מדיניות פרטיות

Privacy Policy

Effective date: 12 November 2026 · Last updated: 12 November 2026

Esty (“Esty”, “we”, “us”) is a customer-relationship management (CRM) web application for real-estate agents and brokerages in Israel, available at https://esty-ai.web.app. Esty is operated by Aviv Goldstein, Israel. This policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the choices and rights you have. It applies to the Esty web app, its public pages, and its related services.

1. Who this policy covers

• Users — agents, brokers and office staff who create an Esty account.
• Contacts of users — people whose details an agent records in their CRM (buyers, sellers, tenants, landlords, leads). The agent who records them decides what to record and is responsible for having a lawful basis to do so; Esty processes that information on the agent’s behalf.
• Visitors — people who open a public page an agent shares with them (a property page, a client board, or a document to sign), without an account.

2. Information we collect

2.1 Account information

• Name, email address and profile photo, when you sign in with Google; or your mobile phone number, when you sign in with a one-time code sent by SMS or WhatsApp.
• Profile details you choose to add: title, license number, office, logo, signature image, and your mobile number.
• Subscription and billing status. Payment card details are entered directly with our payment processor, Stripe; Esty never receives or stores full card numbers.

2.2 Content you store in Esty

• CRM records: leads, clients, properties (addresses, prices, photos, features, owner details), calendar events, tasks, notes, call logs, deals and commissions, contracts and digital signatures, and marketing texts.
• Files you upload, such as property photos, logos and documents.

2.3 Information from services you choose to connect

• Google Calendar (optional) — see section 4.
• Facebook Pages (optional) — the list of Pages you manage and a Page access token, used only to publish the posts you ask Esty to publish.
• Telephony — when you place or receive calls through Esty, the call metadata (numbers, time, duration, direction) and, where your telephony plan records calls, the recording and its transcript.

2.4 Public market information

Esty displays publicly advertised real-estate listings (for example from Yad2 and Madlan) and public government registers (from data.gov.il). An advertiser’s phone number is retrieved only when an agent explicitly asks to see or call it, one listing at a time; Esty does not bulk-collect advertisers’ contact details.

2.5 Technical and usage information

• Log and device information (IP address, browser type, pages used, errors) needed to run and secure the service.
• Product analytics via Google Analytics for Firebase, to understand which features are used.
• Browser storage (localStorage/sessionStorage) for preferences such as theme and view settings, and for keeping you signed in. Esty does not use advertising cookies.

3. How we use information

• To provide the service: store and display your CRM, sync your calendar, place calls, publish posts you request, generate documents and share pages you choose to share.
• To provide AI features you invoke (for example drafting a listing description, analysing a call or answering a question about your data). The content you submit to an AI feature is sent to the AI provider for that request only.
• To authenticate you, secure accounts, prevent abuse and enforce plan limits.
• To process subscriptions and payments.
• To provide support and communicate with you about the service.
• To comply with legal obligations.

We do not sell personal information, and we do not use your data or your contacts’ data for advertising.

4. Google user data (Google Calendar)

Connecting Google Calendar is optional and is done from Settings. If you connect it, Esty requests the https://www.googleapis.com/auth/calendar.events scope (view and edit events on your calendars), together with your email address (openid, email) to show which Google account is connected.

What we access

• Events on your primary Google Calendar: title, start and end time, location, description, and status — within a working window of 30 days back and 12 months ahead, plus later changes to them.
• The events Esty creates on your behalf, which carry a private marker linking them to the Esty event.

How we use it

• Solely to keep your Esty calendar and your Google Calendar synchronized in both directions: meetings you create, change or delete in Esty are written to your Google Calendar, and meetings you create, change or delete in Google Calendar appear in your Esty calendar.
• Synced events are shown only to you, inside your own Esty account.

What we do not do

• We do not sell Google user data, and we do not use it for advertising, including retargeting or interest-based advertising.
• We do not transfer Google user data to third parties, except as necessary to provide or improve the user-facing synchronization feature, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
• We do not use Google user data to develop, improve or train generalized artificial-intelligence or machine-learning models.
• No person at Esty reads your Google Calendar data, except with your explicit permission for a specific support request, where necessary for security purposes (such as investigating abuse), or to comply with applicable law.

Storage, retention and revocation

• The OAuth refresh token that lets Esty sync is stored on our server (Cloudflare Workers KV), never in your browser, and is used only to call the Google Calendar API for you.
• Events that have been synced are stored as part of your Esty calendar (Google Cloud Firestore) until you delete them or your account.
• You can disconnect at any time from Esty → Settings → Google Calendar. Disconnecting revokes Esty’s token at Google and deletes the stored token and sync state from our servers immediately. You can also remove access from your Google Account at myaccount.google.com/permissions. Events already copied remain in both calendars unless you delete them.

5. Who we share information with

We share information only with service providers that process it for us to run Esty, under their own security and confidentiality commitments, and only as needed for the purpose listed:

We may also disclose information if required by law or a valid legal request, to protect the rights and safety of users or others, or in connection with a merger or sale of the business (with notice to you). Pages you choose to share publicly (a property page, a client board or a signing link) are visible to anyone who has the link; each such link exposes only that one record.

6. International transfers

Our providers may process data outside Israel, including in the European Union and the United States. Where they do, they are bound by contractual and security commitments appropriate to the data.

7. Retention

• Account data and CRM content are kept for as long as your account is active.
• When you delete a record, it is removed from our database; backups may retain it for a limited period before being overwritten.
• When your account is deleted, your data is deleted within 30 days, except where we must keep it longer by law (for example billing records).
• Google Calendar tokens are deleted immediately on disconnect (section 4).

8. Security

• All traffic is encrypted in transit (HTTPS/TLS). Data is stored with our providers, encrypted at rest.
• Each user’s data is isolated by server-side access rules; public share links expose a single record only.
• Access tokens for connected services (Google, Facebook) are kept server-side and never sent to the browser.
• No method of transmission or storage is completely secure; we work to protect your information and will notify you and the authorities of a breach as the law requires.

9. Your rights and choices

Under Israel’s Protection of Privacy Law, 5741-1981, and other applicable law, you may:

• access the personal information we hold about you and receive a copy;
• ask us to correct inaccurate information or delete it;
• disconnect Google Calendar or Facebook at any time from Settings;
• export your records (for example, properties to CSV) and delete records yourself in the app;
• ask us to delete your account.

If you are a person whose details an agent recorded in Esty, please contact that agent first; they control that record. You may also contact us and we will pass your request on or assist as the law requires. To exercise any right, write to avivgold@gmail.com. We respond within 30 days.

10. Children

Esty is a professional tool for adults. It is not directed to children under 18, and we do not knowingly collect their information.

11. Changes to this policy

We will post any change on this page with a new “Last updated” date, and notify users in the app or by email about material changes before they take effect.

12. Contact

Esty · operated by Aviv Goldstein, Israel
Email: avivgold@gmail.com
Website: https://esty-ai.web.app/home