Privacy Policy

Last updated: 3 June 2026

Tenancy ("we", "our", "us") is committed to protecting your privacy. This policy explains what personal data we collect, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Tenancy is operated as a sole-trader service providing AI-powered listing tools to UK letting agents. The data controller for the purposes of UK GDPR is the operator of Tenancy, contactable at vr047836@gmail.com.

2. What we collect

  • Account data: your email address. Tenancy uses magic-link authentication, so we do not store passwords.
  • Listing content: the property details you enter, the AI-generated descriptions, and any listings you save to your vault.
  • Compliance scan inputs: any listing text you paste into the Compliance Checker.
  • A/B test inputs: any variants you submit to the A/B Test tool.
  • Subscription data: your tier (Free, Pro, or Lister), billing interval (monthly or yearly), and listing/vault/compliance usage counts.
  • Payment data: processed by Stripe. We do not store card details on our servers.
  • Technical data: IP address, browser type, and device information collected automatically by our hosting provider.

3. How we use your data

  • To provide the service (account access, AI generation, vault storage, compliance scanning, A/B testing, PDF export).
  • To process subscription payments via Stripe.
  • To enforce plan limits (monthly listing allowances, compliance scan allowances, vault capacity).
  • To send essential account emails (magic-link sign-in codes, billing notifications, email-change confirmations).
  • To improve the service and prevent abuse.

We do not sell your data, and we do not use your listings to train AI models. Listing content is sent to Anthropic (our AI provider) only at the moment you generate or scan; it is not retained by them for training.

4. Third-party processors

To run Tenancy we share necessary data with the following processors. Each is contractually required to handle your data securely.

  • Supabase (database and authentication) — hosted in the EU. Stores your account, profile, vault listings, and usage data.
  • Stripe (payment processing) — UK/EU and US. Handles subscription payments.
  • Anthropic (AI generation via Claude API) — US-based. Receives the property details you enter and the listing text you paste into the Compliance Checker, only for the duration of each request.
  • Resend (transactional email) — US-based. Sends magic-link sign-in codes, billing notifications, and email-change confirmations.
  • Vercel (website hosting) — global edge network.

When data is transferred outside the UK/EU, we rely on appropriate safeguards including the UK International Data Transfer Addendum and Standard Contractual Clauses.

5. How long we keep your data

  • Account data and vault listings: while your account is active. When you delete your account from the Account page, all profile data and vault listings are removed immediately and cannot be recovered.
  • Compliance and A/B test inputs: not stored. Each scan/test is processed in real time and discarded.
  • Payment records: retained by Stripe and in our billing logs for 7 years, in line with UK tax law.

6. Your rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your data.
  • Request a portable copy of your data.
  • Object to processing or withdraw consent.
  • Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

You can update your email and delete your account directly from your Account page. To exercise any other rights or request a data export, email vr047836@gmail.com.

7. Cookies

We use only essential cookies required for authentication and session management. We do not use advertising or tracking cookies.

8. Security

We use industry-standard security measures including HTTPS encryption, Supabase Row Level Security (so users can only access their own data), and magic-link authentication (no passwords stored on our servers). No system is 100% secure, but we work hard to protect your data.

9. Changes to this policy

We may update this policy from time to time. Significant changes will be communicated to active users by email.

10. Contact

Questions about this policy or your data? Email vr047836@gmail.com.

← Back to Tenancy