Privacy Policy

1. Information We Collect

We collect information that you provide directly to us, including:

• Account Information: Name, email address, phone number, company details
• Property Data: Property addresses, rental amounts, tenancy details
• Financial Information: Payment history, bank account details for Direct Debit
• Usage Data: Log files, device information, and interaction with our platform
• Communications: Messages, support tickets, and feedback you send us
• Compliance Evidence: Right to Rent, AML, sanctions, audit, and statutory-defence records where required by law

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our property management services
• Process payments and manage financial transactions
• Send important notifications about your properties and tenancies
• Comply with legal obligations (e.g., Right to Rent checks, compliance certificates)
• Detect, investigate, and prevent fraudulent or unauthorized activities
• Respond to your requests and provide customer support
• Minimise diagnostic and support data before it is sent to non-essential subprocessors

3. Data Security

We implement industry-standard security measures to protect your data:

• End-to-end encryption for all data in transit (TLS 1.3)
• AES-256 encryption for data at rest
• Multi-factor authentication support
• Regular security audits and penetration testing
• SOC 2 Type II certified cloud infrastructure
• Automatic backups with geographic redundancy

4. Your Rights

Under GDPR and UK data protection law, you have the following rights:

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, immigration, AML, audit, and reporting requirements. Right to Rent evidence is retained for the tenancy duration plus at least one year. Tenancy and financial records may be retained for statutory limitation or accounting periods, then deleted, placed beyond operational use, or irreversibly anonymised according to the applicable legal basis.

6. Subprocessors

We use selected subprocessors for hosting, payments, email delivery, diagnostics, and regulated integrations. Non-essential telemetry is minimised before egress so raw names, addresses, free-text notes, identity numbers, bank details, and payment-provider identifiers are not sent in diagnostic payloads.

7. Data Storage & International Transfers

Your core records — properties, tenancies, maintenance, finances, documents, and uploaded files — are stored in the United Kingdom / European Union (Google Cloud, London region).

Authentication data (your account email, phone number, and login credentials) is processed in the United States by our authentication provider, Google Firebase Authentication, which operates only from US data centres. This international transfer relies on the EU-US Data Privacy Framework (and its UK Extension) and Standard Contractual Clauses with the UK Addendum, together with encryption in transit and at rest and access controls as supplementary safeguards.

Certain subprocessors (for example, card-payment processing) may also process limited personal data outside the UK/EU under equivalent safeguards.