KeptLet privacy policy
Last updated: [date]
KeptLet is run by [Luke's full name], trading as KeptLet, [address] ("we"). We are the controller of your personal data. Contact us at [support email].
What we collect
- Your account: your email address, if you create an account.
- Your records: the properties, certificates, dates, notes, tenancy checklists, repair log entries and documents you add. These can include your tenants' names and details you choose to type in.
- Subscription status: whether you are on a trial or a paid plan, and until when. Payments are handled by Stripe, Apple or Google; we never see your card details.
- People you share with: the email addresses of joint owners you invite. They can see and change the records you share.
- Photos and receipts you add to inspections and income and costs.
- Feedback you send us from the app, with the app version and the type of device.
- Trade contacts you save (name, number, email, registration number) and a record of the messages you send from the app and when a certificate copy was given to a tenant. Messages themselves are sent by your own email, messaging or WhatsApp app, not by us.
- Your HMRC connection, if you use Making Tax Digital: your National Insurance number, the access HMRC grants us to your Self Assessment account, your property business reference, and a copy of each quarterly update you send. These are kept on our server, never on your device, and we send HMRC only the figures you have checked, plus the device details HMRC requires of all tax software for fraud prevention.
- Postcodes you look up on the Energy Performance of Buildings register, which pass through our server to the register, and the postcode of each home you add, which the app looks up on postcodes.io to fill in your region.
- Documents you ask the app to read. When you scan or attach a certificate while signed in, the document is sent through our server to Anthropic, whose AI reads the dates, reference and engineer from it. The answer comes back to the app for you to check. Anthropic doesn't use it to train its models. We keep only a count of how many documents you've read each day.
- Scans sent to your computer. A document you scan with "Scan to computer" is stored in your account's file storage until you file it.
- Your bank transactions, if you connect your bank or import a statement: the date, amount, payer and reference of money paid in, used only to match rent to your tenancies. A bank connection is read-only (we can't move money or see your bank login) and goes through TrueLayer, which is authorised by the Financial Conduct Authority. Statement files are read on your device. Rent you confirm is saved with your records; other transactions are not kept. You can disconnect at any time.
- Documents you send for e-signature, and the names and email addresses of the people you send them to. They go through Dropbox Sign, which emails each signer and returns the signed copy to your account.
- The waitlist, if you join it on our website: your email address, your region and how many homes you let, where you heard about us, and when you agreed to hear from us.
If you don't create an account, your records stay on your device and we receive nothing.
Why we use it
| Purpose | Lawful basis |
|---|---|
| Back up your records and sync them between your devices | Contract |
| Send your sign-in codes | Contract |
| Know which plan you are on | Contract |
| Improve the app from your feedback | Legitimate interests |
| Email you about the launch and your region's deadline (waitlist) | Consent: unsubscribe any time |
| Keep accounting records of payments | Legal obligation |
We don't sell your data, show adverts or use it to train AI models. Reminders are generated on your phone.
Who processes it for us
- Supabase (database, file storage and sign-in), hosted in Ireland (EU).
- Stripe (web payments), Apple and Google (in-app payments), and RevenueCat (which keeps app-store subscriptions in step).
- Resend, for sign-in codes and emails about your account.
- Cloudflare, which hosts our website.
- TrueLayer, which connects to your bank if you choose to (read-only).
- Dropbox Sign, which handles documents you send for e-signature.
- HM Revenue and Customs, when you send Making Tax Digital updates.
- The Department for Housing's Energy Performance of Buildings register, when you look up an EPC (it receives the postcode only).
- Anthropic, which reads the documents you ask the app to read.
- postcodes.io, which receives the postcode of a home you add (nothing else).
Some of these companies may process data outside the UK under approved safeguards.
How long we keep it
While your account exists. When you delete your account in the app, we delete your account, the cloud copy of your records and your uploaded documents straight away. We keep payment records for six years because HMRC requires it. Feedback is kept without your account details.
Your rights
You can access, correct, export or delete your data, object to how we use it, or ask us to restrict it. Most of this you can do in the app (Settings > Export a backup, and Account > Delete my account). Otherwise email us.
If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/
Your tenants' details
If you add your tenants' details, you are responsible for having a lawful reason to hold them, as you are for any landlord records.
Children
KeptLet is for landlords and isn't intended for anyone under 18.