This notice explains how LandlordHub uses personal data and what your rights are under UK data protection law. LandlordHub is run by Gary Callaway, a sole trader trading as LandlordHub ("we", "us").
If you are a tenant, a prospective tenant or someone who viewed a property: most information about you in LandlordHub is controlled by the landlord or letting agency you deal with, not by us. They decide what is entered, why and for how long, and we handle it on their behalf. They should give you their own privacy information. See section 2.
LandlordHub is a trading name of Gary Callaway, a sole trader based in England. Gary Callaway is the controller for the personal data described in this notice where we decide how it is used.
For anything about this notice or your personal data, email us, use our contact form (choose "Data protection request" or "Data protection complaint"), or write to the address above marked "Data Protection". We are a small business and do not have a formal Data Protection Officer; Gary Callaway handles data protection matters personally.
UK data protection law gives different responsibilities to controllers (who decide why and how personal data is used) and processors (who handle it on a controller's behalf).
| Personal data | Who is the controller | Our role |
|---|---|---|
| Your LandlordHub account: name, email, password, phone number, role, notification choices, login and security records. For agencies, also the agency's details and each team member's login and role. | LandlordHub | Controller |
| Plans, purchases, agency credit, invoices and payment status | LandlordHub | Controller |
| Website visits, free tools, the contact form, support requests, the referral programme, and guest purchases (AI inventory and tenant referencing bought without an account) | LandlordHub | Controller |
| Everything a landlord or letting agency puts into LandlordHub about their properties and the people connected to them: tenants, applicants, people who view properties, occupiers, guarantors, landlords (for agencies), contractors and key holders; documents, certificates, photos and videos; repairs, messages, viewings, the letting pipeline and applicant checks, deposits, Right to Rent records, keys, approvals, move-outs, tenancy agreements and inventories | The landlord or letting agency that manages the property ("the Customer") | Processor, acting on the Customer's instructions |
| Tenant referencing and credit checks | Vorensys (our referencing partner), for the checks it carries out, and the Customer, for its letting decision | We pass the order to Vorensys and show the Customer the status and result |
Where a letting agency manages a property, the agency is the Customer for that property. The landlord who owns it can see some of its information through a free read-only account, as the agency allows.
Where we act as processor, the Customer is responsible for having a lawful basis, for telling you how your data is used, and for responding to your rights requests. If you contact us about data we hold for a Customer, we will pass your request to them and let you know we have done so.
Most calculators run in your browser and we do not store what you enter. If you use the council finder, the postcode you enter is sent to the public postcode service postcodes.io to find the local council; we do not store it.
We only use personal data where the law allows. This table covers what we do as controller.
| Purpose | Lawful basis |
|---|---|
| Creating and running accounts (including agency team logins and free accounts for landlords whose properties an agency manages), and providing the features you use | Contract; for agency team members and managed landlords, our legitimate interests in providing the service the agency has asked for |
| Taking payments, managing plans, free trials, free allowances and agency credit | Contract |
| Providing guest AI inventories, guest tenancy agreements and guest tenant referencing | Contract |
| Sending service messages: account confirmation, password resets, security alerts, billing notices, and notifications about repairs, compliance, viewings and agency tasks | Contract; and legitimate interests (keeping the service working and users informed) |
| Sending text alerts and app notifications | Contract, only when you switch them on; you can switch them off at any time |
| Answering questions to the "Ask LandlordHub" assistant | Contract, or legitimate interests (helping you use the service) |
| Running the referral programme and applying rewards | Contract |
| Running the affiliate programme: tracking sign-ups from affiliate links (only with cookie consent), calculating and paying commission | Contract with the affiliate; consent for the tracking storage; legitimate interests (crediting the right affiliate) for the sign-up record |
| Sending contractor requests and partner introductions you ask for, and tracking their status and any commission | Contract (you asked us to do it); legitimate interests for commission records |
| Looking up public information you ask for (such as an EPC or local council) | Contract; legitimate interests |
| Answering enquiries, support requests and complaints | Legitimate interests (helping you); legal obligation for data protection complaints |
| Keeping the service secure, preventing fraud and misuse, and enforcing our Terms | Legitimate interests |
| Measuring website use with Google Analytics | Consent (only if you accept analytics) |
| Keeping accounting and tax records | Legal obligation |
| Complying with law, court orders and regulators | Legal obligation |
| Improving the service using aggregated statistics that don't identify anyone | Legitimate interests |
| Sending marketing emails | Consent, or for existing customers our legitimate interests, with the right to opt out at any time (see section 12) |
Where we rely on legitimate interests, we have balanced our interests against your rights and expectations. You can ask us for details and you can object (see section 11).
For data we process as processor, the Customer decides the lawful basis. This is usually taking steps to enter into or perform the tenancy, the Customer's legal obligations (for example Right to Rent and deposit protection), or its legitimate interests.
LandlordHub does not ask for special category data (such as health, ethnicity or religion) or criminal offence data. Someone might still choose to include it, for example in a repair request ("urgent because of a health condition") or in notes about an applicant. That information is processed on the Customer's behalf so they can respond. Please include only what is necessary.
Right to Rent evidence can include identity and immigration documents. Agencies upload these to private storage for their own legal checks. Referencing can involve financial, credit and identity data, which Vorensys processes under its own privacy notice.
We use OpenAI to provide three features:
We don't use your content to train AI models. Under OpenAI's business terms, data sent through its API is not used to train its models. Please avoid filming people or personal belongings in inventory recordings, and don't type other people's personal details into the assistant.
We do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects. Decisions about letting a property, including after referencing and checks, are made by the landlord or letting agency.
People connected to the same property can see what the service shows them. For example: a tenant sees the property details, documents and compliance information their landlord or agency shares; a landlord or agency sees their tenants' repair requests and messages; agency team members see their agency's records according to their role; a landlord whose property is managed by an agency sees that property's information in a read-only view. Where an agency manages a property, the tenant deals only with the agency and does not see the landlord's contact details. If an agency adds its branding, its logo and colours appear in its landlords' and tenants' portals and emails.
We use carefully chosen providers to run LandlordHub. They may only use personal data on our instructions and must keep it secure. They provide database and file hosting, website hosting, email, text messages, app notifications, AI drafting, payments, analytics (only with consent) and content delivery. The current list, with where each provider processes data, is on our Data Protection & GDPR page.
We do not sell personal data.
Our database and file storage are hosted by Supabase in the European Union (Ireland), which the UK recognises as giving adequate protection. Some providers (for email, text messages, AI, payments and analytics) are based in, or use systems in, the United States or other countries outside the UK.
When personal data is transferred outside the UK, we make sure it is protected by an approved safeguard: UK adequacy regulations (including the UK–US data bridge where the recipient is certified), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more information.
We keep personal data only as long as necessary. For data we process for a Customer, the Customer decides how long it is kept while their account is open, and it is deleted when their account is closed, as below.
| Data | How long |
|---|---|
| Account and profile data | While your account is open. Deleted or anonymised when you delete your account, except as below. |
| Customer content (properties, tenancies, documents, repairs, messages, viewings, pipeline and checks records, deposits, Right to Rent, keys, generated documents, inventories) | While the Customer's account is open, unless the Customer deletes items sooner. Deleted when the Customer's account is closed or deleted. |
| Landlord and agency accounts whose free trial or plan has ended | The account becomes read-only. If no paid plan is chosen, the account and everything in it may be permanently deleted 90 days after we first tell the account holder. Landlords receive emails when the account becomes read-only, 30 days before and 7 days before deletion. |
| Agency team member logins | While the person is on the agency's team. Removed when the agency removes them or closes its account. |
| Free landlord accounts for agency-managed properties | While an agency manages at least one of the landlord's properties, or while the landlord has a paid plan. |
| Tenant accounts | While your account is open. Records that form part of a Customer's tenancy records (such as repair history) may be kept by the Customer. |
| Guest AI inventory recordings | Not kept after each room is analysed. The private link stops working after 7 days. |
| Payment, invoice, credit and purchase records (including guest purchases) | 6 years from the end of the tax year they relate to, to meet tax and accounting law |
| In-app notifications and email, text and app notification delivery records | 12 months |
| Contact form messages, assistant questions and support correspondence | 2 years from the last contact |
| Data protection requests and complaints | 3 years from closure |
| Security and audit logs | 12 months, unless needed to investigate an incident |
| Referral programme records | While the programme applies to your account, then 6 years for rewards that affected billing |
| Affiliate records (links, credited sign-ups, commission and payouts) | While you're an affiliate, then 6 years from the end of the tax year of the last payment |
| Contractor request records | While the linked repair record exists in the Customer's account; commission records 6 years from the end of the tax year they relate to |
| Guest tenancy agreement answers | Deleted 30 days after the private link expires (links last 7 days). The payment record is kept as above. |
| Documents sent for signature by guests (without an account) | The document, signatures and signing record are deleted 90 days after both people have signed, or 30 days after an unsigned request expires or is cancelled. Please download the signed copy. |
| Documents sent for signature from an account | Kept with the account's documents; the account holder decides how long to keep them |
| Advert enquiries | Sent to the agency or landlord and kept as part of their records; they decide how long to keep them |
| Backups | Deleted data can remain in encrypted backups until they are overwritten, normally within 30 days |
We use appropriate technical and organisational measures to protect personal data. These include encryption in transit, database rules that restrict each user to the data they are allowed to see, private file storage with time-limited links, hashed passwords, restricted administrative access protected by multi-factor authentication, and keeping payment details with specialist payment providers. No system is completely secure, so please use a strong, unique password and keep your login details private.
If a personal data breach is likely to put your rights at risk, we will tell the Information Commissioner within 72 hours where required, and tell you directly without undue delay if the risk is high. Where we act for a Customer, we will tell that Customer so they can meet their own obligations.
Subject to certain conditions and exemptions, you have the right to:
You can update most account details and delete your account yourself in your account settings. For anything else, contact us as set out in section 1. We may need to confirm your identity. We will respond within one month of receiving your request (or of receiving any information we reasonably need to confirm your identity or understand the request). We may extend this by up to two further months for complex or numerous requests, and will tell you if we do. There is normally no fee.
Tenants, applicants and people who viewed a property: for information a landlord or letting agency controls, please ask them. If you send your request to us, we will forward it to them and tell you.
We send service messages, such as account, security, billing, repair, compliance, viewing and agency notifications, because they are part of the service. You can choose which repair and compliance notifications you receive by email, text or app notification in your settings; some essential account and security messages cannot be switched off. Letting agencies receive alerts by email only.
We only send marketing emails with your consent, or to existing customers about similar LandlordHub products with an easy way to opt out in every message. We do not send marketing texts without your consent, and we never pass your details to other organisations for their marketing.
We use strictly necessary browser storage to keep you signed in, remember choices you make and provide features you ask for. We also store your cookie choice. If, and only if, you accept analytics, we use Google Analytics 4 to understand visits, pages viewed, interactions, traffic sources, devices and broad location (such as country and region). Google advertising features and Google Signals are switched off. If, and only if, you allow referral link tracking, we remember an affiliate link you arrived through for up to 60 days so the affiliate can be credited. See our Cookies Policy for details and how to change your choice.
LandlordHub accounts are only for people aged 18 or over, and we do not knowingly collect personal data from children through the service. Landlords and agencies may record the names of occupiers who are children where necessary for the tenancy; they are responsible for that as controller. If you believe a child has created an account, contact us and we will delete it.
If you are unhappy with how we have used your personal data, please complain to us first so we can put it right. Use our contact form, email [email protected], or write to us.
We will acknowledge your complaint within 30 days, investigate without undue delay, keep you informed and tell you the outcome.
You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
If your complaint is about data a landlord or letting agency controls, please raise it with them. We will help them respond where we can.
We may update this notice from time to time. We will change the date at the top and, for significant changes, tell registered users by email or in the service. If the business becomes a limited company, we will update this notice with its details and tell registered users.
When we add a feature that shares personal data with a new organisation (for example a new partner or public data service), we will update this notice and our Data Protection & GDPR page before it goes live.
InventoryHub (inventoryhub.info) is run by us too and uses the same systems, but has its own privacy notice for the reports sold there.
