This Privacy Policy explains how we collect, use, share and protect personal data when you use the Lettfolio website (lettfolio.uk), our application (app.lettfolio.uk) and related services (together, the "Service"). It is written for our customers — UK landlords, both individuals and businesses — and for anyone whose personal data we handle as a controller.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Lettfolio is provided by Lettfolio Ltd, a company registered in England & Wales (company no. 17306482), with its registered office at Faulkner House, 31 West Street, Wimborne, Dorset, BH21 1JS. In this policy, "we", "us" and "our" refer to Lettfolio Ltd.
For the personal data described in this policy — your account, billing and marketing data — Lettfolio Ltd is the data controller.
- Contact email: hello@lettfolio.uk
- ICO registration number: ZC185358
Tenant data and our role as a processor
When you, as our customer, enter personal data about your tenants and other third parties (for example names, contact details, tenancy, rent, deposit, financial records and communications), you are the data controller for that data and Lettfolio acts as a data processor on your behalf. Our handling of that data is governed by our Data Processing Agreement, which forms part of your agreement with us. This Privacy Policy describes how we handle personal data for which we are the controller.
Tenant and accountant portals
A customer (the landlord) can invite their tenants and their accountant to access parts of the Service through their own logins. Where a person accepts such an invitation:
- We send a secure, single-use magic-link sign-in email and create a login that is bound to that person's verified email address. For this login and authentication data (email address, sign-in events, session and device information) we act as controller, on the basis of our legitimate interest in operating secure access to the Service.
- Tenants can view information their landlord has shared with them and can submit maintenance requests with photographs, exchange messages with their landlord, update their own contact details, and receive in-app notifications. The underlying portfolio records this relates to remain the landlord's data, for which the landlord is controller and we are processor under the Data Processing Agreement.
- Accountants are granted read-only access limited to the landlord's financial records (such as income, expenses and mortgage figures) for the purpose of preparing the landlord's accounts and tax. They cannot see tenant contact details, messages or maintenance content.
Photographs and messages submitted through the tenant portal are stored in a private store and are accessible only to the landlord's organisation and the tenant who submitted them. Access is enforced at the database level with row-level isolation.
2. The personal data we collect
We collect and process the following categories of personal data:
| Data | What it includes | Purpose | Lawful basis |
|---|---|---|---|
| Account data | Your name, email address and organisation name. Your password is stored only as a secure hash by our authentication provider — we never see or store it in plain text. | To create and manage your account and provide the Service | Performance of a contract |
| Usage / technical data | Log data, device and browser information, and IP address | To operate, secure, troubleshoot and improve the Service | Legitimate interests (security and service improvement) |
| Billing data | Subscription and payment details. Card and payment data are handled by our payment processor (Stripe); we do not store full card numbers. | To take payment and manage your subscription | Performance of a contract; legal obligation (accounting) |
| Marketing data | Email address provided to receive our newsletter and free guides | To send you marketing emails you have asked for | Consent (individuals); legitimate interests (B2B) |
| Customer content | Data you input into the Service, which may include your tenants' personal data — and, where the tenant portal is used, content tenants submit themselves such as maintenance requests, uploaded photographs, messages and updated contact details | To provide the Service to you — we process this as your processor | Governed by the Data Processing Agreement |
| Portal login data | For tenants and accountants the landlord invites: the email address the login is bound to, plus sign-in, session and device information | To provide secure, role-appropriate access to the tenant and accountant portals | Legitimate interests (operating secure access) |
3. Lawful bases for processing
We rely on the following lawful bases under UK GDPR:
- Contract — to provide the Service you have signed up for, manage your account and take payment.
- Legitimate interests — to keep the Service secure, prevent fraud and abuse, improve and develop the Service, and carry out business-to-business marketing. Where we rely on legitimate interests, we balance our interests against your rights.
- Consent — to send email marketing to individuals. You can withdraw consent at any time.
- Legal obligation — to comply with our tax, accounting and other legal duties.
4. How we use your data
- Provide and secure the Service — set up and run your account, authenticate you, and keep the Service safe and available.
- Billing — manage your subscription, take payment and issue receipts and invoices.
- Support — respond to your questions and provide customer support.
- Product improvement — understand how the Service is used so we can fix problems and improve features.
- Marketing — send you our newsletter and free guides where you have consented (individuals) or where we have a legitimate interest (business contacts). Every marketing email includes an unsubscribe link.
- Legal compliance — meet our legal, tax and regulatory obligations and protect our legal rights.
5. Who we share it with (our processors and sub-processors)
We share personal data with carefully selected service providers who help us run the Service. They act on our instructions and under appropriate contracts. Our key providers are:
| Provider | Role | Location |
|---|---|---|
| Supabase | Primary database hosting | London, UK (eu-west-2) |
| Vercel | Application hosting | USA (under appropriate transfer safeguards) |
| Fasthosts | Marketing website hosting | UK |
| Stripe | Payment processing | USA / Ireland (under appropriate transfer safeguards) |
| Anthropic | AI provider powering the public assistant chat and our document-reading features. When you upload a document to be read automatically — a mortgage offer, an insurance schedule, or a compliance certificate (e.g. a gas, electrical or EPC certificate) — or send a message to the public assistant, that document or message is sent to Anthropic to extract or respond to its contents | USA (under appropriate transfer safeguards) |
| Google (Google Analytics 4) | Consent-based website analytics on our public marketing site (lettfolio.uk) to measure and improve how the site is used. Not used on the app, and not used for advertising | USA (under appropriate transfer safeguards) |
| Resend | Email delivery and marketing | USA (under appropriate transfer safeguards) |
We may also disclose personal data where required by law, regulation or legal process, or to protect our rights, property or safety. We never sell your personal data.
AI document reading
Some features let you upload a PDF — such as a mortgage offer, insurance schedule or compliance certificate — and have its key details read automatically to save you typing. When you use these features, the PDF is sent to our AI sub-processor (Anthropic) solely to extract those details, which are then returned to you to review and save. You are always shown that the document has been read by AI and asked to check the details before saving, and using the feature is optional — you can enter the information manually instead. The documents you upload are not used to train AI models. Where a document contains a third party's personal data (for example a tenant named on a certificate), you, as our customer, are the controller for that content and we act as your processor under the Data Processing Agreement.
6. International transfers
Our core data is stored in the UK. Where a provider (for example, Vercel) processes personal data outside the UK, we rely on safeguards recognised under UK GDPR — such as the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses — to ensure your data continues to receive an essentially equivalent level of protection.
7. How long we keep your data
- Account and customer content — kept while your account is active and for a reasonable period afterwards to allow for reactivation, dispute resolution and our legal and tax obligations.
- Billing data — retained for as long as required by accounting and tax law.
- Marketing data — kept until you unsubscribe or otherwise ask us to stop.
- Portal login data — kept while a tenant or accountant has active access to a landlord's account; revoked access and the associated login data are removed in line with the landlord's account, and pending invitations expire automatically after 14 days.
When data is no longer needed, we securely delete or anonymise it.
8. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you;
- Rectification of inaccurate or incomplete data;
- Erasure of your data in certain circumstances;
- Restriction of our processing in certain circumstances;
- Portability — to receive your data in a structured, commonly used format;
- Object to processing based on legitimate interests, and to direct marketing at any time;
- Withdraw consent at any time where we rely on consent.
To exercise any of these rights, email us at hello@lettfolio.uk.
If your request relates to tenant data (data a customer has entered about their tenants), we act only as a processor. We will pass your request to the relevant customer, who is the controller and is responsible for responding.
You also have the right to complain to the Information Commissioner's Office (ICO) if you are unhappy with how we handle your data. The ICO can be contacted at ico.org.uk. We would, however, appreciate the chance to address your concerns first.
9. Cookies
We use a limited set of cookies and similar technologies to operate the Service and understand how it is used. For details, please see our Cookie Policy.
10. Security
We take appropriate technical and organisational measures to protect personal data, including encryption in transit, database access controls with row-level isolation so each customer's data is kept separate, and restricted administrative access on a need-to-know basis. No system can be guaranteed completely secure, but we work to protect your data and to respond promptly to any incident.
11. Children
The Service is intended for landlords and is not directed at children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us so we can remove it.
12. Changes and how to contact us
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Please check this page periodically.
If you have any questions about this policy or how we handle your personal data, contact us at:
- Email: hello@lettfolio.uk
- Post: Lettfolio Ltd, Faulkner House, 31 West Street, Wimborne, Dorset, BH21 1JS