Privacy policy
DRAFT for Tristan to review. Not legal advice. Fill in the parts in [square brackets]. Check the ICO's guidance and whether you need to pay the ICO data protection fee (https://ico.org.uk/for-organisations/data-protection-fee/) before taking real sign-ups.
Last updated: [date]
HouseOnTheHunt ("we") is run by [Your name], a sole trader and student at the University of Exeter. We are the controller of your personal data. Contact: [your email].
What we collect, and why
| What | Why | Legal basis |
|---|---|---|
| The lead's name and email address | To send your group's alerts and account emails, and to log you in | Contract |
| Phone number (optional) | Only for WhatsApp alerts, if we add them later | Consent (you choose to give it) |
| Your group's search: group size, budget, areas, housing types, move-in dates, walking limits, bills preference | To match houses to your group | Contract |
| Which alerts we sent you, and which listing links you clicked | To avoid sending the same house twice, to show your history on your account page, and to measure which houses people view | Contract, and our legitimate interest in running and improving the service |
| Viewing requests you choose to send. The agent gets your name, your email, your group size, your move-in date, the statements you tick (such as "we are all full-time students") and your message. We keep that, the agent's address, when it was sent and whether the agent replied | To send your request to the agent in your name, and to track agents' reply speed | Contract. You tick a box agreeing that your name and email go to the agents you contact |
| Payment details | Stripe handles them; we never see or store your card number. We keep Stripe's reference numbers and an anonymous "fingerprint" of the card | Contract. The card fingerprint is our legitimate interest in stopping referral fraud and repeat free trials (one free trial per card) |
| Referral links and who joined through them | To give the 5-day referral reward | Contract |
| A refund request, if you send one | To decide on it | Contract and legal obligation |
| Your email on the waitlist | To tell you when sign-up opens | Consent |
| Promotional emails | Only if you tick the separate box | Consent (you can withdraw it at any time) |
We collect only what matching needs. We never sell your data, and we never share it with landlords or agents except when you send a viewing request yourself.
Who processes it for us
| Service | What it does | Where |
|---|---|---|
| Supabase | Database and login | [EU or UK region chosen at setup] |
| Stripe | Payments | UK/EU, with transfers to the US |
| Resend | Sending emails | US |
| Cloudflare | Hosting the website | Global |
| DigitalOcean | The server that finds listings and sends alerts | London |
Some of these transfer data outside the UK. When they do, it is protected by the UK's adequacy rules or the UK International Data Transfer Addendum, as set out in each provider's own terms.
The listings themselves come from letting agents' public adverts and contain no personal data about you.
How long we keep it
- Your account: until you delete it. "Delete my account" on your account page removes your group, alerts, history, viewing requests and login straight away.
- Free trial record: after you delete your account we keep a one-way scrambled (hashed) copy of your email and your card's fingerprint, only to stop repeat free trials. Neither can be turned back into your email or card number.
- Backups: your data disappears from the 7 daily backups within 7 days.
- Payment records: Stripe keeps them as the law requires (for tax, normally 6 years).
- Server logs: deleted after 14 days. They don't contain the contents of your alerts.
Cookies
We use only what logging in needs: your login session, stored in your browser. There are no advertising or tracking cookies.
Your rights
You can ask to see, correct or delete your data, to object to how we use it, or to take a copy with you. Email [your email] and we'll reply within one month. Most of this you can do yourself on your account page.
If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/
Who it's for
HouseOnTheHunt is for university students aged 18 or over.