LEGAL

Privacy Policy

Last updated: 26 October 2026 · Version 2.6

This policy explains what 4Real Estate Limited (company number 15119929), trading as RenteRoo, does with personal data when you use RenteRoo at www.renteroo.co.uk.

Registered office: 42 Ffordd Y Meillion, Llanelli, SA15 2EX, Wales. Contact for anything in this policy: hello@renteroo.co.uk.

We are registered with the Information Commissioner's Office, registration reference ZC215339. You can check it at ico.org.uk/ESDWebPages/Search.

1. The most important thing on this page: there are two relationships here

RenteRoo holds two kinds of personal data, and we have a different job for each. Which one applies changes who you ask when you want something done.

	Your own account	What a landlord records about their tenants and properties
What it covers	Your name, email, phone, login, security and sign-in records, how you use the product, anything you send us	Tenant names and contact details, dates of birth, tenancy dates and terms, documents and certificates, inventories, photographs, messages, rent notes
Who decides what happens to it	We do	The landlord does
Our legal role	Controller	Processor — we act on the landlord's instructions
Who you ask about it	Us — hello@renteroo.co.uk	Your landlord first. We will help you reach them

If you are a landlord: for your tenants' data, you are the controller and we work for you. The agreement that governs it is Schedule 1 — the Data Processing Agreement, and UK GDPR requires it to exist in writing. You also have your own privacy notice to give your tenants — that one is yours, not ours.

If you are a tenant: your landlord decides what is held about your tenancy. Sections 2, 3, 4, 6, 7, 9 and 10 of this policy describe what we do with your own account data, where we are the controller and you can come straight to us. For anything about your tenancy records, section 9 explains how it works.

Where the same information sits in both — your name and email, for instance, which is both your account and something your landlord recorded — we treat the account copy as ours to answer for, and the landlord's copy as theirs.

2. What we collect, where we are the controller

2.1 Your account

Name, email address, phone number
Password (stored as a one-way hash — we never see it)
Date of birth and postcode, where they are used to confirm a tenant invitation is for the right person
Profile photograph, if you add one — optional
Your role: landlord or tenant
Multi-factor authentication settings and recovery codes

2.2 Waitlist and early access

Name and email address
How many properties you have, whether they are in Wales, whether you self-manage or use an agent
What tools you use now, your biggest problem, whether you want to join the Beta, whether you would give feedback
How you heard about RenteRoo, and any referral or campaign details in the link you used

2.2a Updates for Welsh landlords

If you sign up on our updates page, we keep your email address, which emails you asked for (updates for Welsh landlords, news about RenteRoo's new features and services, or both), the exact words you agreed to, when and on which page you signed up, and when you confirmed your address. We do not need your name, and we do not link the sign-up to a RenteRoo account.

2.3 How you use RenteRoo

IP address, browser and device type, session tokens, sign-in and security logs
Product analytics — which is unusual and worth reading. We record that things happened, such as "a property was added" or "a certificate was recorded". If you are not signed in you are counted anonymously. If you are signed in, events are linked to your account's identifier — never to your name, address, documents or messages. No third-party analytics code runs in your browser, nothing is stored on your device for analytics, and no analytics cookie is set. The technical detail is in the Cookie Policy.
Our weekly compliance email contains a small invisible image that tells us the email was opened. It records only that your account opened that week's email — not what you read or clicked. Many email apps load it automatically, so the figure is approximate. Unsubscribing stops it.

2.3a If you turn on notifications

Notifications are off unless you turn them on. If you do, your browser creates a subscription and gives us two things, which we keep so we can send to that device:

An address for that browser on that device, issued by your browser's own push service. It is an address for delivery, nothing more.
Two keys, used to encrypt each message so only your device can read it.

There is one record per device, and each is separate.

What it is not: not your location, not a way for us to recognise you on other websites, and it holds none of the contents of what we send.

When it goes. We delete it when you turn notifications off, when you sign out on that device, and when you close your account. If your browser tells us the subscription no longer exists, we delete our copy automatically the next time we try to send to it. Your browser's own settings can revoke permission at any time, whatever RenteRoo says.

2.4 When you contact us

Anything you send to hello@renteroo.co.uk, and our replies.

2.5 What we do not collect

Stated because the previous version of this policy said otherwise, and it was wrong:

We do not collect your National Insurance number or Unique Taxpayer Reference.
We do not collect bank account details. If you subscribe to a paid plan, your card details go straight to Stripe, which handles our payments; we never see or store your full card number. We keep a record of your plan, your payments and your billing name and address, because we issue invoices and keep accounts. Invoices and payment records are kept for six years after the end of the financial year they belong to, because tax law requires it — including after you close your account.
We do not collect identity documents — passports, driving licences, payslips, bank statements — as part of your account. A landlord may choose to upload a document to their own property or tenancy records, and if they do, that is their data under section 1, not ours.
RenteRoo never holds rent, deposits or any other money.

3. Why we use it, and our lawful basis

What we do	Lawful basis
Create and run your account; let you sign in; keep you signed in	Contract — UK GDPR Article 6(1)(b)
Give you the product: your properties, documents, reminders, messages, inventories	Contract — Article 6(1)(b)
Send you service messages — compliance reminders, security alerts, invitations, changes to these documents	Contract — Article 6(1)(b)
Tell a landlord that their tenant has reported an urgent repair	Contract — Article 6(1)(b). Passing on your tenant's urgent repair report is part of the service you signed up for, and our Terms say so. It is the one message about your properties you cannot switch off, because your tenant cannot know whether you have.
Send you notifications on your device, if you have turned them on	Contract — Article 6(1)(b) for what the message says. Storing the subscription on your device relies on the permission your browser asked you for
Confirm a tenant invitation is going to the right person, using date of birth and postcode	Contract — Article 6(1)(b), and legitimate interests — Article 6(1)(f) — in not letting a stranger into someone's tenancy records
Keep the platform secure: rate limiting, sign-in logs, fraud and abuse prevention, error monitoring	Legitimate interests — Article 6(1)(f) — in keeping other people's data safe
Understand whether the product is genuinely useful, using the analytics described above	Legitimate interests — Article 6(1)(f) — in improving a product people rely on, balanced against a design that deliberately sends no identifying content
Answer you when you contact us	Legitimate interests — Article 6(1)(f)
Meet our own legal duties — responding to a subject access request, keeping records we must keep, responding to a lawful request from a regulator or a court	Legal obligation — Article 6(1)(c)
Emailing you about early access and product updates after you joined the waitlist	Consent — Article 6(1)(a). You gave it on the form and can withdraw it at any time, with the unsubscribe link or by emailing us
Emailing you updates for Welsh landlords, and news about RenteRoo's new features and services if you ticked that box too	Consent — Article 6(1)(a), and the consent the email marketing rules (PECR) require. You gave it by ticking a box that was not ticked for you, and confirmed it from your inbox. You can withdraw it at any time with the unsubscribe link in every email, or by emailing us

Where we rely on legitimate interests, you can object — section 9.

4. Special category data

We do not ask for health, ethnicity, religion, sexuality, biometric or similar data, and RenteRoo has no field for it.

A landlord could upload a document that happens to contain some — a letter about an adaptation for a disability, for example. If that happens, the landlord is the controller of it and needs their own lawful basis under Article 9. We ask landlords not to upload what they do not need.

5. Children

RenteRoo is not for anyone under 18 and we do not knowingly hold a child's personal data. A landlord may record that a household includes children as part of a tenancy — that is their record and their responsibility. If you think we hold a child's data we should not, email hello@renteroo.co.uk and we will deal with it.

6. Who we share it with

We do not sell personal data. We never have and it is not part of the business model.

6.1 Other people using RenteRoo

A landlord sees the records they created about their own properties, tenancies and tenants.
A tenant sees what their landlord has shared with them, and the messages between them. After a tenancy ends, the tenant can still see their own tenancy documents, move-in inventory, deposit record and any check-out record for 6 months, on the landlord's behalf. Nothing else about the home. This applies to tenancies ended on or after 26 October 2026.
Nobody sees another landlord's records. This is enforced at the database, not just in the interface, and it has been tested against live accounts.

6.2 Companies that help us run RenteRoo

Six suppliers, listed in full with what each one does and where it processes data, at /subprocessors: Supabase (database, file storage, login), Vercel (hosting), Resend (email), Upstash (rate limiting), Sentry (error monitoring) and Ideal Postcodes (the address finder — it receives what you type into the address box, and nothing about you).

We also send a postcode and nothing else to api.postcodes.io, a free open-data service, to fill in the town and county and work out which country a property is in. No name, no address line, no account identifier. We also send a property's UPRN and nothing else to the government's EPC register, to fill in its current energy certificate. No name, no account identifier.

Each is bound to use the data only for what we ask.

Stripe — card payments and subscriptions. For some purposes, such as preventing fraud and meeting its own legal duties, Stripe decides how it uses the information, and its own privacy policy applies. Stripe may process data in the United States, under the UK Extension to the EU–US Data Privacy Framework and the UK International Data Transfer Addendum (Stripe's data transfer terms).

6.3 When the law requires it

We may have to disclose data to a court, the police, the ICO, HMRC or another authority. We will only do so where we are satisfied we have to, and we will tell you unless we are prohibited from doing so.

6.4 If the business changes hands

If RenteRoo is sold or reorganised, data may transfer to the buyer, who would be bound by this policy or by one no less protective. We will tell you before it happens.

7. Where your data is processed

Our position is that personal data stays in the UK or the European Economic Area. The current picture:

Supplier	What it does	Where it processes
Supabase	Database, file storage, login	UK — London ✅ confirmed
Sentry	Error monitoring	EU ✅ confirmed
Vercel	Hosting and content delivery	UK — London ✅ confirmed
Resend	Sending email	EU — Ireland ✅ confirmed
Upstash	Rate limiting	UK — London ✅ confirmed
Ideal Postcodes	The address finder	UK / EU ✅ confirmed

8. How long we keep it

When you close your account, your own profile — name, contact details, login — is anonymised 30 days later. During those 30 days your account still works and you can cancel the closure or download your data. If you want it gone immediately, choose instant deletion and re-enter your password.

Records of a tenancy are not deleted with you. The property while it was let, the contract, certificates, inventory, rent and repair history describe a relationship with someone else — a tenant, or a landlord — and destroying them could take away evidence either of you might need later. They are kept for the periods below with your name replaced by an anonymous reference. A property you never let through RenteRoo is yours alone, and goes with your account. If you have a paid plan when you close your account, we cancel it and you are not charged again.

What	How long
Your profile: name, contact details, login	Anonymised 30 days after closure, or immediately on request
Property, tenancy and compliance records: documents, certificates, deposit references, dates	6 years after the tenancy ends or the property is closed, then anonymised. This matches the six-year window for a contract claim under the Limitation Act 1980
Rent records for a tenancy	6 years after the tenancy ends — they are part of the tenancy record above
Your own expense notes and tax details	Deleted with your account. Download them first if you need them for your own records
Messages and their attachments	3 years. If you close your account, your messages stay in the other person's conversation for that time, with your name replaced by Deleted user
Documents a tenant sends to apply for a tenancy — ID, references, proof of income	Deleted when the tenancy ends or when the tenant closes their account, whichever comes first
Billing records — what you paid, when and for what	6 years after the end of the financial year, as tax law requires (Finance Act 1998, Schedule 18). Stripe keeps its own copy — see section 6
Support conversations	Deleted with your account
The record that you asked us to close your account, and that we did	6 years — dates and outcome only, with your name removed
Waitlist entries	Until you unsubscribe, or 24 months after the last contact from you. If you close an account, we also remove you from the waitlist and keep only a scrambled copy of your email so we never contact you again
Updates sign-ups	Until you unsubscribe. If you never confirm your address, we delete it after 30 days. When you unsubscribe we delete your sign-up and keep only a scrambled copy of your email address, so we never email you again by mistake
Security and audit logs	12 months
Technical logs	90 days
Backups	Our database provider keeps seven days of backups, then overwrites them; uploaded files are not in them. If we ever restore a backup, we re-run every deletion made since it was taken

You can ask us to delete something sooner, and we will unless there is a legal reason to keep it or it would remove someone else's records. Section 9 explains how. Deleted records leave our backups within seven days.

9. Your rights

You have the right to ask for a copy of your data, have it corrected, have it deleted, restrict what we do with it, take it elsewhere in a machine-readable form, object to processing we base on legitimate interests, and withdraw consent where we relied on it.

To use any of them, email hello@renteroo.co.uk. It is free, and we respond within one calendar month.

Choosing what we send you

If you are a landlord, RenteRoo has a settings page where you choose which reminders and updates reach you, and how.

Almost all of it is your choice. Two things are not: messages about your account itself, and an urgent repair reported by your tenant. Your tenant has no way of knowing if you have turned that off, and a repair cannot wait.

If you are a tenant, RenteRoo has a settings page too — you choose whether repairs and visits, messages from your landlord, and inventories and documents reach you by email, on your phone, or both. Your account itself, an invitation to a tenancy, and the outcome of an application always reach you, because you would have no other way of knowing.

If you signed up for updates, every email has a link to stop them; one click stops everything, and nothing else is needed.

If you are a tenant, read this part

Which of us you ask depends on what you are asking about, and section 1 has the table:

Your account — your login, your email address, how we contact you, closing your account: ask us. We can act.
Your tenancy records — what your landlord has recorded about you, a document about your home, an inventory, the messages: ask your landlord. They decide what happens to those records, and the law puts the duty on them.

If you ask us and it turns out to be your landlord's, we will tell you so, tell you who to ask, and pass your request on to them. We will not ignore you and we will not leave you going in circles. But we cannot change or delete a landlord's records without their instruction, and you would not want a system where a supplier could.

You can always complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113 — whether the issue is with us, with your landlord, or with both. You do not have to come to us first, though we would like the chance to fix it.

10. How we protect it

Everything travels over encrypted HTTPS, and our database and file storage providers encrypt data at rest.
Passwords are stored as one-way hashes. We cannot read them.
Multi-factor authentication is available and we recommend it. Every administrative account that can reach production has it switched on.
Every landlord's records are separated at the database level, using row-level security policies rather than only in the interface — so a fault in a page cannot expose someone else's data. This has been tested against live accounts across account boundaries.
Documents and photographs live in private storage, reachable only through short-lived links issued to someone entitled to see them. They are never publicly addressable.
Sensitive actions are rate-limited — invitations, account deletion, document access — and the identifiers used for that are pseudonymised.
Our error monitoring is built to exclude personal data: request bodies, query strings, cookies, tokens, file paths, names, addresses and message content are all stripped before anything leaves.
Invitation tokens and date-of-birth checks are stored as hashes, not as readable values.
Access to the production database is limited to authorised personnel, which today means the founder.
We keep backups, and their handling is described in Schedule 1.

If there is a breach likely to risk your rights, we will report it to the ICO within 72 hours and tell you without undue delay. We have a written incident procedure and have rehearsed it.

No system is perfectly secure. If you find a problem, email hello@renteroo.co.uk — we will take it seriously and we will not come after you for telling us.

11. Cookies

We use only strictly necessary cookies — the ones that keep you signed in and keep your session secure. We set no analytics, advertising or tracking cookies, and there is no third-party tracking code in the product. Full detail: Cookie Policy.

12. Automated decisions

We do not make any decision about you by automated means that has a legal or similarly significant effect. RenteRoo calculates dates and shows statuses — that is arithmetic on what you entered, not a decision about you, and it does nothing on its own.

13. Changes to this policy

We may update this policy. Where a change is material, we will email registered users and show a notice in the product before it takes effect. The version and date at the bottom always reflect the current one, and we keep previous versions — ask us for the one that applied on a given date.

14. Complaining

Email hello@renteroo.co.uk first if you can — we aim to reply within 5 working days, and within one calendar month for anything that is a formal request about your data.

If you are not satisfied: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk — 0303 123 1113. The ICO also has a Wales office.

4Real Estate Limited (company number 15119929), trading as RenteRoo · registered office 42 Ffordd Y Meillion, Llanelli, SA15 2EX, Wales · ICO registration ZC215339 · hello@renteroo.co.uk