Privacy Policy

Last updated: 15 July 2026

LettingsHQ

This Privacy Policy explains how LettingsHQ Software Ltd ("LettingsHQ", "we", "us", "our") collects, uses, stores and protects personal data when you use our website at lettingshq.com and our software service (together, the "Service").

We are committed to protecting personal data and handling it in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

LettingsHQ is a compliance-tracking tool for letting agents. The Service helps letting agencies keep track of certificates, deadlines, tenancy records and related regulatory obligations.

Data controller for our own business data:

LettingsHQ Software Ltd

Unit 82a, James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE

Company number: 17340908

ICO registration reference: ZC198981

Contact: privacy@lettingshq.com

Important — our role in relation to tenant and landlord data: When a letting agency uses the Service to store information about its landlords, tenants and properties, that agency is the data controller of that information and decides how it is used. LettingsHQ acts as a data processor, handling that data on the agency's behalf and under its instructions. Section 7 explains this in more detail.

2. The personal data we collect

a) Account data (we are the controller). When you sign up, we collect your name, email address, password (stored in encrypted form, never in plain text), and the name of your agency. If you subscribe, our payment provider collects your payment details (see Section 6) — we never see or store your full card number.

b) Data you enter about landlords, tenants and properties (the agency is the controller). This may include names, property addresses, tenancy dates, rent amounts, deposit details, certificate dates, maintenance records and uploaded documents such as gas or electrical safety certificates. You decide what to enter; the Service simply stores and organises it for you.

c) Usage and technical data. When you use the Service we automatically collect information such as your IP address, browser type, device information, pages viewed, actions taken within the app, and session activity. We use this to run, secure and improve the Service (see Section 5).

3. How we collect it

We collect personal data when you: create an account; enter information into the Service; upload documents; subscribe to a paid plan; contact us or send feedback; or simply use the Service (technical and usage data is collected automatically).

4. Why we use it and our lawful bases

  • What we use it for — Lawful basis
  • Creating and running your account — Performance of a contract
  • Providing the Service and its features — Performance of a contract
  • Sending compliance reminder emails — Performance of a contract
  • Taking payment for a subscription — Performance of a contract
  • Securing the Service and preventing fraud — Legitimate interests
  • Understanding and improving how the Service is used — Legitimate interests
  • Responding to your questions and feedback — Legitimate interests
  • Sending occasional service-related updates — Legitimate interests
  • Meeting our legal and regulatory obligations — Legal obligation

We do not sell your personal data, and we do not use it for advertising.

5. Analytics and session recording

We use PostHog, a product-analytics tool, to understand how the Service is used and to identify where users encounter difficulties. This includes session recording, which captures on-screen activity during your use of the app so we can diagnose problems and improve usability.

Because you may enter landlord and tenant information into the Service, session recordings can include that information. Password fields are automatically masked and are never recorded. We use these recordings only to operate and improve the Service, we restrict who can access them, and they are retained for a limited period. PostHog data is hosted in the European Union.

If you would prefer your sessions not to be recorded, contact us at privacy@lettingshq.com.

6. The providers we share data with

We use a small number of carefully chosen providers ("sub-processors") to run the Service. Each only receives the data needed to perform its function, and each is bound to protect it:

  • Provider — Purpose — Data location
  • Supabase — Database and file storage (accounts, property records, uploaded documents) — United Kingdom (London)
  • Vercel — Website and application hosting — Serves from the closest region; data at rest held with our database provider
  • Resend — Sending reminder and feedback emails — European Union
  • Stripe — Payment processing for subscriptions — Global; Stripe is certified for international data transfers
  • PostHog — Product analytics and session recording — European Union

We may also disclose personal data if required by law, court order, or a regulator, or to protect our legal rights.

We do not otherwise share, sell or rent personal data to third parties.

7. Data controller and processor responsibilities

For personal data about your landlords, tenants and properties, your agency is the data controller and LettingsHQ is the data processor. This means:

- You are responsible for having a lawful basis to collect and store that data, and for informing the individuals concerned as required by law.

- We process that data only to provide the Service, and only in line with your instructions and this Policy.

- We will not use that data for our own purposes (beyond operating, securing and improving the Service).

- If you ask us to delete or export the data, we will do so as described in Sections 9 and 10.

- We will assist you, so far as reasonably possible, in responding to requests from individuals exercising their data protection rights.

If you require a separate written data processing agreement, contact us at privacy@lettingshq.com.

8. International transfers

We aim to keep personal data within the UK and EU. Where a provider (such as Stripe) processes data outside the UK or EU, that provider is certified under recognised international transfer mechanisms (such as the UK's International Data Transfer Agreement or equivalent safeguards) to ensure your data receives an equivalent level of protection.

9. How long we keep it

- Account data: for as long as your account is active.

- Landlord, tenant and property data: for as long as your account is active. If you cancel, we retain it for up to 90 days to allow for reactivation or export, after which it is permanently deleted. You may request immediate deletion at any time.

- Usage and analytics data: retained for a limited period consistent with improving and securing the Service.

- Records we must keep by law (such as certain payment and tax records): retained for the period required by law.

10. Your rights

Under UK data protection law you have the right to: access your personal data; correct inaccurate data; request deletion; restrict or object to processing; data portability; and to withdraw consent where processing is based on consent.

Where LettingsHQ is the controller (your account data), you can exercise these rights by contacting us at privacy@lettingshq.com. Where your agency is the controller (landlord and tenant data), individuals should contact the agency directly, and we will support the agency in responding.

You can export your data from within the Service at any time using the built-in export tools.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would ask that you contact us first so we can try to resolve the matter.

11. How we protect data

We use appropriate technical and organisational measures to protect personal data, including: encryption of data in transit; database-level access controls that ensure each agency can only access its own data; encrypted storage of passwords; access to uploaded documents only via secure, time-limited links; and restricting internal access to what is necessary.

No system is completely secure, but we take the security of personal data seriously and keep our measures under review.

12. Cookies

The Service uses a small number of essential cookies to keep you signed in and to keep the Service secure, and analytics cookies (via PostHog) to understand usage. Essential cookies are necessary for the Service to function. You can control non-essential cookies through your browser settings.

13. Children

The Service is for use by letting agency businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18 as a user of the Service.

14. Changes to this Policy

We may update this Policy from time to time. If we make significant changes we will notify you by email or through the Service. The "Last updated" date at the top shows when it was last revised.

15. Contact us

For any questions about this Policy or about how we handle personal data:

Email: privacy@lettingshq.com

Post: LettingsHQ Software Ltd, Unit 82a, James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE