Last updated: 11 August 2026 · Version 2.0
This policy explains what 4Real Estate Limited (company number 15119929), trading as RenteRoo, does with personal data when you use RenteRoo at www.renteroo.co.uk.
Registered office: 42 Ffordd Y Meillion, Llanelli, SA15 2EX, Wales. Contact for anything in this policy: hello@renteroo.co.uk.
We are registered with the Information Commissioner's Office, registration reference ZC215339. You can check it at ico.org.uk/ESDWebPages/Search.
RenteRoo holds two kinds of personal data, and we have a different job for each. Which one applies changes who you ask when you want something done.
| Your own account | What a landlord records about their tenants and properties | |
|---|---|---|
| What it covers | Your name, email, phone, login, security and sign-in records, how you use the product, anything you send us | Tenant names and contact details, dates of birth, tenancy dates and terms, documents and certificates, inventories, photographs, messages, rent notes |
| Who decides what happens to it | We do | The landlord does |
| Our legal role | Controller | Processor — we act on the landlord's instructions |
| Who you ask about it | Us — hello@renteroo.co.uk | Your landlord first. We will help you reach them |
If you are a landlord: for your tenants' data, you are the controller and we work for you. The agreement that governs it is Schedule 1 — the Data Processing Agreement, and UK GDPR requires it to exist in writing. You also have your own privacy notice to give your tenants — that one is yours, not ours.
If you are a tenant: your landlord decides what is held about your tenancy. Sections 2, 3, 4, 6, 7, 9 and 10 of this policy describe what we do with your own account data, where we are the controller and you can come straight to us. For anything about your tenancy records, section 9 explains how it works.
Where the same information sits in both — your name and email, for instance, which is both your account and something your landlord recorded — we treat the account copy as ours to answer for, and the landlord's copy as theirs.
Notifications are off unless you turn them on. If you do, your browser creates a subscription and gives us two things, which we keep so we can send to that device:
There is one record per device, and each is separate.
What it is not: not your location, not a way for us to recognise you on other websites, and it holds none of the contents of what we send.
When it goes. We delete it when you turn notifications off, when you sign out on that device, and when you close your account. If your browser tells us the subscription no longer exists, we delete our copy automatically the next time we try to send to it. Your browser's own settings can revoke permission at any time, whatever RenteRoo says.
Anything you send to hello@renteroo.co.uk, and our replies.
Stated because the previous version of this policy said otherwise, and it was wrong:
| What we do | Lawful basis |
|---|---|
| Create and run your account; let you sign in; keep you signed in | Contract — UK GDPR Article 6(1)(b) |
| Give you the product: your properties, documents, reminders, messages, inventories | Contract — Article 6(1)(b) |
| Send you service messages — compliance reminders, security alerts, invitations, changes to these documents | Contract — Article 6(1)(b) |
| Tell a landlord that their tenant has reported an urgent repair | Contract — Article 6(1)(b), and legitimate interests — Article 6(1)(f) — in a home being safe to live in. This one is about someone else's action rather than your own account, which is why it is listed separately |
| Send you notifications on your device, if you have turned them on | Contract — Article 6(1)(b) for what the message says. Storing the subscription on your device relies on the permission your browser asked you for |
| Confirm a tenant invitation is going to the right person, using date of birth and postcode | Contract — Article 6(1)(b), and legitimate interests — Article 6(1)(f) — in not letting a stranger into someone's tenancy records |
| Keep the platform secure: rate limiting, sign-in logs, fraud and abuse prevention, error monitoring | Legitimate interests — Article 6(1)(f) — in keeping other people's data safe |
| Understand whether the product is genuinely useful, using the analytics described above | Legitimate interests — Article 6(1)(f) — in improving a product people rely on, balanced against a design that deliberately sends no identifying content |
| Answer you when you contact us | Legitimate interests — Article 6(1)(f) |
| Meet our own legal duties — responding to a subject access request, keeping records we must keep, responding to a lawful request from a regulator or a court | Legal obligation — Article 6(1)(c) |
| Emailing you about early access and product updates after you joined the waitlist | Consent — Article 6(1)(a). You gave it on the form and can withdraw it at any time, with the unsubscribe link or by emailing us |
Where we rely on legitimate interests, you can object — section 9.
We do not ask for health, ethnicity, religion, sexuality, biometric or similar data, and RenteRoo has no field for it.
A landlord could upload a document that happens to contain some — a letter about an adaptation for a disability, for example. If that happens, the landlord is the controller of it and needs their own lawful basis under Article 9. We ask landlords not to upload what they do not need.
RenteRoo is not for anyone under 18 and we do not knowingly hold a child's personal data. A landlord may record that a household includes children as part of a tenancy — that is their record and their responsibility. If you think we hold a child's data we should not, email hello@renteroo.co.uk and we will deal with it.
We do not sell personal data. We never have and it is not part of the business model.
Five suppliers, listed in full with what each one does and where it processes data, at /subprocessors: Supabase (database, file storage, login), Vercel (hosting), Resend (email), Upstash (rate limiting) and Sentry (error monitoring).
We also send a postcode and nothing else to api.postcodes.io, a free open-data service, to fill in the town and county and work out which country a property is in. No name, no address line, no account identifier.
Each is bound to use the data only for what we ask.
We may have to disclose data to a court, the police, the ICO, HMRC or another authority. We will only do so where we are satisfied we have to, and we will tell you unless we are prohibited from doing so.
If RenteRoo is sold or reorganised, data may transfer to the buyer, who would be bound by this policy or by one no less protective. We will tell you before it happens.
Our position is that personal data stays in the UK or the European Economic Area. The current picture:
| Supplier | What it does | Where it processes |
|---|---|---|
| Supabase | Database, file storage, login | UK — London ✅ confirmed |
| Sentry | Error monitoring | EU ✅ confirmed |
| Vercel | Hosting and content delivery | UK — London ✅ confirmed |
| Resend | Sending email | EU — Ireland ✅ confirmed |
| Upstash | Rate limiting | UK — London ✅ confirmed |
When you close your account, your own profile — name, contact details, login — is anonymised 30 days later. During those 30 days your account still works and you can cancel the closure or download your data. If you want it gone immediately, choose instant deletion and re-enter your password.
Property, tenancy and compliance records are not deleted with you. They describe a relationship with someone else — a tenant, or a landlord — and destroying them could take away evidence either of you might need later. They are retained and re-attributed to an anonymous reference instead.
| What | How long |
|---|---|
| Your profile: name, contact details, login | Anonymised 30 days after closure, or immediately on request |
| Property, tenancy and compliance records: documents, certificates, deposit references, dates | 6 years after the tenancy ends or the property is closed, then anonymised. This matches the six-year window for a contract claim under the Limitation Act 1980 |
| Rent and expense notes | 6 years |
| Messages | 3 years |
| Waitlist entries | Until you unsubscribe, or 24 months after the last contact from you |
| Security and audit logs | 12 months |
| Technical logs | 90 days |
| Backups | Aged out as backups rotate — see section 10 |
You can ask us to delete something sooner, and we will unless there is a legal reason to keep it or it would remove someone else's records. Section 9 explains how.
You have the right to ask for a copy of your data, have it corrected, have it deleted, restrict what we do with it, take it elsewhere in a machine-readable form, object to processing we base on legitimate interests, and withdraw consent where we relied on it.
To use any of them, email hello@renteroo.co.uk. It is free, and we respond within one calendar month.
If you are a landlord, RenteRoo has a settings page where you choose which reminders and updates reach you, and how.
Almost all of it is your choice. Two things are not: messages about your account itself, and an urgent repair reported by your tenant. Your tenant has no way of knowing if you have turned that off, and a repair cannot wait.
If you are a tenant, RenteRoo has a settings page too — you choose whether repairs and visits, messages from your landlord, and inventories and documents reach you by email, on your phone, or both. Your account itself, an invitation to a tenancy, and the outcome of an application always reach you, because you would have no other way of knowing.
Which of us you ask depends on what you are asking about, and section 1 has the table:
If you ask us and it turns out to be your landlord's, we will tell you so, tell you who to ask, and pass your request on to them. We will not ignore you and we will not leave you going in circles. But we cannot change or delete a landlord's records without their instruction, and you would not want a system where a supplier could.
You can always complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113 — whether the issue is with us, with your landlord, or with both. You do not have to come to us first, though we would like the chance to fix it.
If there is a breach likely to risk your rights, we will report it to the ICO within 72 hours and tell you without undue delay. We have a written incident procedure and have rehearsed it.
No system is perfectly secure. If you find a problem, email hello@renteroo.co.uk — we will take it seriously and we will not come after you for telling us.
We use only strictly necessary cookies — the ones that keep you signed in and keep your session secure. We set no analytics, advertising or tracking cookies, and there is no third-party tracking code in the product. Full detail: Cookie Policy.
We do not make any decision about you by automated means that has a legal or similarly significant effect. RenteRoo calculates dates and shows statuses — that is arithmetic on what you entered, not a decision about you, and it does nothing on its own.
We may update this policy. Where a change is material, we will email registered users and show a notice in the product before it takes effect. The version and date at the bottom always reflect the current one, and we keep previous versions — ask us for the one that applied on a given date.
Email hello@renteroo.co.uk first if you can — we aim to reply within 5 working days, and within one calendar month for anything that is a formal request about your data.
If you are not satisfied: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk — 0303 123 1113. The ICO also has a Wales office.
4Real Estate Limited (company number 15119929), trading as RenteRoo · registered office 42 Ffordd Y Meillion, Llanelli, SA15 2EX, Wales · ICO registration ZC215339 · hello@renteroo.co.uk
Privacy Policy · Version 2.0 · 11 August 2026 · replaces Version 1.1 of 4 August 2026