Privacy Policy — FollowUp Teams for iPhone

Last updated: 20 October 2026

FollowUp Teams (فولو أب للفرق) for iPhone is made by ESTATEOS. It reminds you of your client calls and viewings, and lets a company's manager and salespeople work on the company's clients together. Contact: [email protected]. This page is for the iPhone app; the Android app FollowUp One has its own page.

Delete your data: in the app, Company → “Delete my data from the companies server” (a salesperson) or “Delete the company” (the manager); your own clients are deleted with the app. Details below.

Your own clients stay on your iPhone

Clients you keep as your own, with their names, numbers, notes, follow-ups and deals, are stored inside the app on your iPhone. They are never sent to our servers or to anyone else, and we can never see them. The app has no account to sign up for: using it on your own sends us nothing. A backup file is made only when you ask for it (Import & backup), saved where you choose or shared with whom you choose. It is locked with a password you choose (at least 8 characters): encrypted on your iPhone with AES-256-GCM, with a key made from your password by PBKDF2-HMAC-SHA256 (600,000 rounds) and a random salt. The password stays on your iPhone, in its secure storage; it is never sent to us, we never see it, and we cannot open or recover a backup file: if you forget the password, nobody can open it. The app also keeps a copy by itself every day inside the app (the last 3), to bring your clients back if they are lost; these copies stay inside the app on your iPhone (and in your iPhone's own iCloud backup, if you have it on) and are deleted with the app. Save a backup to iCloud Drive or Files every so often; the app reminds you once a month.

The company's clients (only if you join or make a company team)

Nothing here happens unless you open “Company” in the app and join a company with its code or make one; until then the app never contacts our Teams server (a Supabase project).

• What is kept: the company's name and team code; each person's name as they typed it and their role; the manager's WhatsApp number, confirmed with a code the manager sends from WhatsApp; and the company's clients: name, number, project, source, stage, follow-up and visit times, the notes and results written on them, and who did what and when (the client's history). The app's anonymous sign-in for the team and, to send team notifications, the phone's push token.
• What is never sent: your own clients, and deal amounts and commissions (a deal is shown only as “won”).
• The ad links (optional): a company's owner can make two links for new leads. A private link (a secret key sent in a header, for Zapier or Make; never to be put on a web page) and a form link (a key that may sit on a public landing page; the form also carries a hidden field that real visitors leave empty, to stop robots). Each lead sent is kept like any client of the company — the name, number, project, campaign name and the form's message — and waits for the owner or operations to hand it out (they can delete unwanted leads in one go). The company decides what its forms collect; we only keep what is sent. To limit misuse we keep a count of leads per hour (one day) and, for the form link, a one-way code of the sender's network address (made with a secret only we hold) for one day.
• One free trial per number: to give each manager's number one free trial only, we keep a one-way code of the manager's number (made with a secret only we hold) and the date its first trial ends. It has no end date and is not removed when a company is deleted, so deleting a company and starting another with the same number does not start a new trial.
• The manager's number and moving a company: a company is tied to its manager's confirmed WhatsApp number. If that number is confirmed from another phone, the company's current phone is asked first and has 24 hours to say it isn't them; if it says no, nothing moves; if it says yes, or does not answer for 24 hours (a lost phone), the company moves to the new phone. We keep the request until it is done and 7 days at most. Whoever ends up holding a manager's number continues in the former manager's place, because the company's seat belongs to the company, not to a person; the owner decides who is in the company and can remove anyone. The manager's WhatsApp message is received by our main server, which passes only the sender's number, the message and its id to the Teams server in a signed request.
• The company dashboard on a computer (optional): the owner, operations or a team lead can open the company's page at estateoseg.com/team on a computer, signed in by approving it from their phone. The phone shows the code, the browser's name and how long ago it was asked, and asks for the phone's own lock if it has one; after approving, the phone shows a 2-digit number that you type on the computer (the computer is never shown it, so a sign-in someone else started cannot be completed by mistake); a wrong number ends that sign-in and the phone gets a notification saying so. The page shows what their phone shows. We keep the browser's name (like “Chrome · Windows”), when it was used, and one-way codes of the network address and of its network (made with a secret only we hold) for one day, only to limit misuse. The phone gets a notification when the company dashboard is opened, lists each computer and can sign it out. A sign-in code lasts 5 minutes, the number 2 minutes, and a session ends after 12 hours unused or 7 days at most.
• Who sees it: it depends on the role the company's owner gives each person:
  • the owner («صاحب الشركة») sees all the company's clients and the team's notes;
  • operations («أوبريشن») sees all the company's clients, to hand them out;
  • a team lead («مدير فريق») sees the clients of the people in their own teams, and the clients still waiting to be handed out (name and number only, not their history);
  • a salesperson sees only the clients given to them.
  No one sees another company. Backups made by the app never include the company's clients; they come back from the Teams server.
• Leaving: when you leave the team or the manager removes you, the company's clients leave your iPhone and stay with the company (it's the company's data).
• Notifications: team notifications (a join request, clients given to you, a note from the team, a new client nobody called, the day's summary, a request to move the company, a computer opening the company dashboard, and a warning that a stopped company's data will be deleted) are sent through Google's Firebase Cloud Messaging and Apple's push service. They say who and how many, never a client's name or number.

Permissions

• Notifications: so your reminders and team notifications reach you. Reminders are planned on your iPhone.
• Contacts: when you add a client from your contacts, you pick the contact yourself in iOS's own picker and the app takes only that number. The app never reads your contacts itself and never uploads them.
• Files: when you import a sheet or restore a backup, iOS gives the app only the file you picked.
• Face ID or passcode (optional): to lock the app. iOS checks it; the app never sees your face or passcode.

There are no ads, analytics or third-party trackers in the app. We never sell your data, and we share it only with the providers below to run the service.

Security

Every connection is encrypted. The Teams server is hosted by Supabase in the European Union (Frankfurt, Germany). The service runs on trusted providers: Supabase (the Teams server and database), Meta's WhatsApp Business (confirming the manager's number), Google Firebase Cloud Messaging and Apple's push service (team notifications; no analytics), GitHub (encrypted server backups), Cloudflare (this website) and our email provider (the support mailbox).

How long we keep data

• A company's clients, team and history: while the company runs; a client the manager deletes is erased with its history 30 days later, and a note that it was deleted (its id only, no name or number) is kept 400 days so a phone that was switched off learns of it.
• A company that stops: if its free trial ended and it was never continued with us, its clients, their history and pending notifications are deleted 90 days after the trial ended. If it was continued and then lapsed, or its owner stopped it, they are deleted 180 days after its continued time ended or it was stopped. The owner is warned by a notification and a banner in the app 30, 7 and 1 day before; continuing the company with us, or switching it on again, stops the clock, and we can postpone it if the owner asks us. What stays: the company's name, its people (names and roles), the manager's number, the one-trial record and the record of the company's account with us. Done by our daily clean-up.
• The one-trial record (a one-way code of the manager's number and the end of its first trial): no end date, so a number cannot start a second trial.
• A request to move a company: until it is done, 7 days at most. WhatsApp message ids already handled: one day.
• Lead counts and form-sender codes: one day. Our alerts about unusual traffic (counts only): 90 days.
• Team notifications: 7 days after they are sent (30 days if never sent).
• The manager's number confirmations: codes 30 days; confirmation attempts one day.
• A declined join request: 30 days; join attempts one day.
• The push token of a phone that is in no team: 30 days.
• Company dashboard sign-ins on a computer: the sign-in codes and the network-address codes one day; the sessions until signed out or ended (12 hours unused, 7 days at most).
• Encrypted server backups: made daily in a private repository, each kept up to 90 days.
• Emails to our support address: while needed to answer you.

Deleting your data and your rights

Under Egypt's Personal Data Protection Law No. 151 of 2020, you can ask for a copy of the data we hold about you, correct it, or delete it at any time.

• Your own clients: they are only on your iPhone; deleting a client deletes it, and deleting the app deletes them all with its copies.
• A salesperson: Company → “Delete my data from the companies server”: you leave the team and your name is removed from the Teams server (you show as “former member” in the company's history). The company's clients belong to the company and go back to the manager.
• The manager: Company → “Delete the company” (the company's name typed to confirm) deletes its clients, team and history at once. We keep only the one-way code of the manager's number and the end of its first trial, with no end date, so the same number cannot start a new trial by starting a new company.
• A stopped company: its clients are deleted automatically 90 or 180 days after it stopped, as described above.
• By email: [email protected]. Before deleting a company we make sure the request is from its manager's WhatsApp number; we delete within 30 days.

Copies inside the Teams server's encrypted backups are gone within 90 days.

Children

The app is a work tool for adults and is not meant for children.

Changes

If we change anything important here, we'll update the date at the top of this page.