Privacy policy

01Who We Are

LetCompliance ("we", "us", "our") is a software service operated by Erdem Volkan, trading as LetCompliance, a sole trader based in the United Kingdom. Our business address is available on request at hello@letcompliance.com. We are registered with the UK Information Commissioner's Office (ICO) as a data controller, registration number ZC175264. For the purposes of UK GDPR and the Data Protection Act 2018, we are the Data Controller of the personal information of our account holders (landlords, letting agents and property managers). Where you use LetCompliance to process personal information about your tenants or applicants, you are the Data Controller of that information and we act as your Data Processor, handling it only on your instructions to provide the Service.

02What Data We Collect

• Account information: your name, email address and password (stored as a hash, we never see your password).
• Sign in with Google (optional): if you choose to sign in with Google, we receive your name, email address and profile photo from your Google account to create and sign you into LetCompliance. We never receive or store your Google password.
• Profile information: your mobile number, if you give it. You get one welcome text, and SMS reminders only if you switch them on, which needs a paid plan.
• Email copies (optional): if you add someone to receive copies of your emails, their email address, the name you give, the kinds of email they receive and whether they confirmed or stopped them. We send that person one email asking them to confirm, and nothing else unless they do.
• Property data: addresses, compliance certificate dates, financial figures you enter.
• Bank statement lines (optional): if you upload a statement from your bank, the date, amount and description of each transaction, so you can match them to rent and costs. The file itself is read in your browser and is not uploaded.
• Documents: files you upload (Gas Safety certificates, EICRs, EPCs, etc.) stored encrypted in Supabase Storage.
• Tax information (if you use our Making Tax Digital tools): your National Insurance number and the income and expense figures used to prepare quarterly updates and your year-end declaration.
• Connection and device data (if you connect to HMRC): your IP address, a device identifier, browser type, screen size, time zone and similar technical details. HMRC’s anti-fraud rules require this to be collected and sent with each submission (see Section 6).
• Billing information: processed entirely by Stripe. We store only your Stripe customer ID, not card numbers.
• Shop orders: if you buy a product from Landlord Essentials, we store your name, email and delivery address to fulfil and deliver the order, and to handle any return or refund. Your card is handled by Stripe; we never see it.
• Usage data: pages visited, features used, browser type. Used only to improve the product.
• Email activity: whether an email from LetCompliance was delivered and opened, and which of its links were clicked, as reported by our email provider (Resend). It shows which emails are useful.
• Your email choice: whether you ticked the box at sign-up to refuse emails about LetCompliance itself, or unsubscribed later (see Section 14).
• Template and checklist downloads: your email address, the IP address and browser of the request, which document it was and some of what you entered. For the tenancy and guarantor agreement templates and the compliance checklist, that includes the property address (and, for the checklist, the landlord name if you gave one); for the rent receipt, deposit receipt, rental application form, inventory, income and expenses spreadsheet, landlord reference letter, change of landlord letter, tenant welcome letter, tenant privacy notice and legionella risk assessment templates and the inspection and end of tenancy checklists, only the kind of document and its settings (for the reference letter, which answer it gives on the rent, the condition and the deposit; for the legionella record, the kind of water system, whether the home was occupied and how many checks need action; for the checklists, the kind of property, the rooms chosen and the deposit scheme), never the names, addresses, amounts or bank details you typed. Also kept: whether you ticked to receive three follow-up emails, and whether the email was delivered.
• Cookies: strictly necessary cookies for sign-in, security and payments, plus optional analytics and marketing cookies that stay off until you opt in (see our Cookie Policy).

03How We Use Your Data

• To provide the LetCompliance service: adverts and applications, tenancies and e-signing, rent and arrears, repairs, notices, tax records, certificate dates and reminders, and document storage.
• To send reminders about rent, certificates and other dates by email, which you can pause in Settings, and by SMS only if you switch SMS reminders on.
• To prepare and, on your instruction, submit Making Tax Digital updates and declarations to HMRC.
• To process payments and manage your subscription, and to operate rent collection where you enable it, via Stripe.
• To communicate with you about your account, updates and security.
• To email you about LetCompliance itself: set-up tips, what the paid plans add, what changes when your trial ends, a monthly summary and occasional news. You can refuse these at any time (see Section 14).
• To comply with legal obligations.
• We never sell your personal data or use it to build cross-site advertising profiles. Any analytics or ad-measurement happens only through cookies you have opted into.

04Legal Basis for Processing

We process your data under the following legal bases as defined by UK GDPR: (a) Contract: to deliver the service you signed up for. (b) Consent: for SMS reminders, which you can withdraw at any time in Settings. (c) Legitimate interests: to improve our product, prevent fraud and email you about LetCompliance’s own services (see Section 14). (d) Legal obligation: to comply with financial, tax and data regulations, including HMRC’s mandatory anti-fraud requirements.

05Data Sharing

We share data only with the following service providers and, where you choose to use those features, HMRC:

• Supabase (database and file storage), hosted in the EU (Frankfurt region). Personal data transferred from the UK to the EEA is protected by the UK Government’s data adequacy regulations for the EEA.
• Google (Sign-In), only if you choose “Sign in with Google” to authenticate. Google processes your sign-in under its own privacy policy (policies.google.com/privacy); we receive only your name, email address and profile photo. You can revoke access at any time in your Google Account settings.
• Stripe (payment processing and, where enabled, rent collection), PCI-DSS Level 1 certified.
• Resend (email delivery), used to send the emails the service sends for you and to you: your reminders, the messages and documents you send to your tenants through LetCompliance, account emails such as invitations, and the emails about LetCompliance described in Section 14. Resend also receives the bills you forward to your bills address, if you set one up.
• Brevo (SMS delivery), used only to send the one welcome text after you give a mobile number, the SMS reminders you switch on, and the one text confirming they are on.
• Vercel (application hosting), edge network infrastructure.
• Anthropic (AI features), used to read the certificates and receipts you upload or forward so their dates and figures can be suggested to you, to suggest a priority and trade for a repair report, and to answer the questions you ask the advisor. For a forwarded bill, only the attached file is sent, not the email itself. Anthropic processes this outside the UK and the EEA.
• HMRC (HM Revenue & Customs), only where you connect your account and submit Making Tax Digital information. We transmit your National Insurance number, the relevant income and expense figures, and the technical anti-fraud data HMRC mandates.
• People you choose to give access to your account, only when you do so. An accountant link, or an accountant seat on the Professional plan, shows your tax figures, ledger and receipts, not your tenant records; ledger descriptions you have written can still include a name. A viewer seat on the Professional plan shows your portfolio, including tenants’ names, rent records and documents (which can contain the contact details written in them), but not Right to Rent copies. Seats are read only: nobody with a seat can change anything or send anything to HMRC. You can remove a seat or a link at any time, and your activity log records when it is used and what is downloaded.

We do not share data with any other third parties without your explicit consent.

06Making Tax Digital and HMRC

If you connect LetCompliance to HMRC for Making Tax Digital for Income Tax, we use HMRC’s official, secure OAuth connection. We never see or store your HMRC or Government Gateway sign-in details, only a secure access token that you can revoke at any time by disconnecting. HMRC’s anti-fraud rules ("fraud prevention headers") legally require us to collect and transmit technical information about your device and connection, such as your IP address, a device identifier, browser type and screen size, with each request. This is mandated by HMRC, is not optional, and is used solely for HMRC’s fraud prevention. You are responsible for the accuracy of the figures you choose to submit; we provide the tools to prepare and send them.

07Rent Collection and Payments

Subscription billing and, where you enable it, Direct Debit rent collection are handled by Stripe. For rent collection we use Stripe Connect: your tenant authorises a Direct Debit, and rent is collected directly into your own connected Stripe account. We do not hold, control or have access to those funds. We store references such as payment and mandate identifiers needed to show the status of payments in your account, but we do not store full bank account details, which are handled by Stripe.

08Data Retention

We retain your personal data for as long as your account is active. If you delete your account, all personal data, including property information, documents and compliance records, is permanently deleted within 30 days. Billing and tax records are retained for the period required by UK law (generally up to 7 years).

If you set up a bills address, a short record of each email sent to it is kept: who sent it, when it arrived and whether it was filed. The subject and the text of the email are not kept. The bill itself is saved with your other receipts, and the record is deleted with your account.

09Your Rights Under UK GDPR

• Right of access: request a copy of all data we hold about you.
• Right to rectification: correct inaccurate data.
• Right to erasure ("right to be forgotten"): delete your account and all associated data.
• Right to restrict processing: limit how we use your data.
• Right to data portability: receive your data in a machine-readable format.
• Right to object: object to processing based on legitimate interests.
• Right to object to direct marketing: stop the emails about LetCompliance at any time, for any reason, with the unsubscribe link in any of them or by emailing hello@letcompliance.com.
• Right to withdraw consent: cancel SMS reminders at any time in Settings.

To exercise any of these rights, email hello@letcompliance.com. We will respond within 30 days. Where we act as Processor for tenant data, requests from your tenants should be directed to you as the Controller, and we will assist you in responding.

10Security

We implement industry-standard security measures: All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Authentication is handled by Supabase Auth, with secure password hashing for email sign-in, or via Google’s OAuth where you choose “Sign in with Google”. Row Level Security (RLS) ensures no user can access another user's data. HMRC access tokens are stored server-side only, restricted to backend access. We conduct regular security reviews and apply updates promptly. If a personal data breach occurs, we have procedures to detect, investigate and contain it. Where a breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office (ICO) without undue delay (and within 72 hours of becoming aware, where required), and we will inform you without undue delay where the breach is likely to result in a high risk to you.

11Cookies

Strictly necessary cookies (sign-in, security, payments) are always on. Analytics (Microsoft Clarity) and marketing (Google) cookies are optional, off by default, and only set if you opt in via our cookie banner; rejecting them is as easy as accepting. You can change your choice or delete cookies via your browser at any time. See our Cookie Policy at /cookies for the full list and detail.

12International Data Transfers

We aim to keep your personal data within the UK and the European Economic Area (EEA). Our primary database and file storage (Supabase) are hosted in the EEA (Frankfurt), and transfers from the UK to the EEA are protected by the UK Government’s data adequacy regulations. Some of our service providers (for example Stripe, Google, Resend, Brevo and Vercel: see Section 5) may process limited personal data outside the UK and EEA, including in the United States. Where they do, we rely on a UK adequacy regulation (such as the UK Extension to the EU–US Data Privacy Framework) or on appropriate safeguards required by UK GDPR, such as the International Data Transfer Agreement (IDTA) or Standard Contractual Clauses. Making Tax Digital submissions are sent to HMRC’s systems in the UK.

13Automated Decision-Making and Profiling

We do not make decisions that produce a legal or similarly significant effect on you based solely on automated processing. Some features use automation to assist you, for example our AI tools (which suggest, triage or summarise based on the information you enter) and tenant referencing (where a regulated UK credit reference agency carries out an automated affordability and credit assessment). These produce information and suggestions for you to review; the final decision, such as whether to let a property or accept a tenant, is always made by you, not by us. You can ask us about any automated processing, request human review, or object, by emailing hello@letcompliance.com.

14Emails about LetCompliance

As well as the emails the service sends because you set them up (reminders, documents, receipts, sign-in and billing emails), we email account holders about LetCompliance itself: set-up tips, what the paid plans add, what changes when your trial ends, a monthly summary of your properties and occasional news. Your welcome email names the plan prices too. We send these under the "soft opt-in" in regulation 22(3) of the Privacy and Electronic Communications Regulations 2003: you gave us your email address when you signed up for a trial of our paid plans, and these emails are only about LetCompliance’s own services. Our lawful basis under UK GDPR is legitimate interests. You can refuse them when you sign up, with the box marked "Don’t email me set-up tips or plan offers. Reminders and account emails still arrive." on the sign-up page, and in every one of them, with the unsubscribe link at the bottom. Either stops them straight away and costs nothing. If you open an account with Google from the sign-in page, which has no box, the same box is shown while you set up the account. You will still get the emails the service needs to send, such as a certificate reminder, a failed payment notice or a change to our terms.

15Changes to This Policy

We will notify you by email if we make material changes to this privacy policy. The "Last updated" date at the top of this page will always reflect the most recent version.

16Contact & Complaints

For any privacy questions, or to report a security or data concern, contact us at hello@letcompliance.com. If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.