Privacy policy

The data controller for your account is Northwind Labs Ltd (registered office: 82a James Carter Road, Mildenhall, Suffolk, IP28 7DE), registered with the UK Information Commissioner's Office (ICO) under reference ZC192521. When you use TenantProof to record information about your own tenancy, you are organising your personal records; the operator processes that information on your behalf to provide the service.

TenantProof is a tool to help you keep your own records and find official routes. It does not provide legal advice and does not act on your behalf.

We collect only what the features need (data minimisation):

• Your account email address and an encrypted password.
• Tenancy details you enter (address, landlord/agent, dates, rent, deposit and scheme).
• Condition reports and repair logs, including notes and any photos you upload.
• If you upload your tenancy agreement, the PDF file itself and the key details you confirm from it (such as the parties, dates, rent and deposit). We do not run it through any AI, you enter or confirm those details yourself.
• A record of each time you download an evidence bundle or a paid pack: which tenancy it was for, which kind, and the time. We keep this for 180 days and then delete it. It is deliberately minimal, with no IP address and no device information, and it exists so we can show a pack was actually delivered if a card payment is ever disputed. You can see your own download history in the data you download from your account page.
• Photo metadata: the time you uploaded it, the capture time from the photo's EXIF data (if present), and, only if you explicitly opt in when adding a photo, your device's location at that moment. If a photo you upload has a location tag embedded by your camera, we strip it in your browser before the photo is stored, wherever your browser can process the file. In rare cases, an unusual file type or a browser that cannot re-encode the image, the photo may be stored as your camera produced it. Photos you take live in the app carry no location tag to begin with.
• Letters you choose to save.
• If you buy a Dispute Pack, a record that the purchase was made (the card payment itself is handled by Stripe, we never see or store your card details).
• How you first reached us: if you arrive from a tagged link or another website, we store the campaign source, the page you landed on, and the referring site's name (not its full address). We do not use a tracking cookie for this: it is held in your browser's own local storage on your first visit, and saved to your account only if you sign up. It is never shared with advertisers, and clearing your browser storage removes it.

We process your data to perform the service you asked for (Article 6(1)(b), performance of a contract), and to keep the service secure and working. Optional location data attached to a photo is processed on the basis of your explicit consent, given each time you opt in; you can decline and still use every feature.

Optional analytics cookies (see “Cookies” below) are used only on the basis of your consent (Article 6(1)(a)), which you give or refuse in the cookie banner and can withdraw at any time.

Before you make that choice, Google Analytics runs in a cookieless mode that sends Google limited technical data, including your IP address (which Google uses to estimate broad location and does not store to identify you). We rely on our legitimate interests (Article 6(1)(f)) in measuring and improving the service for this, and you can stop it entirely by choosing “Reject” in the banner.

We also record how you first reached us (campaign source, landing page, referring site) on the basis of our legitimate interests (Article 6(1)(f)) in understanding which channels help renters find the service. It is stored with your account, not used to track you across other sites, and is included in your data export and deletion.

Your records may include the name of your landlord or letting agent. We process those third-party names under our legitimate interests (Article 6(1)(f)) in providing a tenancy-records service: they are recorded in a business capacity, kept private to your account, and never published or used for marketing. A landlord or agent can contact us (see “Contact” below) to exercise their rights, including to object to this processing.

Your records are private to your account. Every database table is protected by row-level security, so one user can never read or change another user's data. Photos are kept in a private storage bucket and shown to you only through short-lived signed links. Access from inside the application is scoped to your own account.

We do not sell your personal data, and we never share your tenancy records, photos or letters with advertisers. We use a small number of processors to run and improve the service:

• Supabase, database, authentication and photo storage.
• Stripe, payment processing, only if you buy a Dispute Pack.
• An email provider, only to send account and purchase-receipt emails and, if you opt in, reminders about repairs that may need chasing and about getting your evidence ready around your move-out and deposit-return window. You can turn the reminders off at any time on your account page.
• Vercel, hosting.
• Sentry, error monitoring, so we can detect and fix faults. It receives only technical error reports, with personal details stripped before sending, never your tenancy records, photos or letters.
• Google Analytics 4 (Google), to measure how the site is used and how well our marketing works. By default it runs in a cookieless mode: it sets no cookies, though it still sends Google limited data including your IP address (used for approximate location, not to identify you). Choosing “Reject” stops it; accepting enables more precise, cookie-based measurement. Accepting does not switch on advertising features: we keep Google's advertising signals (ad storage, ad personalisation and ad user data) turned off whichever option you choose.
• Microsoft Clarity (Microsoft), only if you accept analytics cookies, for anonymised session analytics (which pages are used and where people get stuck). On the pages that show your tenancy details, on-screen text is masked so it is not captured in recordings.

Your records are stored by Supabase in a UK region. Stripe, Vercel, Google, Microsoft, Sentry and our email provider may process limited data outside the UK, including in the United States; where they do, the transfer is protected by the UK International Data Transfer Agreement (or Addendum) or Standard Contractual Clauses.

Essential cookies are always on. They keep you signed in and remember your cookie choice. The service will not work without them, so they don't need consent.

Optional analytics cookies are set only after you accept them in the cookie banner, that is when Google Analytics starts using cookies and when Microsoft Clarity loads at all. Before you accept, Google Analytics runs in a cookieless mode that sets no cookies (it still sends Google limited data such as your IP address, used for approximate location, not to identify you, and choosing “Reject” stops that).

You can accept or reject optional cookies when you first visit, and change your mind at any time using Cookie settings in the footer. Rejecting or withdrawing stops those analytics tools and deletes their cookies.

We keep your data for as long as your account is open. When you delete your account, your data and photos are permanently removed, with two exceptions. If you have bought a pack, we keep a minimal record of that purchase (the amount, date and payment reference, with no other personal details) for as long as tax and company law require, then delete it. And if one of our emails to you bounced, or you reported one as spam, we keep your email address on a do-not-email list so that we do not contact you again. You stay in control: you can export or delete everything else at any time.

Our renter survey is separate from an account, and you can answer it without creating one. We store your answers about renting, repairs and deposits, and, if you were given a link by a students' union or another partner, a code identifying who shared it. Your answers are not linked to your name or to any account.

We only store your email address if you ticked the box asking us to contact you, and we use it only for that. Because survey answers are not tied to an account, we cannot look yours up from the site; if you want your response found and deleted, email us at privacy@tenantproof.co.uk and tell us roughly when you answered, and the email address you gave if you gave one. We keep survey answers for up to two years so we can understand what renters need, then delete them.

Under UK GDPR you have the right to access, correct, export and delete your data, and to withdraw consent. You can download your data, or permanently delete your account and everything in it, at any time from your account page. The download is a JSON file of your records: your tenancies, condition reports, repairs, letters and purchases. It does not contain the photo files themselves, so if you want to keep your photos, export your evidence bundle PDF before you delete your account, because deletion removes the photos permanently. You also have the right to complain to the ICO (ico.org.uk).

Location is only ever attached to a photo if you explicitly opt in when adding it, and your browser asks your permission first. You can decline and still use every feature. Location is never collected in the background.

For any privacy question or to exercise your rights, contact privacy@tenantproof.co.uk.