1. Summary
We respect your privacy. HouseDossier processes the minimum data needed to deliver a UK property intelligence report. We do not sell your data. We never share it with third parties for marketing.
2. Who is the data controller?
HouseDossier acts as the data controller for the personal information you provide directly to us (email address, name, payment details, the addresses you search).
3. What we collect
- Account data: email and (optionally) name when you create an account.
- Property searches: addresses, postcodes and UPRNs you look up, plus a hashed IP for rate limiting.
- Order data: report contents, the payment status, and a Stripe customer ID.
- Email logs: which transactional emails we sent you and their delivery status.
- Cookies: a session cookie from our auth provider, and optional analytics.
4. Why we use it
- To deliver the reports you request (legitimate interest, contractual necessity).
- To take payment and send receipts (contractual necessity).
- To improve and secure the service (legitimate interest).
- To send product updates only if you opt in (consent).
5. Sharing
We use a small set of carefully selected processors: Supabase (database/auth, EU region), Stripe (payments), Resend (transactional email) and Vercel (hosting). They process data on our instructions only.
6. Retention
- Reports are accessible online for 30 days; PDF downloads are forever.
- Order history is kept for 7 years for tax/accounting purposes.
- Address search logs are kept for 90 days for fraud and rate-limit purposes.
- Account data is kept until you delete your account.
7. Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict or port your data, and to object to processing. Email privacy@housedossier.co.uk for any request - we'll respond within 30 days.
8. International transfers
Data is stored in the European Economic Area where possible. Some processors (e.g. Vercel CDN) operate globally; appropriate safeguards (Standard Contractual Clauses) are in place.
9. Security
We encrypt data in transit (TLS) and at rest. Access to production systems is limited and audited. We never store payment card details - Stripe handles those directly.
10. Complaints
You can complain to the UK Information Commissioner's Office at ico.org.uk.
11. Updates
We may update this policy. Significant changes will be flagged on the site and emailed to active customers.