Privacy policy
Last updated: [DATE]
This policy explains how [COMPANY NAME LTD] ("Tenevo", "we", "us") uses personal data on this website and in the Tenevo service. We are a company registered in England and Wales, number [COMPANY NUMBER], with our registered office at [REGISTERED ADDRESS]. We are registered with the Information Commissioner's Office (ICO), number [ICO REGISTRATION NUMBER]. Contact us at [privacy@yourdomain.co.uk].
1. Two roles: who decides what
When you visit this website or sign up, we decide why and how your data is used. We are the "controller".
When you use Tenevo to manage your lettings, you decide why and how information about your tenants and properties is used, and we process it on your behalf. You are the controller and we are your "processor". This part of the policy and our Data Processing Terms (available on request) set out what we do. You are responsible for having a lawful reason to hold your tenants' data and for telling them about it.
2. What we collect
| Data | When | Why we use it | Lawful basis (UK GDPR) |
|---|---|---|---|
| Email address and anything you type in the sign-up form | You join the free trial or ask a question | To set up your trial, send what you asked for and contact you about it | Taking steps at your request before a contract; legitimate interests in replying to enquiries |
| Account details: name, email, password (stored hashed), phone if you add it | You create an account | To provide and secure the service | Contract |
| Your property and tenancy records, tenant names and contact details, rent records, repair reports, messages | You add them or tenants submit them | To run the features you ask for | You are the controller; we process on your instructions |
| Documents and photos you upload, such as gas, electrical and energy certificates | You upload or forward them | To read, file and set reminders for them | As above |
| Billing details: plan, invoices, payment status. Card details go to our payment provider and are not stored by us | After your trial, if you subscribe | To take payment and keep tax records | Contract; legal obligation |
| Technical data: IP address, device and browser type, pages and actions, error logs | You use the site or app | To keep the service secure, fix problems and understand use | Legitimate interests |
| Marketing emails | Only if you opt in, or as an existing customer about similar services | To tell you about Tenevo | Consent, or legitimate interests (you can opt out at any time) |
We do not ask for special category data (such as health data). Please do not put it in free-text boxes. We do not sell personal data.
3. AI and your documents
Tenevo uses AI models to read documents, sort repair reports and draft messages. Content you upload is sent to our AI provider, [Anthropic, PBC or other provider: confirm], to produce the result. [Confirm before publishing: We do not allow our provider to use your content to train its models, and we do not use it to train our own.] AI can make mistakes. Nothing is sent to a tenant or contractor until you approve it, and you should check what the AI has extracted.
4. Who we share data with
We use trusted service providers who process data for us under contract. Our current list is [confirm and keep up to date]:
| Provider | What for | Where |
|---|---|---|
| [Supabase] | Database, sign-in and file storage | [UK/EU region] |
| [Vercel] | Website and app hosting | [region] |
| [Stripe] | Subscription payments | [region] |
| [Resend or Postmark] | Sending emails and reminders | [region] |
| [Anthropic] | AI document reading and drafting | [region] |
| [Form or email-list provider] | Collecting sign-ups before launch | [region] |
We may also share data if the law requires it, or with a buyer if we sell the business (they must honour this policy). When data goes outside the UK we use a UK adequacy decision, the UK International Data Transfer Agreement or the UK Addendum to the EU standard clauses.
5. How long we keep it
- Sign-up enquiries that do not become accounts: up to [12] months, then deleted.
- Account and landlord records: while your account is open, then deleted within [90] days of closing unless the law requires us to keep something. You can export your data first.
- Billing records: [6] years, for tax law.
- Server logs: [30] days.
6. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to our use of it, or move it to another service. Where we rely on consent you can withdraw it at any time. Email [privacy@yourdomain.co.uk]. We reply within one month. If you are a tenant of one of our customers, please contact your landlord first, as they decide how your data is used. We will help them respond.
If you are unhappy, tell us and we will try to put it right. You can also complain to the ICO at ico.org.uk or on 0303 123 1113.
7. Security
Data is encrypted in transit over HTTPS, passwords are stored hashed, and uploaded files open only through short-lived private links. Access to records is restricted by account. We limit staff access and keep logs. No system is perfectly secure. If a breach affects you we will tell you and, where required, the ICO.
8. Cookies
See our cookie notice.
9. Changes
We will update this page when things change and, for material changes, tell account holders by email.