Privacy Policy

We act as the data controller for personal data about your own account — for example your email address and account settings.

When you enter personal data about other people — such as tenants, contractors, or clients — you are the data controller for that data and we act as your data processor, handling it on your instructions to provide the Service. You are responsible for having a lawful basis to collect and use that data and for providing the people concerned with any required privacy information.

We collect and process the following categories of data:

• Account and identity data — your email address, an encrypted (hashed) password held by our authentication provider, and your account and notification settings.
• Data you enter — property addresses and details, tenancy records, financial entries (income and expenses), compliance records, maintenance records, and the names and contact details of tenants, contractors, and clients.
• Files you upload — documents such as tenancy agreements, certificates, receipts, and property images.
• Technical data — essential session information, push-notification subscription details (if you enable them), and an audit log of key actions taken in your account for security and accountability.

• To provide, maintain, and operate the Service for you — performance of our contract with you.
• To send service and notification emails, including daily digests where enabled — our contract with you and your consent, which you can withdraw.
• To keep the Service secure, prevent abuse, and maintain audit records — our legitimate interests.
• To comply with our legal obligations — legal obligation.

We do not sell your personal data and we do not use it for advertising.

We use only essential cookies needed to keep you signed in and to operate the Service securely. We do not use advertising or third-party analytics or tracking cookies.

If you enable notifications, we send a periodic digest summarising items such as compliance deadlines, payments, and maintenance updates. You can turn these off at any time in your settings. We suppress digests for accounts that have been inactive for an extended period.

Some features use third-party AI service providers to help structure data you provide — for example, when importing a spreadsheet, the data in that file may be sent to an AI provider to map columns to the right fields. This data is processed only to deliver the feature you requested and is not used by us to make decisions with legal or similarly significant effects about any individual.

We share data with trusted service providers who process it on our behalf under contract, only as needed to run the Service. These providers fall into the following categories:

• hosting and database infrastructure (where your account data is stored);
• file and document storage;
• email delivery;
• background job and workflow processing;
• AI processing for the automated features described above.

We may also disclose data where required by law, to protect our rights, or in connection with a reorganisation or transfer of the Service.

Some of our service providers may process data outside the United Kingdom. Where they do, we rely on appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement, Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

We keep personal data for as long as your account is active and as needed to provide the Service. When you delete records, they may be archived for a short period before permanent deletion. When you close your account, we delete or anonymise your data within a reasonable period, except where we must retain it to comply with a legal obligation.

We use appropriate technical and organisational measures to protect personal data, including encryption of data in transit, access controls, hashed passwords, and direct, authorised uploads for files. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Under UK data protection law you have the right to access, correct, delete, or restrict the processing of your personal data, to object to certain processing, to data portability, and to withdraw consent where processing is based on consent. To exercise these rights for data we control, contact us at privacy@useplinth.co.uk.

If your request concerns personal data that a landlord or agent has entered about you (where they are the controller), please see the section below.

If you are a tenant, contractor, or client and your personal data was entered into Plinth by a landlord or letting agent, that landlord or agent is the data controller for your data. We process it only on their behalf. Please direct requests about your data to them; we will support them in responding. If you are unsure who to contact, email privacy@useplinth.co.uk and we will help where we can.

The Service is intended for use by adults and is not directed at children under 18. We do not knowingly collect personal data from children.

We may update this policy from time to time. If we make material changes, we will take reasonable steps to notify you. The “last updated” date at the top shows when it was last revised.

For privacy questions or to exercise your rights, contact privacy@useplinth.co.uk. If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.