Privacy Policy

1. Who we are

RentClarity ("RentClarity", "we", "us", "our") provides an AI-assisted tool that reviews UK tenancy documents against renter-protection law. This policy explains what personal data we collect, why, how we use it, and the rights you have over it, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data controller: [PLACEHOLDER — registered company name, company number, and registered address once incorporated]. Until incorporation is complete, the data controller is the sole trader operating RentClarity, contactable at privacy@rentclarity.co.uk [PLACEHOLDER — confirm this mailbox exists and is monitored, or replace with your preferred contact address].

2. What data we collect

• Account data: email address, hashed password (we never store your password in plain text), and name, if you provide one.
• Tenancy check data: property address and tenancy type for each tenancy check you create.
• Uploaded documents: tenancy agreements, deposit protection certificates, EPCs, gas safety certificates, or other documents you upload as a PDF or pasted text, and the fields our AI extracts from them (rent amount, deposit amount, clause text, and similar). These documents often contain sensitive personal information — your name, address, financial details, and sometimes details about people you live with.
• Payment data: we do not directly store your card details. Payments are handled entirely by Stripe, our payment processor (see Section 5). We store the fact that a tenancy check has been paid for, and Stripe's internal reference IDs for your checkout session and subscription, so we can reconcile payments and manage your subscription.
• Technical data: your session is maintained via a single authentication cookie (see Section 6 — Cookies). We do not currently run analytics or advertising trackers.

3. How we use your data, and our legal basis

We do not use your data for marketing emails or sell it to third parties. If that changes in future, we will ask for your explicit consent first and update this policy.

4. How we use AI

When you upload a document or paste text, its content is sent to Anthropic (the maker of the Claude AI models) to extract relevant fields and, separately, to evaluate your uploaded documents against a fixed checklist of renter-protection law for your nation. This processing is automated, but the output is informational guidance for you to read and act on yourself — it is not a decision made about you, and no automated decision with legal or similarly significant effect on you is made without human involvement (you decide what to do with the results; we do not, for example, automatically reject or approve anything on your behalf).

AI-generated output can be wrong. See Section 9 and our Terms of Service for the full disclaimer — the results are general guidance, not legal advice.

5. Who we share your data with

We share personal data with the following processors, only as needed to run the service:

• Anthropic PBC (Claude AI) — processes the content of documents you upload to extract fields and evaluate them against the checklist. Anthropic is based in the United States; data sent to it may be processed outside the UK/EEA. [PLACEHOLDER — confirm the specific data processing terms and transfer safeguards (e.g. Standard Contractual Clauses) under your actual Anthropic account/API agreement].
• Stripe, Inc. / Stripe Payments UK Ltd — processes your payment details directly; we never see or store your full card number. Stripe may process data outside the UK/EEA under its own safeguards. See Stripe's privacy policy.
• Supabase — hosts our Postgres database (account, tenancy check, and document data), on infrastructure in the EU (eu-west-1/eu-west-2 region).
• Vercel Inc. — hosts and serves the RentClarity application itself.

We do not sell your data, and we do not share it with any other third party except where required by law (for example, a valid court order or regulatory request), or to protect our legal rights.

6. Cookies

We use a single cookie, called session, which is strictly necessary to keep you logged in. It is HTTP-only (inaccessible to JavaScript), marked secure in production, and expires after 30 days. Because it is strictly necessary for the service to function, it does not require consent under the UK Privacy and Electronic Communications Regulations (PECR). We do not currently use analytics, advertising, or third-party tracking cookies.

7. How long we keep your data

We retain your account, tenancy check, and document data for as long as your account is active, so you can keep referring back to past checks. If you ask us to delete your account (see Section 8), we will delete your personal data and uploaded documents within 30 days, except where we are required to retain certain records (e.g. payment/invoice records) for statutory accounting or tax purposes, which is typically 6 years under UK tax law.

[PLACEHOLDER / BUILD GAP] Account and document deletion is currently a manual process — there is no self-service "delete my account" button in the app yet. Requests must be actioned by emailing us. This should be built as an in-app feature before real volume goes through the service, both for user trust and to make erasure requests reliably actionable within the statutory timeframe.

8. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Ask us to delete your data ("right to be forgotten")
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time, where we rely on consent (we currently do not for any processing described in this policy)

To exercise any of these rights, email privacy@rentclarity.co.uk [PLACEHOLDER — confirm mailbox]. We will respond within one month, as required by law.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), if you believe we have mishandled your data.

9. Data security

Passwords are hashed (never stored in plain text). Your session is authenticated via a signed, HTTP-only cookie. Uploaded PDF documents are currently stored as encoded text within our database, which is standard practice for an early-stage service but is not equivalent to dedicated encrypted object storage; migrating to dedicated encrypted object storage (e.g. S3-compatible storage with server-side encryption) is a planned improvement as the service grows, given the sensitivity of tenancy documents.

10. Children

RentClarity is not intended for anyone under 18. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you (for example, by email or an in-app notice) before they take effect.

12. Contact us

Questions about this policy or your data: privacy@rentclarity.co.uk [PLACEHOLDER — confirm mailbox].