Privacy Policy
1. Introduction
HouseFile ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our compliance document platform and website.
2. Information we collect
We collect information that you provide directly to us, including:
- Account information (name, email address, password)
- Your name and email address from Google, if you choose to sign in with Google
- Property and tenancy details, such as addresses, tenancy dates, rent and which scheme protects the deposit
- Documents you upload (EPCs, gas safety certificates, etc.)
- Details of tenants and other people you add, such as their names and email addresses
- Payment information (processed securely via Stripe)
- Communications you send to us
When a tenant uses a tenant link, we record which documents they open and when, the name they enter, their responses, and the IP address they used, so the landlord has a record of delivery.
Certificate reminders. If you ask for a reminder at housefile.app/certificate-reminders, we keep your email address, the type of certificate, its date and the nickname you gave the property, to send the reminders you asked for. We use your consent for this, and the address for nothing else. You can unsubscribe from any reminder, which stops them all. We delete the address when you unsubscribe, a week after signing up if you never confirm, and a year after the certificate’s date otherwise.
Booking links. Some pages link to companies that carry out landlord certificates, and some of those links may earn us a commission. When you follow one, we record the company, the page, where on the page the link was and the host name of the site you came from. We record no IP address, no cookie and nothing that identifies you. How we label these links.
We automatically collect certain information when you use our service:
- Log data (IP address, browser type, pages visited)
- Device information
- Usage data and analytics, including through Google Analytics (see section 8)
3. How we use your information
We use the information we collect to:
- Provide, maintain, and improve our services
- Read the documents you upload so we can suggest their title, category and expiry date
- Process transactions and send related information
- Send you reminders, technical notices and support messages
- Respond to your comments and questions
- Track document access for compliance purposes
- Find and fix errors, and detect and prevent fraud or abuse
4. Information sharing
We do not sell your personal information. We may share your information in the following circumstances:
- With tenants you choose to share property information with via tenant links
- With letting agents or other people you give access to your account
- With the service providers listed in section 9, who process it for us to run HouseFile
- If required by law or to protect our rights
- In connection with a merger, acquisition, or sale of assets
5. Data security & document storage
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.
All documents uploaded to HouseFile are stored with Supabase, on AWS infrastructure in Zurich, Switzerland, with the following protections:
- Encryption at rest: all stored files and data are encrypted using AES-256 encryption
- Encryption in transit: all data transferred between your device and our servers is protected via TLS/HTTPS
- Access controls: documents are only accessible to the property owner, people they give access to, and tenants who have been given a valid sharing link
- Infrastructure compliance: Supabase, which stores our data, and Vercel, which hosts the website, are both SOC 2 Type II certified
- Isolation: each user's data is logically separated using row-level security policies, ensuring no cross-account access
- No selling or advertising: uploaded documents are never sold or used for advertising, and are only processed by the service providers in section 9 to run HouseFile
- Limited staff access: only the people who run HouseFile can reach the systems that hold your data, and they only look at your documents or property information when you ask for support, to fix a problem, or when the law requires it
Payment information is handled exclusively by Stripe and is never stored on our servers. Stripe is PCI DSS Level 1 certified, the highest level of certification in the payments industry.
6. Data retention
We retain your personal information for as long as your account is active or as needed to provide you services. You can request deletion of your account and associated data at any time by contacting us.
7. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Object to processing of your data
- Request data portability
- Withdraw consent at any time
To exercise these rights, please contact us using the details below. You can also complain to the Information Commissioner's Office at ico.org.uk.
9. Third-party services
These service providers process data for us to run HouseFile:
- Supabase: data storage, sign-in and file hosting, with data held in Zurich, Switzerland (SOC 2 Type II certified)
- Vercel: hosting the website and app (SOC 2 Type II certified)
- Stripe: payment processing (PCI DSS Level 1 certified)
- Resend: sending emails, such as password resets, reminders and notifications
- Anthropic: reading the documents you upload so we can suggest their title, category and expiry date. The file is sent to Anthropic's API for this, and under Anthropic's commercial terms it isn't used to train its models
- Google: Google Analytics for website usage, Google sign-in if you choose it, and YouTube for the videos on some pages, which load only when you press to watch one, or straight away if you have chosen that
- Sentry: error monitoring, which can include your account ID but not your email address
- ImprovMX: forwarding emails sent to our support addresses
- postcodes.io and the government EPC register: looking up a property's location or EPC from the postcode or address you enter
Each of these services has their own privacy policy governing their use of your data. We only share the minimum information necessary for each service to function.
Some of them process data outside the UK, including in the United States. Where they do, we rely on the safeguards UK data protection law requires, such as adequacy regulations or standard contractual clauses.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.
11. Contact us
If you have any questions about this Privacy Policy or our data practices, please contact us at: