Privacy Policy

Privacy Policy — The Trusted Landlord

---

1. Who We Are

The Trusted Landlord is operated by Vallnor Alliance Ltd, a company registered in England and Wales.

Data controller:
Vallnor Alliance Ltd
Suite 1, Concept House, 23 Billet Lane, Hornchurch, Essex, RM11 1XP
Company number: 15383148
Email: hello@thetrustedlandlord.co.uk
ICO Registration number: Registration pending

---

2. What Personal Data We Collect and Why

We collect personal data only where we have a lawful basis to do so under UK GDPR.

Account and profile data

• Full name, email address, password (hashed — never stored in plain text)
• Property addresses, financial details (rent, mortgage, insurance), compliance document dates
• Onboarding responses (expat status, salary, tax residency)

Lawful basis: Contract (Article 6(1)(b)) — necessary to provide the service you have signed up for.

Payment data

• Subscription status, billing cycle, payment history
• We do not store card numbers or payment details directly. Stripe processes and stores all payment data on our behalf. We store only the Stripe customer ID and subscription ID as references.

Lawful basis: Contract (Article 6(1)(b)) and Legitimate interests (Article 6(1)(f)) for fraud prevention.

Usage and analytics data

• Pages visited, features used, events triggered within the app (e.g. properties added, documents uploaded)
• This data is linked to your account. We use it to operate, secure and improve the service, and we report on it in aggregate. Aggregated figures that cannot identify you are not personal data.

Lawful basis: Legitimate interests (Article 6(1)(f)) — to operate and improve the service.

Campaign attribution data (UTM parameters)

• If you arrive at The Trusted Landlord via a marketing link, we may capture campaign parameters (utm_source, utm_medium, utm_campaign) from the URL.
• This data is stored in your browser's session storage (not a persistent cookie) and, on sign-up, attached to your account to help us understand which marketing campaigns are effective.

Lawful basis: Legitimate interests (Article 6(1)(f)).

Information about your tenants and letting agents

• When you record a tenancy or a managing agent, we store the details you enter. This can include a tenant's name and tenancy dates, and an agent's company, contact name and contract terms.
• This information is about other people, not about you. You provide it to us so that we can deliver the service to you, and you remain responsible for having a proper basis to share it with us. We do not contact your tenants or agents, and we do not use their details for marketing.
• If a tenant or agent asks us what we hold about them, we will help you respond, and we will tell them how to contact you as the person who provided it.

Lawful basis: Legitimate interests (Article 6(1)(f)) — to provide portfolio management to you, balanced against the interests of the individuals concerned.

Financial transaction records

• Income and expenditure you record against your properties, including amounts, dates, categories, descriptions, the tax year, and who a payment was made to or received from.
• Where a payee is a named individual, that is personal data about them and the section above applies.

Lawful basis: Contract (Article 6(1)(b)).

Data we derive about your portfolio

• We calculate figures from the data you enter rather than collecting them directly — for example cashflow and yield, estimated property values, energy-performance information for your properties, portfolio health scores, and activity summaries.
• These are our own calculations and estimates. They are not statements of fact, they may be wrong, and no decision producing a legal or similarly significant effect on you is made solely by automated means.

Lawful basis: Contract (Article 6(1)(b)) and Legitimate interests (Article 6(1)(f)) — to provide and improve the analysis the service exists to give you.

Support requests and fault reports

• When you report a bug or contact support, we store what you send us. A report submitted from inside the app may include a technical snapshot — recent error messages and network activity from your browser session — to help us reproduce the fault.
• These snapshots are for diagnosis. We do not use them for any other purpose.

Lawful basis: Legitimate interests (Article 6(1)(f)) — to investigate and fix faults.

Service operation data

• Records needed to run your account: reminders and notifications we have generated for you, any API keys you create, saved searches, and your acceptance of these policies including the date, version and IP address.

Lawful basis: Contract (Article 6(1)(b)) and Legal obligation (Article 6(1)(c)) for records of consent and acceptance.

AI conversation data (Alma — when deployed)

• When you use Alma, our AI assistant, the content of your conversation is used to generate a response and is then deleted. Conversations are not stored persistently unless one of the exceptions below applies.
• Complaint handling: If a conversation is associated with a formal complaint you have raised, it may be retained for up to 12 months to support resolution and record-keeping.
• Bug reports: If a conversation is flagged as evidence of a technical fault or submitted as a bug report, it may be retained for up to 12 months for quality improvement purposes.
• In all other cases, conversation content is not retained after the session ends. Alma's responses are generated via Anthropic's API; data shared with Anthropic is governed by their data processing terms.

Lawful basis: Contract (Article 6(1)(b)) for service delivery; Legitimate interests (Article 6(1)(f)) for complaint handling and quality improvement.

---

Categories, not an exhaustive list

The categories above describe the personal data we hold and why we hold it. Where delivering the service to you requires us to process information that does not fall neatly within one of them, we will do so only where that processing is necessary for that purpose and is covered by one of the lawful bases set out above. Where it happens, we will update this policy to name it and tell you in the way described in section 8.

We will not use your data for a new and unrelated purpose without telling you first and, where the law requires it, asking your permission.

---

3. Third-Party Data Processors

We share personal data with the following third-party processors. All processors are required to handle your data in accordance with UK GDPR.

Stripe

Purpose: Payment processing, subscription management.
Data shared: Name, email, payment card details, billing address, subscription status.
Location: United States (adequacy decision / Standard Contractual Clauses apply).
DPA status: Stripe's Data Processing Agreement is incorporated into their Terms of Service.

Sequenzy

Purpose: CRM and email automation — we use Sequenzy to send you transactional emails (e.g. trial reminders, payment confirmations) and lifecycle communications.
Data shared: Name, email, subscription status, lifecycle stage, property count, account activity.
Location: EU (location to be confirmed on DPA execution)
DPA status: A Data Processing Agreement must be executed with Sequenzy before any user data is transmitted. This is a hard legal requirement. Status: pending.

Google Analytics (GA4) — when enabled

Purpose: Website and app analytics — understanding how users interact with the service.
Data shared: Anonymised usage events, device type, browser, approximate location.
Location: United States (adequacy decision / Standard Contractual Clauses apply).
DPA status: Google's Data Processing Agreement is incorporated into their Terms of Service.
Consent required: Google Analytics is only activated after you grant analytical cookie consent.

Supabase

Purpose: Database hosting and authentication infrastructure.
Data shared: All personal data stored in the app.
Location: Canada (ca-central-1).
DPA status: Data processed under EU Standard Contractual Clauses.

Anthropic (Claude AI) — when Alma is deployed

Purpose: AI response generation for the Alma assistant.
Data shared: Your questions and context sent to Alma (may include property and financial details).
Location: United States.
DPA status: Confirm Anthropic's DPA and data retention policy before Alma goes live.

---

4. How Long We Keep Your Data

---

5. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of all personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data (subject to legal retention obligations — see Section 4)
• Right to restrict processing — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent (e.g. marketing cookies), you can withdraw at any time

To exercise any of these rights, email hello@thetrustedlandlord.co.uk with the subject line "Data Subject Request". We will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

---

6. Cookies and Tracking

We use cookies and similar technologies on The Trusted Landlord. Cookies are small text files stored on your device.

Essential cookies

Required for the app to function. These cannot be disabled.

Set by The Trusted Landlord / Supabase (authentication):

• sb-[ref]-auth-token — stores your login session so you stay signed in; expires when you sign out or after inactivity. Set by Supabase Auth.
• sb-[ref]-auth-token.0, sb-[ref]-auth-token.1 — chunked session data where session size requires splitting. Same expiry as above.

Set by Stripe (payment security):

• __stripe_mid — device fingerprint used by Stripe for fraud prevention on payment pages. Persistent, expires after approximately 1 year. Set by Stripe, Inc.
• __stripe_sid — session identifier used by Stripe for fraud detection. Session cookie, expires when you close your browser. Set by Stripe, Inc.

These cookies are strictly necessary for authentication and secure payment processing to function. They are set by trusted third-party processors (Supabase and Stripe) and cannot be disabled without breaking core service functionality.

Analytical cookies

Used to understand how you use the app, helping us improve it. Only set after you grant consent.

• _ga, _ga_[ID] — Google Analytics 4 cookies used to distinguish users and sessions for anonymised usage tracking. Persistent, expire after 2 years / 24 hours respectively. Set by Google LLC.

Marketing cookies

Used to measure the effectiveness of advertising campaigns. Only set after you grant consent.

• _fbp — Meta Pixel cookie used to identify browsers for Meta (Facebook/Instagram) advertising attribution. Persistent, expires after approximately 90 days. Set by Meta Platforms, Inc.
• _gcl_au — Google Ads cookie used for conversion measurement when Google Ads campaigns are active. Persistent, expires after approximately 90 days. Set by Google LLC.

You can manage your cookie preferences at any time using the cookie settings link in the footer. Withdrawing consent will stop new analytical and marketing cookies being set. It will not remove cookies already stored on your device — you can clear these via your browser settings. Essential cookies cannot be disabled as they are required for the service to function.

---

7. Data Security

We take reasonable technical and organisational measures to protect your personal data, including:

• Encryption at rest and in transit (HTTPS/TLS)
• Passwords hashed using industry-standard algorithms (Supabase Auth handles this)
• Row-level security on all database tables — users can only access their own data
• Access to production systems restricted to authorised personnel only

---

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the app and/or email before the changes take effect. Your continued use of The Trusted Landlord after the effective date constitutes acceptance of the revised policy.

The current version of this policy is always available at thetrustedlandlord.co.uk/legal/privacy, and shows its version number and effective date. If you would like a copy of a previous version, email hello@thetrustedlandlord.co.uk and we will provide one.

---

9. Contact Us

For any questions about this Privacy Policy or to exercise your data rights:

Email: hello@thetrustedlandlord.co.uk
Post: Vallnor Alliance Ltd, Suite 1, Concept House, 23 Billet Lane, Hornchurch, Essex, RM11 1XP