the safeguards that apply to a specific transfer.

6. How long we keep it

Account and workspace data — for as long as your account is open. If you close your account, we delete or anonymise it within 90 days, except where we must keep something longer for the reasons below.
Inactive accounts — we may delete the data of accounts inactive for more than 24 months, after emailing you first and giving you a reasonable opportunity to export your estimates.
Server and security logs — up to 12 months, then deleted.
Analytics data — aggregated usage statistics, retained for up to 24 months.
Support correspondence — up to 24 months after the issue is closed.
Invoices and accounting records — for as long as Bulgarian tax and accounting law requires, currently up to 10 years. Note that Paddle keeps its own records as an independent controller.

When we no longer need personal data for the purpose we collected it, we delete it or irreversibly anonymise it.

7. Your rights

Under the GDPR and Bulgarian data protection law, you have the right to:

Access — ask what personal data we hold about you and get a copy;
Rectification — have inaccurate or incomplete data corrected;
Erasure — ask us to delete your data where there is no overriding reason for us to keep it;
Restriction — ask us to pause processing while a dispute is resolved;
Portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another provider. You can also export your estimates yourself from inside Estimake at any time;
Objection — object to processing based on legitimate interests, and object to direct marketing at any time, which we will always honour;
Withdraw consent — where we rely on consent, withdraw it at any time. This does not affect processing that already happened.

To exercise any of these, email support@estimake.it. We may need to verify your identity first. We will respond within one month, and will tell you if we need to extend that period as the law allows. Exercising your rights is free and we will not treat you differently for it.

If your data sits inside another customer's workspace — for example you are named as a contact on their estimate — we will forward your request to that customer, who is the controller for it, and support them in answering you.

Complaints. If you are unhappy with how we have handled your data, please tell us first — we would like the chance to fix it. You also have the right to complain to a supervisory authority: in Bulgaria this is the Commission for Personal Data Protection (CPDP) , and you may instead complain to the authority in the EU country where you live or work.

8. Security

We take appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS across the site, the application and our APIs), encryption at rest for stored files and backups, hashed passwords, access controls that give our staff only the access they need, and regular patching of the systems we run.

No system is perfectly secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the CPDP within 72 hours and tell you without undue delay where the law requires it.

You have a part in this too: use a strong, unique password, keep it to yourself, and tell us immediately at support@estimake.it if you think your account has been compromised.

9. Cookies and similar technologies

Estimake uses a small amount of browser storage to keep you signed in and to remember your preferences, and cookieless analytics to understand how the site is used. We set no advertising cookies and allow no third-party ad trackers. Our cookie policy lists exactly what is stored, why, and how to control it.

10. Children

Estimake is a business tool and is not intended for children. You must be at least 16 years old, or the age of digital consent in your country, to have an account. We do not knowingly collect data about children; if you believe a child has given us personal data, contact us and we will delete it.

11. Other websites

Our site links to sites we do not operate, such as Paddle's. We are not responsible for their content or their privacy practices — please read their policies.

12. Changes to this policy

We may update this policy to reflect changes to the Service, our providers or the law. The date at the top of this page shows when it was last revised. If a change materially affects how we use your data, we will notify you by email or in the application before it takes effect, and where the law requires consent we will ask for it again.

13. Contact

Cytec BG Ltd. — data controller
zh.k. Trakia, block 327, entrance V, floor 7, apartment 20
Plovdiv, Bulgaria
UIC (ЕИК): 202835086 · VAT: BG202835086
support@estimake.it