Privacy Policy
Last updated: May 2025 · Operated by Waesta Enterprises U Ltd, Uganda
1. Who we are
Waesta Enterprises U Ltd ("we", "us", "our") operates Estamail. We are the data controller for personal data collected through the Service. Registered in Kampala, Uganda.
Contact: privacy@estamail.app
2. Data we collect
Account data: Email address, password (hashed — never stored in plain text), name (optional).
Profile & signature data: Information you enter into the signature builder — name, title, company, phone number, social links, photo, logo, etc. This data is used solely to generate your signatures.
Usage data: Pages visited, features used, click events on your public digital cards and signatures. We use this to power your analytics dashboard.
Payment data: Transaction references and plan information. We do not store card numbers. Payments are processed by third-party providers (MTN, Airtel via Relworx; card providers via our payment gateway).
Affiliate data: If you join the affiliate program: your full name, mobile number, mobile money provider, application details, tracking link activity, and payout history.
Technical data: IP address, browser type, device type, and referrer URL for security and analytics purposes.
3. How we use your data
- To provide, operate, and improve the Service
- To authenticate you and keep your account secure
- To process payments and manage your subscription
- To power your analytics — showing you signature views, card scans, and link clicks
- To communicate with you about your account, updates, and support
- To detect and prevent fraud, abuse, and security incidents
- To comply with legal obligations
We do not use your data for advertising, and we do not sell it to third parties.
4. Legal bases for processing
Where applicable, we process your data based on: contract performance (to provide the Service you signed up for), legitimate interests (security, fraud prevention, analytics), and legal obligation (accounting, compliance).
5. Data sharing & third parties
We share data with trusted third-party service providers only as necessary to operate the Service:
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase | Database & authentication | Account data, signature data, all platform data |
| Relworx | Affiliate payouts (mobile money) | Affiliate name, phone number, payout amount |
| Vercel | Hosting & CDN | IP address, request logs |
We require all third parties to handle your data securely and in accordance with applicable privacy laws.
6. Cookies & tracking
We use session cookies to keep you logged in and functional cookies to remember your preferences. We do not use advertising or cross-site tracking cookies.
Our analytics are based on server-side event data (page views, clicks) and do not rely on third-party advertising networks.
7. Data retention
We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or accounting purposes (typically up to 7 years for financial records).
8. Your rights
You have the right to:
- Access — request a copy of the data we hold about you
- Correction — ask us to correct inaccurate data
- Deletion — ask us to delete your account and data
- Portability — request your data in a machine-readable format
- Objection — object to processing based on legitimate interests
To exercise any of these rights, email privacy@estamail.app. We will respond within 30 days.
9. Security
We take security seriously. All data is encrypted in transit (HTTPS/TLS). Passwords are hashed using bcrypt and never stored in plain text. We use row-level security on our database to ensure users can only access their own data.
Despite our best efforts, no system is completely secure. If you discover a security vulnerability, please report it responsibly to security@estamail.app.
10. Children's privacy
The Service is not directed at children under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or a notice on the Service. The date at the top of this page always reflects the most recent update.