Data Deletion Policy

# Data Deletion and Retention Policy — The Good Landlord

**Version:** 1.0
**Last updated:** 13 May 2026
**Effective date:** 17 May 2026
**Changelog:** Initial version.

---

## 1. What Data We Hold About You

When you use The Good Landlord, we hold the following categories of personal data:

| Category | Examples |
|---|---|
| Account identity | Name, email address, hashed password |
| Profile data | Expat status, salary, tax residency |
| Property data | Addresses, tenure type, purchase date |
| Tenancy records | Rent amounts, start/end dates, rental type |
| Mortgage records | Lender, balance, interest rate, term dates |
| Insurance records | Provider, cover type, renewal dates |
| Compliance records | Gas safety, EPC, EICR certificate dates |
| Agent records | Agent company, fees, contract dates |
| Financial records | Running costs, cashflow entries |
| Documents | Uploaded PDFs and files |
| Payment records | Stripe subscription and invoice history |
| CRM records | Lifecycle stage, subscription history, email engagement |
| AI conversation data | Alma session content (when Alma is deployed) |
| Analytics data | Anonymised usage events, page views |
| Campaign data | UTM attribution parameters from ad clicks |

---

## 2. Your Right to Erasure (UK GDPR Article 17)

Under UK GDPR, you have the right to request erasure of your personal data. You can exercise this right in two ways:

1. **Self-service account deletion** — via Account Settings → Delete My Account. This is immediate and permanent.
2. **Manual request** — email hello@goodlandlord.co.uk with the subject line "Account Deletion Request". We will complete deletion within 30 days.

---

## 3. What Happens When You Delete Your Account

When you initiate account deletion, the following steps occur automatically:

### Immediately
- Your login session is revoked and you are signed out
- Your access to the service ceases

### Within 30 days
The following data is permanently deleted or anonymised:
- Your name, email address, and hashed password (authentication credentials)
- All property records, tenancy records, mortgage records, insurance records, compliance records, agent records, running costs, and financial entries
- All uploaded documents (files removed from storage)
- Your CRM profile and all CRM event records
- Your Sequenzy contact record (once the Sequenzy integration is live)
- Alma AI conversation data, unless retained under the exceptions below (when Alma is deployed)
- Campaign attribution data (UTM parameters)

A confirmation email is sent to your registered email address before deletion is executed.

### Data that may be retained beyond deletion
The following data may be retained for the period stated, even after account deletion. Where data is retained, it will be isolated, access-restricted, and flagged for deletion at the end of the retention period.

| Data type | Retention period | Reason |
|---|---|---|
| Payment transaction records | 7 years from transaction date | HMRC business record-keeping obligation (standard guidance) |
| Anonymised analytics | Up to 26 months | Retained in anonymised, non-personal form only |
| Email delivery logs | Up to 12 months | Required for deliverability compliance and spam complaint records |
| Alma conversation data (complaints) | Up to 12 months from conversation date | Retained only where the conversation was associated with a formal complaint you raised |
| Alma conversation data (bug reports) | Up to 12 months from conversation date | Retained only where the conversation was submitted as a bug report or technical fault record |

---

## 4. Active Subscription on Deletion

If you have an active paid subscription at the time of account deletion:
- Your subscription is cancelled with Stripe immediately
- Refunds on account deletion follow the same policy as cancellation refunds set out in the Terms of Service: the 14-day statutory cooling-off right applies where relevant; beyond that, our goodwill refund commitment (last monthly payment or pro-rata annual refund) applies where requested within 30 days of the last payment
- Stripe retains transaction history in accordance with its own data retention policies

---

## 5. Data We Cannot Delete

In limited circumstances, we may be unable to delete certain data immediately due to:
- A legal obligation to retain it (e.g. HMRC record-keeping)
- An ongoing legal dispute or regulatory investigation in which the data is relevant

Where this applies, we will inform you clearly at the time of your deletion request, explain what is being retained and why, and confirm when it will be deleted.

---

## 6. Third-Party Data Processors on Deletion

Deletion of your account triggers deletion requests to our third-party processors where technically possible:

| Processor | Deletion action |
|---|---|
| Stripe | Stripe retains payment transaction records in accordance with their own data retention policy and legal obligations. This is a standard and disclosed arrangement — Stripe's role as a data processor and their independent record-keeping obligations are set out in our Privacy Policy and Terms of Service. If you wish to request deletion of records held directly by Stripe, you may contact Stripe at stripe.com/privacy. |
| Sequenzy | Your Sequenzy contact record is deleted as part of the account deletion flow (once the Sequenzy DPA is executed and the integration is live). |
| Google Analytics | Analytics data is anonymised and cannot be linked back to you after account deletion. Historical anonymised data is retained per Google's retention settings (max 26 months). |
| Supabase | All data held in our Supabase database is deleted as described above. |

---

## 7. Data Retention for Non-Deleted Accounts

For active accounts, we retain your data for as long as you have an account with us and for the periods described in Section 3 after deletion.

We do not retain data beyond what is necessary for the purposes for which it was collected.

---

## 8. Contact

To exercise your right to erasure or for any questions about data retention:

**Email:** hello@goodlandlord.co.uk
Use subject line: "Account Deletion Request" or "Data Retention Query"
**Post:** Vallnor Alliance Ltd, Suite 1, Concept House, 23 Billet Lane, Hornchurch, Essex, RM11 1XP

We will acknowledge your request within 5 working days and complete it within 30 days.

If you are dissatisfied with our response, you have the right to complain to the ICO at ico.org.uk.