Privacy Policy

1. Data Controller and Contact

Rentvault Software Ltd is registered with the Information Commissioner's Office (ICO) as a data controller. Registration number: C1912530. For data protection enquiries, contact our Data Protection Contact at privacy@rentvault.co.uk.

We have not formally appointed a Data Protection Officer under UK GDPR Article 37 on the basis that our core activities do not meet the thresholds that would require one. Our Data Protection Contact handles all data protection enquiries.

2. What Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, username, and hashed password
• Property data: property addresses, room details, compliance certificates, and associated documentation
• Tenant data (input by you as landlord): tenant names, contact details, tenancy dates, rent amounts, and Right to Rent check records
• Special category and identification data: where you use Right to Rent features, this may include nationality, immigration status, date of birth, and copies of identity documents
• Financial data: income and expense records, and where Open Banking is enabled, bank transaction data accessed via TrueLayer
• Usage data: pages visited, features used, session duration, and device information
• Analytics data: where you consent, pseudonymised analytics data collected via Google Analytics 4 and Microsoft Clarity
• Communications: messages sent via the in-app assistant and support requests

Tenant records may sometimes include personal data relating to minors (for example, where a family occupies the property). You are responsible for the lawful basis for processing such data.

3. Controller / Processor Roles

For most tenant data you enter into the Service, you are the data controller and we act as your data processor. Our Data Processing Agreement governs this relationship.

For the following limited activities we act as an independent controller or joint controller:

• The optional in-app AI assistant (when it processes tenant data to generate output for you)
• Anonymised and aggregated analytics we use to improve the Service
• Website visitor analytics via Google Analytics
• Any direct tax reporting or MTD features we provide

Where we act as joint controller, we and you will agree our respective responsibilities in line with UK GDPR Article 26. The terms of any joint controller arrangement are set out in our Data Processing Agreement.

4. Legal Basis for Processing

Under UK GDPR, we process personal data on the following legal bases:

• Contract (Article 6(1)(b)): processing necessary to provide the Service you have subscribed to
• Legitimate interests (Article 6(1)(f)): improving the Service, preventing fraud, and ensuring security
• Consent (Article 6(1)(a)): for marketing communications, Open Banking connections, and analytics cookies
• Legal obligation (Article 6(1)(c)): where we are required to retain data for tax or regulatory purposes

For special category data (e.g. nationality data within Right to Rent records), we rely on Article 9(2)(g) (substantial public interest) as implemented by Schedule 1 Part 2 of the Data Protection Act 2018, specifically the condition for preventing unlawful acts. Primary responsibility for the Article 9 condition sits with you as landlord; we process this data on your instructions.

5. How We Use Your Data

• Providing and maintaining the property management Service
• Sending transactional emails (account confirmation, password resets, compliance alerts, arrears notifications)
• Processing subscription payments via our payment partner (Stripe)
• Generating legal documents and compliance reports
• Automated bank transaction categorisation (when Open Banking is enabled)
• Improving the Service through aggregated, anonymised analytics
• Understanding website usage via Google Analytics (with your consent)

6. Automated Decision-Making

We do not currently make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing. If we introduce such features in future (for example, automated tenant risk scoring), we will update this policy and seek any required consents.

7. Sub-processors and Data Sharing

We do not sell your personal data. We share data only with the following categories of recipient, and our current sub-processor list is published at rentvault.co.uk/sub-processors:

• TrueLayer Limited (UK): Open Banking services, where you grant consent
• Stripe, Inc. / Stripe Payments UK Ltd: payment processing
• Resend, Inc. (US): transactional and notification email delivery
• Google LLC (US): website analytics via Google Analytics 4, where you grant consent
• Microsoft Corporation (US): website analytics via Microsoft Clarity — session recordings, heatmaps, and click tracking that use cookies to collect anonymised usage data, only after you have accepted analytics cookies. Microsoft's privacy policy is available at privacy.microsoft.com
• OpenAI, L.L.C. (US): AI assistant features, where you use them
• Replit, Inc. (US): our application hosting provider. The RentVault application and primary database run on a Replit Reserved VM physically located in Frankfurt, Germany (Google Cloud europe-west3 region), so day-to-day storage and processing of your account, property, tenant and financial data takes place inside the European Economic Area
• Replit Object Storage (Frankfurt, EEA): encrypted storage for documents, certificates, and photos you upload
• Any other sub-processors: are disclosed and kept up to date on the sub-processor register linked above
• Law enforcement and regulators: where required by law or court order

8. International Transfers and Where Your Data is Held

Primary data location. The RentVault application and the primary PostgreSQL database that holds your account, property, tenant, compliance and financial data are hosted on a Replit Reserved VM physically located in Frankfurt, Germany (Google Cloud europe-west3 region) — within the European Economic Area. Database backups are held in the same region.

Cross-border transfers. Some sub-processors operate from outside the UK/EEA, in particular Stripe, Google (for Google Analytics), Microsoft (for Microsoft Clarity), OpenAI, and Replit (our hosting provider, which is a US-incorporated company even though our specific deployment runs in Frankfurt). Where personal data is transferred outside the UK/EEA, we rely on appropriate safeguards, which may include:

• The UK Extension to the EU-US Data Privacy Framework, where the recipient is certified
• The UK International Data Transfer Agreement
• Standard Contractual Clauses approved by the ICO

We carry out Transfer Risk Assessments for material international transfers and these are available to you on reasonable request.

9. Data Retention

We retain your account data for as long as your account is active. Specific retention periods:

• Account data: until account deletion, then erased within 30 days (following a 30-day export window)
• Financial records: 7 years from the end of the tax year to which they relate (HMRC requirement)
• Compliance certificate records: 6 years after expiry of the certificate
• Right to Rent records: retained for the duration of the tenancy and for 1 year after it ends (Home Office requirement)
• Google Analytics data: 14 months

If retention is required by law beyond these periods, we will retain the minimum data necessary.

10. Your Rights

Under UK GDPR, you have the following rights:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data (subject to legal retention requirements)
• Portability: request your data in a machine-readable format
• Restriction: request we limit processing of your data
• Objection: object to processing based on legitimate interests
• Withdraw consent: where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact privacy@rentvault.co.uk. We will respond within one calendar month of receiving a valid request. Where a request is complex or we receive several requests, we may extend this period by up to two further months and will notify you of any extension.

11. Cookies and Similar Technologies

We use a small number of cookies and similar technologies. Some are strictly necessary for the Service to function; others require your consent. For full details, see our Cookie Policy.

12. Security

We implement appropriate technical and organisational measures to protect your data, including: encryption in transit (TLS), hashed passwords (bcrypt), role-based access controls, and regular security reviews. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where the breach is likely to result in a high risk, we will notify affected individuals without undue delay.

13. Marketing

We do not currently send marketing emails. Should we wish to in future, we will do so only on the basis of your opt-in consent, and every marketing communication will contain a clear unsubscribe mechanism.

14. Children

The Service is not intended for individuals under 18 years of age as account holders; we do not knowingly accept registrations from children. Tenant records entered by our subscribers may include data relating to minors (for example, family members occupying a rental property); subscribers are responsible for the lawful basis of such processing.

15. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or in-app notification. The "last updated" date at the top of this page indicates when the policy was last revised.

16. Complaints

If you are unhappy with how we handle your data, please contact us first at privacy@rentvault.co.uk so we can try to resolve your concern. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

17. Contact

• Data Protection Contact: privacy@rentvault.co.uk
• Rentvault Software Ltd (Company No. 17165919 · ICO Registration: C1912530)
• Registered office: Whitstable, Kent, United Kingdom
• Registered in England & Wales