Privacy Policy

Last updated: 28 July 2026

1. Who we are

LetTrack Ltd is the data controller for personal data you provide when creating and using your account (your name, email, organisation and role). For personal data about tenants that a landlord or agency enters or uploads, LetTrack acts as that landlord/agency’s data processor under the UK GDPR, processing it on their documented instructions. The landlord or agency remains the controller of their tenants’ data and is responsible for informing their tenants about it (see section 6).

2. Data we collect

Account data: name, email, password hash, organisation name, role
Property data: addresses, compliance documents, inspection records
Tenant data (entered by a landlord/agent): name, email, phone, tenancy dates, rent and deposit amounts, rent-payment history, maintenance requests and reported issues
Right to Rent / immigration data: where a landlord records a statutory Right to Rent check — document type, number and expiry, Home Office share code and date of birth, and the check outcome. This is treated as special-category / high-sensitivity data (see section 4)
Identity / anti-money-laundering data: where an ID verification is recorded, an encrypted reference to the identity document
Tenant Passport data: where a tenant chooses to share one, a redacted “passport” summary of their rental identity and reliability (see section 6)
Usage data: log data, IP addresses, browser type (for security and analytics)

3. How we use your data

We use your data to: (a) provide the LetTrack service; (b) send transactional emails (e.g. invite links, compliance alerts); (c) improve the platform; (d) comply with our legal obligations. For tenant data, the purposes are set by the landlord/agency controller and are typically managing the tenancy (contract), meeting a legal obligation (Right to Rent, deposit protection, safety compliance), and their legitimate interests in managing their portfolio.

4. Right to Rent — immigration checks

Where a landlord or agency records a UK Right to Rent check, LetTrack stores immigration/identity data — including a Home Office share code and date of birth, and any document image — on their behalf. This is special-category / high-sensitivity data processed under the landlord’s statutory Right to Rent duty (Immigration Act 2014; Art. 9 UK GDPR condition: substantial public interest / a statutory scheme).

We apply heightened protections: the share code and date of birth are encrypted at rest; document images are held in a private store and served only via short-lived signed links; a recorded consent basis is required before a check can be stored; the records are immutable and audit-logged; this data is never used to train or run AI features; and it is not shown to tenants or to any other organisation. Right to Rent data is also never included in a Tenant Passport (section 6).

5. Arrears and rent-risk profiling

To help a landlord manage arrears, LetTrack may calculate a rent-risk indicator for a tenancy from its rent-payment history (for example, how often rent has been late). This is profiling under the UK GDPR, carried out in the landlord’s legitimate interests. It is advisory only: it does not make any automated decision that produces a legal or similarly significant effect about a tenant (there is no automatic eviction, referencing decision, or blacklisting), so Article 22 does not apply. A tenant can ask the landlord about, or object to, this profiling, and can ask us (as processor) to pass that request on.

6. Who can see your data — landlords, tenants and the Tenant Passport

Within an organisation: a landlord/agency’s staff can see the data for their own organisation’s properties and tenancies. Access is enforced at the database level; staff of one organisation cannot see another organisation’s data, and a tenant cannot see their landlord’s private records (such as ownership, internal notes or reports).

Tenants: an invited tenant sees their own tenancy — their rent and deposit status, the documents shared with them, and the issues they raise. They do not see Right to Rent or AML records.

Tenant Passport (optional): a tenant may choose to share a Tenant Passport — a redacted summary of their rental identity and reliability — with a third party, either via a share link/QR code they generate or by accepting an in-app request from another organisation. Sharing happens only with the tenant’s consent, the passport never contains Right to Rent or AML data, and the tenant (or their organisation) can revoke a share or turn the feature off, which stops existing links from resolving.

7. Business development & prospecting

To offer LetTrack to letting agencies and landlords who may benefit from it, we hold a small amount of business-contact information about prospective customers — company name and registration number, registered office, nature of business, a publicly filed officer name and role where needed to identify a contact, and public business contact details. We collect this only from public sources (the Companies House register, gov.uk, and the business’s own published website); we do not scrape closed platforms such as LinkedIn, and we never hold special-category data or the home/private contact details of the people who run a business.

Our lawful basis is legitimate interests (Art. 6(1)(f) UK GDPR) in business-to-business marketing. We keep a prospect record for a maximum of 12 months from the last meaningful engagement, then delete it. You can object at any time — for direct-marketing purposes that objection is absolute and we will stop and suppress immediately — and you can ask us to erase your information. Email privacy@lettrack.co.uk.

8. The free compliance check

Our free compliance check lets you self-assess your rental compliance without an account. You can complete it and see your score without giving us your email address. If you choose to enter one so we can email you the results, we store that address alongside your answers, your scores, and where you came from. We are the controller for this information — you are not anybody’s tenant here, you are a prospective customer of ours.

Our lawful basis for returning the results you asked for is legitimate interests (Art. 6(1)(f) UK GDPR). The separate “occasional landlord compliance tips” tick-box is consent, is unticked by default, and can be withdrawn at any time without affecting the results you requested. The check never asks for a document and never verifies one.

We keep a submission for 90 days, after which it expires; if you claim your result into a LetTrack account it becomes part of that account instead and follows the retention in section 10. You can ask us to erase it sooner, or object to the processing, at privacy@lettrack.co.uk.

9. Your rights

Under UK GDPR you have the right to: access your data, correct inaccurate data, erase your data (subject to legal retention obligations), restrict processing, portability, and to object to processing (including the profiling in section 5). Submit requests to privacy@lettrack.co.uk. If we hold your data as a processor for a landlord or agency, we will help route your request to them as the controller.

10. Data retention

Account data is retained for the duration of your subscription plus 30 days. Compliance documents — including Right to Rent records — may be retained for up to 6 years for legal compliance purposes. Audit logs are retained for 2 years. Business-development prospect records are retained for up to 12 months from the last meaningful engagement (see section 7).

11. Third parties

Supabase — database, authentication and file storage (hosted in the EU, AWS Ireland)
Vercel — application hosting
Resend — transactional email delivery
Stripe — payment processing
Sentry — error monitoring (anonymised where possible)
Google — “Sign in with Google” authentication (only if you choose it), and Google Analytics for website usage analytics (only if you accept analytics cookies)
Companies House — public company register, a source for business-development prospect information (see section 7)
Anthropic — AI model provider used to summarise public business information into a research brief (minimised business data only). Right to Rent and AML data are never sent to any AI provider (see section 4)

12. Security

All data is encrypted in transit (TLS) and at rest. Row-level security is enforced at the database level. Special-category Right to Rent data and AML identity references are additionally encrypted at the record level. Documents are served via time-limited signed URLs only.

13. Cookies

See our Cookie Policy.

14. Contact

Data protection queries: privacy@lettrack.co.uk · Data Protection Lead: contactable at dpo@lettrack.co.uk · ICO registration: in progress (number published once issued).