Privacy Notice — RentDocs.co.uk

This Privacy Notice explains how Rentdocs.co.uk ("we", "us", "our") collects, uses, shares and protects personal data when you use the RentDocs platform at rentdocs.co.uk (the "Service").

1. Who we are & our two roles

RentDocs.co.uk is operated by Private Shares Limited, a company registered in England and Wales (company number 08367665), whose registered office is 1 Billing Road, Northampton, NN1 5AL. You can contact us at hello@rentdocs.co.uk or via the contact form.

We handle personal data in two capacities and the rules are different depending on whose data is involved:

We are the controller of data about our landlord customers themselves — the account, billing, product-analytics and marketing data you generate as a RentDocs user. This Privacy Notice covers how we use that data.
We are the processor, acting on the landlord's instructions, for data about tenants, guarantors, occupiers and properties that a landlord enters into the Service. For that data the landlord is the controller. Tenants who want to exercise rights over their own data should contact their landlord first — see Data request. Our processor terms are set out in the Data Processing Addendum.

2. Personal data we collect

Account data (controller): name, email address, password (hashed), authentication tokens, profile data.
Landlord content (processor): property addresses, tenancy details, uploaded certificates and documents, notes.
Tenant contact data entered by landlords (processor): tenant name, phone number, email address.
Communications: messages sent through the platform, help requests, SMS and email delivery logs, tenant-portal access logs (timestamp, IP, browser).
Usage & device data (controller): IP address, browser type, pages visited, timestamps, cookies.
Billing data (Paddle as separate controller): subscription status and plan. Card details are handled by Paddle, not us.

3. Why we use your data (purposes & legal bases)

Provide the Service (contract): create your account, store documents, send reminders and packs.
Security & fraud prevention (legitimate interests): protect accounts and prevent abuse.
Customer support (contract / legitimate interests): respond to help requests.
Product improvement (legitimate interests): understand how the Service is used.
Legal compliance (legal obligation): tax records, responding to lawful requests.
Marketing (consent / legitimate interests): occasional product updates you can opt out of.

4. Who we share data with

We use a small number of third-party subprocessors to run the Service. The full, current list — with purpose, region and transfer safeguard — lives on our Subprocessors page. In summary:

Subprocessors: hosting (Cloudflare), database / authentication / storage (Supabase, UK/EU region), transactional email (Lovable email gateway), SMS (Twilio), analytics (Google Analytics 4, Meta Pixel), AI content generation (Google Gemini).
Paddle.com Market Ltd — our Merchant of Record for all subscriptions. Paddle processes payments, handles billing, tax compliance and invoicing as a separate controller for payment data.
Tenants named by landlords, who receive document packs and reminders the landlord initiates.
Professional advisers (legal, accounting) where necessary.
Authorities where required by law.

5. International transfers

Core landlord and tenant content is hosted in a UK/EU region. Some subprocessors (notably Cloudflare, Google and Meta) may process data outside the UK/EEA — including in the United States. Where they do, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an applicable adequacy regulation. The safeguard used for each provider is identified on the Subprocessors page.

6. Retention

We keep personal data only as long as we need it. Indicative retention periods:

Data	Retention
Account data (landlord)	Duration of account, then up to 12 months after closure.
Tenancy records, certificates, communications	Minimum 6 years after end of tenancy (dispute-resolution & letting compliance).
E-signature audit certificates	Retained for the life of the underlying tenancy record.
Tenant portal access logs	24 months rolling.
SMS & email delivery logs	24 months rolling.
Billing records (Paddle)	7 years (statutory).
Marketing preferences	Until you unsubscribe, then a suppression record indefinitely.
Support tickets	24 months after resolution.

When personal data is no longer needed it is deleted or anonymised. Where we act as processor, retention is ultimately directed by the landlord (controller), subject to their own legal obligations.

7. Your rights (UK GDPR)

You have the right to: access, rectify, erase, restrict processing, port, and object to processing of your personal data, and to withdraw consent where processing is based on consent. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk). We aim to respond to requests within one month. See Data request for how to submit one — including how tenants should route requests through their landlord where we act only as processor.

8. Security

We use appropriate technical and organisational measures including encryption in transit, access controls, hashed passwords, and role-based database policies. No system is 100% secure, but we work continuously to protect your data.

9. Cookies

We use essential cookies to keep you signed in and to operate the Service. We may use limited analytics cookies to understand aggregate usage. You can control cookies through your browser settings.

10. Changes to this notice

We may update this notice from time to time. Material changes will be notified in-app or by email.

11. Contact

Questions or requests? Email hello@rentdocs.co.uk, use the contact form, or (if signed in) the in-app Help form.