Privacy Policy

Who we are

TenancyPack provides tenancy document packs that help landlords comply with the Renters' Rights Act 2025.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller for the personal data we collect through this service.

What data we collect

We collect and process the following categories of personal data:

• Account information: your email address and password (hashed) when you create an account.
• Landlord details: your name, correspondence address, email address, and phone number — used to pre-fill your tenancy documents.
• Tenant details: tenant names and email addresses — used to pre-fill tenancy documents on your behalf.
• Property details: property address, property type, number of bedrooms, furnishing status, and other tenancy-related information.
• Payment information: payments are processed securely by Stripe. We do not store your card number, CVV, or full payment details on our servers. We retain only a Stripe transaction reference for our records.

Why we collect it and our legal basis

We collect your personal data for the following purposes:

• To generate your document pack: we use the landlord, tenant, and property details you provide to pre-fill your tenancy documents.
• To process your payment: we pass necessary information to Stripe so you can pay for the service.
• To allow you to download your documents: we store generated documents so you can access and re-download them from your account.

Our legal basis for processing your personal data is contract performance (UK GDPR Article 6(1)(b)) — the processing is necessary to provide you with the service you have purchased or requested.

Who we share your data with

We share your personal data only with the third-party service providers necessary to operate our service:

• Stripe — payment processing. Stripe is PCI-DSS Level 1 certified and processes your card details directly. We never see or store your full card information.
• Supabase — database and authentication. Our database is hosted in the EU (Frankfurt).
• Vercel — website hosting and delivery.

We do not sell, rent, or trade your personal data to any third party.

International data transfers

Some of our service providers process data outside the UK. We ensure appropriate safeguards are in place for all international transfers:

• Vercel — hosting infrastructure located in the US. Transfers are protected by Standard Contractual Clauses (SCCs) under Vercel's Data Processing Agreement.
• Supabase — our database is hosted in the EU (Frankfurt, Germany). No transfer outside the UK/EEA is required for database operations.
• Stripe — payment processing with infrastructure in the US. Transfers are protected by Standard Contractual Clauses (SCCs) and Stripe's compliance with applicable data protection frameworks.

Tenant data

When you use TenancyPack to generate documents, you provide personal data about your tenants (names, email addresses). For the purposes of data protection law:

• You (the landlord) are the data controller for your tenants' personal data. You are responsible for ensuring you have a lawful basis to provide this data to us and for informing your tenants about how their data is used.
• TenancyPack is the data processor, processing tenant data on your behalf solely for the purpose of generating your document pack.

We do not use tenant data for any purpose other than generating your requested documents. Tenant data is subject to the same retention and deletion policies described in this policy.

How long we keep your data

• Account data: retained for as long as your account is active. If you request deletion of your account, we will delete your personal data within 30 days.
• Document packs: stored for 12 months from the date of generation, after which they are automatically deleted.
• Payment records: retained for 7 years as required by UK tax and accounting regulations.

Your rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct any inaccurate or incomplete personal data.
• Right to erasure: you can ask us to delete your personal data where there is no compelling reason for us to continue processing it.
• Right to data portability: you can request that we transfer your personal data to you or to another provider in a structured, commonly used format.
• Right to object: you can object to the processing of your personal data in certain circumstances.

To exercise any of these rights, please contact us at privacy@tenancypack.co.uk. We will respond to your request within one month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

Cookies

We use essential cookies for site operation and analytics cookies to understand how visitors use the site. These include:

• Supabase authentication cookies: used to keep you signed in to your account and maintain your session. These are first-party cookies that expire when your session ends or after a set period of inactivity.
• Google Analytics cookies: used to measure site usage patterns (for example, page views and navigation paths) so we can improve content and user experience.

We do not use advertising cookies.

Contact us

If you have any questions about this privacy policy or how we handle your personal data, please contact us at:

privacy@tenancypack.co.uk