1. Summary
We respect your privacy. HouseDossier processes information needed to deliver an England and Wales property intelligence report. We do not sell your data. We never share it with third parties for marketing.
2. Who is the data controller?
HouseDossier acts as the data controller for the personal information you provide directly to us (email address, name, payment details, the addresses you search).
3. What we collect
- Account data: email and (optionally) name when you create an account.
- Email updates: your email, chosen topics, consent wording version, request and confirmation dates, and any unsubscribe instruction. Home Watch interest does not require your home address.
- Property searches: addresses, postcodes and UPRNs you look up, plus a hashed IP for rate limiting.
- Order data: report contents, the payment status, and a Stripe customer ID.
- Email logs: which transactional emails we sent you and their delivery status.
- Cookies: a session cookie from our auth provider, and optional analytics.
- Optional analytics: with your permission, a random session ID, measured page paths, search outcomes, campaign tags and referring hostname. We can connect a measured session to its order to understand conversion. Analytics excludes raw searched addresses, emails, URL query strings and report access tokens. This is pseudonymous information, not a claim of complete anonymity.
4. Why we use it
- To deliver the reports you request (legitimate interest, contractual necessity).
- To take payment and send receipts (contractual necessity).
- To improve and secure the service (legitimate interest).
- To measure optional browsing journeys and conversion (consent). You can withdraw through Privacy choices without affecting your purchase. Necessary payment, refund and fulfilment records are separate.
- To send email updates about topics you choose, after you opt in and confirm your email (consent). Every marketing update includes an unsubscribe link. Report purchases do not automatically subscribe you, and withdrawing does not stop receipts or report delivery.
5. Sharing
We use a small set of carefully selected processors: Supabase (database/auth, EU region), Stripe (payments), Resend (email delivery) and Vercel (hosting). They process data on our instructions only.
When an AI summary is generated, the configured AI provider processes the report evidence needed for that summary. The optional Jev evidence review runs through OpenRouter and TypeSafe using restricted source facts and text with known property identifiers and contact details removed. It does not receive your payment details or account credentials.
6. Retention
- Reports are accessible online for 30 days; PDF downloads are forever.
- Order history is kept for 7 years for tax/accounting purposes.
- Address search logs are kept for 90 days for fraud and rate-limit purposes.
- Account data is kept until you delete your account.
- Unconfirmed email requests expire after 48 hours and are removed by daily maintenance. Active email preferences are kept while you subscribe. After withdrawal, a minimal suppression and consent record is retained to respect your choice and document it; it is not an active mailing-list membership.
7. Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict or port your data, and to object to processing. Email privacy@housedossier.co.uk for any request - we'll respond within 30 days.
8. International transfers
Data is stored in the European Economic Area where possible. Some processors (e.g. Vercel CDN) operate globally; appropriate safeguards (Standard Contractual Clauses) are in place.
9. Security
We encrypt data in transit (TLS) and at rest. Access to production systems is limited and audited. We never store payment card details - Stripe handles those directly.
10. Complaints
You can complain to the UK Information Commissioner's Office at ico.org.uk.
11. Updates
We may update this policy. Significant changes will be flagged on the site and emailed to active customers.