KG rEstate - Real Estate

KG rEstate provides shortcodes usable in WordPress content and in builders that render WordPress shortcodes. Validate the specific theme/builder combination and its styles; compatibility with every configuration is not guaranteed.

No. KG rEstate uses OpenStreetMap and Leaflet out of the box, meaning you don't need to register credit cards or configure Google Maps API keys to get fully interactive maps.

Yes. You can customize the currency symbol, ISO code (USD, EUR, GBP, CAD, MXN, etc.), price formatting style, and area measurement units (m², sq ft, yd², v², or hectares) in KG rEstate > Settings.

Inquiries are sent directly to the configured advisor's email address and securely stored in the WordPress database under the KG rEstate > Inquiries inbox.

The inbox stores the submitted name, email, phone, message, property context and submission/mail status. An inquiry is saved before attempting email. Mail transport acceptance does not guarantee delivery. General inquiries use this site's name and home URL; property inquiries use the published property's title and URL from WordPress. Public submissions require POST and a valid nonce, with server-side type and length validation. A hidden optional trap field supplements these checks. Existing custom forms without that field remain supported. Names allow up to 120 Unicode characters and messages up to 5,000; oversized data is rejected rather than truncated. Phone input remains optional at the server boundary for compatibility with custom forms. Fixed ten-minute windows allow five validated attempts per contact email, thirty per connection address, and 120 site-wide. Limits are shared across concurrent requests. A limited request receives a retry interval and does not save an inquiry or send email. An admitted attempt consumes allowance even if inbox storage or mail later fails. These controls reduce repeated submissions; they do not identify every bot or guarantee protection against distributed attacks. The rate-control option stores window-specific HMAC identifiers derived from the email and connection address using a site secret, plus counts; it adds no clear IP address or clear email to those counters. These identifiers are pseudonymous, not guaranteed anonymous. The bounded option is replaced when a valid attempt reaches a later window; expiry does not itself erase it at exactly ten minutes. Inbox inquiries remain until manual deletion unless an administrator explicitly enables a reviewed retention policy. There is no automatic deletion at 300 inquiries. Connection limits use the web server's REMOTE_ADDR, not client-supplied forwarding headers. Shared networks or reverse proxies can share an allowance. Before deployment, verify the hosting server's trusted-proxy configuration and actual form behavior. No external CAPTCHA service is contacted. Site owners should describe inquiry storage, email handling and these controls in their privacy notice.

Yes. KG rEstate registers providers for Tools > Export Personal Data and Tools > Erase Personal Data. These use WordPress capabilities, request records and nonce checks. The plugin adds no public export or deletion URL. Follow the native request/confirmation workflow; authorized administrators retain WordPress's ability to force a request. Generating an export requires the ZipArchive support used by WordPress itself. The exporter includes the plugin's contact fields, inquiry dates, property context, read/mail status and that email's submission count when present. It excludes the advisor's separate address, other contacts and shared network counters. Extension-defined fields need their own exporter. Reports are paginated in groups of fifty. If the requested contact's data changes between pages, export stops and must be restarted from the beginning; unrelated contacts do not invalidate it. User text is escaped for WordPress's HTML report. Erasure removes matching inquiry records, including additional fields on those records, in batches without skipping a shrinking list. It preserves other contacts. An active pseudonymous submission counter is reported as retained so erasure cannot immediately bypass the submission limit. A later explicit erasure can safely clean expired counter state. Repeated erasure is safe. These callbacks do not erase sent mail, backups, other providers' data or WordPress-managed privacy reports and request records. WordPress manages those reports separately. The plugin also offers editable text in the WordPress privacy policy guide. It does not publish or replace your policy page. Review its purposes, providers and actual retention practices before publishing a policy.

Automatic cleanup is disabled by default. In KG rEstate > Inquiries > Inquiry retention, propose a period from 1 to 3650 days, review the current eligible/protected counts, then explicitly confirm and enable the reviewed policy. The displayed proposal of 90 days is not an enabled policy or a legal recommendation. Review tokens expire after ten minutes and are tied to the operator, site, inbox and policy. Saving does not itself delete inquiries. A changed review must be prepared again. New public inquiries record a server-generated UTC timestamp, also included in privacy exports. Only records with a valid integer UTC timestamp are automatically eligible. Older inquiries that have only a local date, invalid dates and future timestamps are preserved. They can still be deleted manually or through the native privacy tools. No legacy dates are guessed or backfilled during an update. When opted in, an hourly WP-Cron event removes at most fifty inquiries older than the chosen period per execution, including unread inquiries. Ages use 24-hour UTC days; a record exactly on the cutoff is preserved until it becomes older. More batches may be needed after a backlog. Scheduling depends on WordPress traffic or a configured server cron and does not guarantee deletion at the exact expiry time. Scheduling failures and the last advisory result are shown in the private controls. Inspect the real hosting configuration before deployment. Disable cleanup directly to stop future deletion. Each write compares both the inquiry snapshot and the active policy bytes atomically, so an obsolete worker cannot continue after a policy change commits. Plugin deactivation removes its future cleanup events while preserving policy and inquiries; reactivation can resume a previously enabled policy. Updating from an installation without this policy leaves it disabled. The cleaner does not erase sent emails, backups, WordPress privacy reports or other services' data. Keep a recoverable backup and review your actual privacy policy before opting in.