Privacy Policy

1.1 Account information. When you create an account, we collect your name, email address, phone number, and, optionally, a profile photo. Authentication is handled by AWS Cognito. You can also sign in with a Google account; choosing that option means we receive basic profile information from Google (such as your name, email address, and profile picture), and this Privacy Policy applies to that information the same way it applies to the rest of your account. Your account role (Tenant, Manager, Cleaner, or Handyman) determines which of the categories below also apply to you.

1.2 Identity verification (Tenants). To verify your identity for rental applications, we require you to upload a government-issued ID or passport (image or PDF). This document is stored in a private, access-restricted file storage bucket, kept separate from the bucket used for property photos, and is only visible to authorized staff reviewing your verification — we do not use a third-party identity-verification service. We record the verification status (pending, approved, or rejected), any review notes, and who reviewed it and when.

1.3 Property listings (Managers). If you list a property, we collect the address, description, price, photos, and amenities you provide, along with the resulting location coordinates (via Mapbox) used to place the listing on the map.

1.4 Applications & leases. When you apply for a property, we collect your application details (contact information, desired move-in date, lease term, and any message to the manager). If your application is approved, we create a lease record with the rent, deposit, and lease term.

The Tenant then reviews a summary of the tenancy agreement and signs it online by typing their full name. When you sign, we record the name you typed, the date and time, the IP address your request came from, and a cryptographic fingerprint (a hash) of the exact agreement text you were shown. We keep this as evidence of what was agreed and when. The property's Manager can see the signed agreement, including the name you typed and the signing date, and both the Tenant and the Manager can download it as a PDF.

1.5 Payments. Rent payments are collected by Direct Debit through Stripe's own secure, hosted checkout page, under the Bacs Direct Debit scheme — we never see or store your UK bank account number or sort code; Stripe collects and holds those directly. After a payment, we store only a reference to it (such as the last 4 digits of the account) together with the amount and date, so you and your manager can see payment history and receipts.

1.6 Service requests. Tenants can submit cleaning or maintenance requests, which include a description, requested date, and, for cleaning, the type of service. Cleaners and Handymen see the requests assigned to them so they can complete the job.

1.7 Messages. The Platform includes in-app messaging between users (for example, between a Tenant and a Manager). We store message content so conversations can be retrieved later by their participants.

1.8 Location data. We use property addresses to display listings on a map and to power address search and autocomplete. This concerns the properties themselves, not your device's location — we do not track your GPS location.

1.9 Cookies. To keep you signed in, our authentication provider (AWS Cognito) keeps your sign-in tokens in your browser's local storage, and our own servers set one cookie once you have signed in. We also use small preference cookies that remember whether you last viewed listings as a grid or a list and whether you collapsed the dashboard sidebar. See Section 6 ("Cookies and Do-Not-Track") for more detail.

1.10 Payout accounts (Managers). If you connect a property to receive rent payouts directly, you go through Stripe's own onboarding process (Stripe Connect), where Stripe collects your identity and bank account details directly on its own hosted pages. We never see or store that information — we only store Stripe's account identifier for the property and whether onboarding is complete, so we know where to route payouts and whether payment collection is available for that property.

1.11 Email notifications. We use the email address on your account to send you an email copy of each notification that appears in your dashboard, such as application decisions, rent due dates and payment updates, service request updates, and lease changes. These are service messages about your account and activity, not marketing. Each email contains the same title and text as the notification, with a link back to the Platform. You can switch off the email copies of messages, viewings, service requests and new applications in your account settings; notices about rent, payments, leases, identity checks and application decisions are always emailed. We do not email deactivated accounts. Emails are sent through our email delivery provider (see Section 4) and then travel across the internet to your own email provider, so they are not as secure as the Platform itself.

• To create and manage your account, authenticate you, and verify your identity
• To operate the Platform's core features: listing properties, submitting and reviewing applications, managing leases, processing rent payments, and handling service requests
• To let you communicate with other users through in-app messaging
• To send you notifications, in the Platform and by email (e.g., application status, payment due dates, service request updates)
• To record your agreement to a tenancy agreement and keep evidence of what was agreed, when, and by whom
• To keep the Platform secure and prevent fraud or abuse, including rate-limiting sensitive actions such as manager invitations and identity document uploads
• To comply with legal obligations, or to protect the rights, safety, or property of our users, ourselves, or the public

Where the UK GDPR or the EU GDPR applies to you, we only process your personal information when we have a valid legal basis to do so:

• Consent — for optional features, such as signing in with Google. You can withdraw consent at any time (Section 11) without affecting the lawfulness of processing carried out beforehand.
• Performance of a contract — to provide the Platform's services once you create an account as a Tenant, Manager, Cleaner, or Handyman.
• Legitimate interests — to keep the Platform secure, prevent fraud and abuse, keep evidence of agreements made on the Platform (such as tenancy agreement signatures), and improve our services, balanced against your rights and freedoms.
• Legal obligation — where processing is necessary to comply with applicable law.
• Vital interests — in the rare case it is necessary to protect someone's safety.

We share information only as needed to operate the Platform:

• With other users, where the Platform's function requires it — for example, a Manager sees the applications and identity-verification status for their properties, and a Cleaner or Handyman sees the service requests assigned to them.
• With service providers who process data on our behalf: AWS (Cognito for sign-in, and S3 for storing property photos and identity documents in separate, access-restricted buckets), Stripe (rent payment collection and, for Managers who connect a property, payout account onboarding and identity verification under Stripe Connect), Resend (delivery of notification emails, which involves your email address and the text of the notification), Mapbox (maps and address lookup), and, for users who choose to sign in with Google, Google itself.
• In a business transfer — if we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction.
• When required by law, or to protect the rights, safety, or property of our users or the Platform.

We do not sell your personal information, and we do not share it with third parties for their own advertising purposes.

Some of our service providers (including AWS, Stripe, Resend, Mapbox, and Google) may process personal information outside the UK, including in the United States. Where this happens, we rely on safeguards recognised under UK data protection law — such as the UK International Data Transfer Agreement, Standard Contractual Clauses as adopted for UK transfers, or a provider's participation in an approved data protection framework — to help ensure your information continues to receive an appropriate level of protection.

To keep you signed in, AWS Cognito keeps your sign-in tokens in your browser's local storage, and our own servers set a session cookie once you have signed in. Our session cookie is marked HttpOnly, so scripts running on the page cannot read it, and it lasts up to one hour, being renewed while you stay signed in. We also use small preference cookies that remember whether you last viewed listings as a grid or a list and whether you collapsed the dashboard sidebar. We do not use advertising or analytics cookies, and we do not permit third parties to place tracking cookies on the Platform for their own purposes.

Most browsers let you block or delete cookies; doing so may prevent you from staying signed in or keep your view preference from being remembered.

Our Cookie Policy lists every cookie and browser storage key we use, what each one does and how long it lasts.

No uniform standard for "Do Not Track" browser signals has been adopted yet, so we do not currently respond to them. If that changes, we will update this section.

We keep your information for as long as your account is active and as needed to provide the Platform's services (e.g., lease and payment history). This includes the signature record for a tenancy agreement (Section 1.4), which we keep with the lease it belongs to so that it can be produced if there is a dispute. Identity documents are retained for as long as needed for verification and any related dispute, and remain accessible only to authorized staff throughout that time. If an identity document is uploaded but never linked to a completed account — for example, a signup that is abandoned partway through — we automatically delete it after 48 hours. If you deactivate your account, we keep it for 30 days in case you want it back; after that, your personal information (name, contact details, profile photo, identity document, messages and notifications) is automatically deleted or anonymized and your login is removed. If your account has tenancy or property records (leases, payments), those records are kept for six years after deactivation for legal, accounting and dispute-resolution purposes, and your personal information is deleted or anonymized at the end of that period.

We use industry-standard safeguards to protect your information, including encrypted connections (HTTPS), access-restricted storage for identity documents kept separate from other files, and Stripe's PCI-compliant payment processing. No method of storage or transmission is 100% secure, but we work to protect your information appropriately.

The Platform is not directed to children under 18, and we do not knowingly collect personal information from them. By using the Platform, you represent that you are at least 18 years old. If we learn that we have collected personal information from someone under 18, we will delete it and deactivate the associated account.

Depending on where you live, data protection law (such as the UK GDPR or the EU GDPR) may give you the right to:

• Access the personal information we hold about you
• Correct inaccurate information or complete incomplete information
• Request erasure of your information
• Restrict or object to certain processing
• Receive a copy of your information in a portable format
• Not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you — we do not use the Platform this way today: every application decision and every identity-verification decision is made by a person.
• Withdraw consent at any time, where we rely on consent

You can also review and update your account details anytime from your account settings, and request that your account be deactivated (see Section 7 for what we retain afterward).

To exercise any of the rights above, or to ask us to correct or delete your information, contact us using the details in Section 13. We will consider and act on any request in accordance with applicable data protection law.

If you are in the UK and unhappy with how we have handled your personal information, you can complain to us directly using the contact details below, or to the Information Commissioner's Office (ICO), the UK's data protection regulator:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are in the EEA, you may also complain to your local data protection authority.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Platform or by email. The "Last updated" date above reflects the most recent revision.

If you have questions about this Privacy Policy, how we handle your information, or want to exercise your privacy rights, contact our Data Protection Officer:

E-VISION CONCEPT LIMITED
2 Bathurst St, Tyburnia, London W2 2SD, England
Phone: 020 3715 5513

privacy@evisionconcept.co.uk