Privacy Policy

This Privacy Policy explains how HomePortfolio Ltd (“HomePortfolio”, “we”, “us” or “our”) collects, uses, shares and protects personal data when you visit our website, create an account, subscribe to a paid plan, or otherwise use our property-intelligence service (the “Service”). We are committed to handling your personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

HomePortfolio aggregates and analyses property information drawn from publicly available UK sources. The Service is about properties, not people: it is not a credit-checking, tenant-screening, people-search or background-check service, and we do not assemble profiles of individuals. Where property records incidentally relate to an identifiable person, we handle that data as described in the “Property data and individuals” section below.

1. Data controller and contact details

HomePortfolio Ltd is the data controller for the personal data described in this policy. If you have any questions about this policy or wish to exercise your data-protection rights, you can contact us at [email protected].

If we appoint a dedicated data protection contact or representative in the future, we will update this section with their details.

2. The personal data we collect

We aim to collect only what we need to provide and improve the Service. The categories of personal data we process are:

• Account and authentication data. When you create an account, we collect your email address and authentication credentials. Authentication is handled on our behalf by Supabase, which manages sign-up, sign-in and session tokens. We do not store your password in plain text; it is hashed and managed by our authentication provider.
• Payment and subscription data. Paid plans are processed by Stripe. When you subscribe, Stripe collects and processes your card or payment details directly. HomePortfolio does not store your full card number, CVC or bank-account details. We receive and retain limited billing metadata from Stripe, such as a customer and subscription identifier, plan, billing status, the last four digits and brand of your card, and invoice history, so that we can manage your subscription and provide support.
• Usage and analytics data. We use PostHog to understand how the Service is used so that we can improve it. This may include pages and features viewed, actions taken, device and browser type, approximate location derived from IP address, and event timestamps. Where required, this is governed by your cookie preferences (see our Cookie Policy).
• Communications data. If you contact us by email or sign up for product updates, we process the contents of your message and your contact details. Transactional and update emails are delivered through Resend.
• Technical and server-log data. Our hosting and application infrastructure automatically records technical information such as IP address, request URLs, user-agent strings, referrer and timestamps. We use these logs to operate the Service, investigate errors, prevent abuse and maintain security.
• Search and property-query data. When you search for or view a property, we may process the search terms and property identifiers you submit, linked to your account where you are signed in, to deliver results, power AI features and improve relevance.

We do not intentionally collect special category data (such as data about health, ethnicity or political opinions), and we ask that you do not submit such data to us.

3. Lawful bases for processing

Under UK GDPR we must have a lawful basis for each processing activity. We rely on the following:

• Contract (Article 6(1)(b)). To create and administer your account, authenticate you, provide the Service, and process subscriptions and payments under our Terms of Service.
• Legitimate interests (Article 6(1)(f)). To operate, secure, debug and improve the Service, prevent fraud and abuse, understand product usage in aggregate, and communicate with you about the Service. Where we rely on legitimate interests, we balance them against your rights and freedoms, and you may object (see “Your rights”).
• Consent (Article 6(1)(a)). For non-essential analytics cookies and optional marketing communications. You can withdraw consent at any time, for example through your cookie settings or by unsubscribing.
• Legal obligation (Article 6(1)(c)). To comply with applicable laws, including tax, accounting and record-keeping requirements, and to respond to lawful requests from authorities.

4. Property data and individuals

HomePortfolio surfaces property intelligence compiled from publicly available UK datasets, including (among others) HM Land Registry price-paid and ownership records, Energy Performance Certificate (EPC) data, planning-application records, Office for National Statistics (ONS) area statistics, and police.uk crime data.

These datasets are organised around properties and geographic areas, not around individuals. Some public records (for example, certain ownership or planning records) may contain or imply information that relates to an identifiable person. Where that is the case, we process such data on the basis of our legitimate interest in providing a transparent property-intelligence service built on public-record data, and we do not enrich, combine or re-purpose it to profile, score or screen individuals.

If you believe a property record displayed by the Service relates to you and you wish to exercise your rights in respect of it, contact us at [email protected] and we will respond as described below. Note that some source records are maintained by the originating public bodies, and the authoritative correction may need to be made at source.

5. Cookies and similar technologies

We use cookies and similar technologies for essential functions (such as keeping you signed in) and, subject to your preferences, for analytics. We do not use advertising or cross-site tracking cookies. For full details of the cookies we use, their purposes and durations, and how to control them, please see our Cookie Policy.

6. Third-party processors and recipients

We share personal data with carefully selected service providers who process it on our behalf under written data-processing terms. We do not sell your personal data. Our key processors are:

• Supabase — authentication, session management and account data storage.
• Stripe — payment processing and subscription management.
• PostHog — product analytics and usage measurement.
• Resend — delivery of transactional and update emails.
• Hosting and infrastructure providers — to host the application, serve content, and store server logs.

We may also disclose personal data where required to comply with the law, enforce our Terms of Service, protect the rights, property or safety of HomePortfolio, our users or others, or in connection with a corporate transaction such as a merger, acquisition or sale of assets (in which case we will require the recipient to honour this policy).

7. International transfers

Some of our processors may store or process personal data outside the United Kingdom. Where personal data is transferred to a country that is not covered by UK adequacy regulations, we put in place appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures required to protect your data. You may contact us for more information about the safeguards we use.

8. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy:

• Account data is retained while your account is active and for a reasonable period afterwards to handle reactivation, support and our legal obligations, after which it is deleted or anonymised.
• Billing and transaction records are retained for the period required by tax and accounting law (generally up to six years).
• Analytics and server-log data are retained for a limited period sufficient for security, debugging and product analysis, and are then deleted or aggregated.

When you delete your account, we will delete or anonymise your personal data except where we are required to retain it by law or have an overriding legitimate ground to keep it.

9. Your rights

Subject to the conditions and exemptions in UK data-protection law, you have the right to:

• Access the personal data we hold about you and obtain a copy of it.
• Rectify inaccurate or incomplete personal data.
• Erase your personal data in certain circumstances (the “right to be forgotten”).
• Restrict our processing of your personal data in certain circumstances.
• Data portability — receive certain personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
• Object to processing based on our legitimate interests and to direct marketing.
• Withdraw consent at any time where we rely on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email [email protected]. We may need to verify your identity before responding, and we will respond within the timeframes required by law (normally one month). There is usually no charge, although we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive.

10. Complaints to the ICO

If you have a concern about how we handle your personal data, we would encourage you to contact us first so we can try to resolve it. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO). You can reach the ICO at ico.org.uk or on their helpline 0303 123 1113.

11. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These include encryption of data in transit (HTTPS), delegating authentication and payment handling to specialist providers (Supabase and Stripe), access controls, and restricting access to personal data to those who need it. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident.

12. Children

The Service is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us at [email protected] and we will take appropriate steps to delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or the Service. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you by email or through the Service. We encourage you to review this page periodically.

14. Contact us

For any privacy questions or requests, contact us at [email protected].