Privacy Notice

Who is responsible

The data controller for this site is:

Daryl Summers trading as UpRently
Lytchett House
13 Freeland Park
Wareham Road
Poole
Dorset
BH16 6FA
United Kingdom

We are registered with the Information Commissioner’s Office (ICO). Our registration number is ZC267581, and you can check it on the ICO’s public register(opens in new tab).

You can contact us about anything on this page, including a request to see, correct or delete your data. You can also email us at contact@uprently.com or write to us at the address above.

The short version

You do not need an account. We do not track you across the web, and we do not sell or share your data for marketing. There are three stages and they are different: while you are filling the form your answers are kept in your browser only; when you press the button to run the check they are sent to our server; and a free check that you do not buy anything from is deleted within 48 hours.

What we collect and why

When you run a free check

We collect your full postcode, the property type, the number of bedrooms, the current and proposed rent, and any notice or tenancy dates you enter.

The step headed “About your home” also collects the internal floor area, the number of bathrooms, roughly when the property was built, the standard of finish, what outdoor space there is, and how many off-street parking spaces there are. These details help us produce a separate rental estimate for your home rather than relying only on the wider local market. The step headed “Your property” asks for your address, which is explained under Your address below.

We need all of these to produce a result. We store them briefly so that if you buy an Evidence Pack, the document is built from the figures our server calculated rather than from anything sent back by your browser.

Our lawful basis is legitimate interests: running the service you asked for, and making sure a paid document is accurate.

Your address

The checker begins with your postcode. When you continue, we check it with postcodes.io and send it to PropertyData, which returns the homes there that have an Energy Performance Certificate. On the next screen we show them as a list: property information supplied by PropertyData, using Energy Performance Certificate and related property data. If your home is not in the list, you type the first line of your address instead.

The list shows addresses only. When you select yours, we fill in its recorded floor area, which makes the comparison more accurate, and you can change that figure. We do not send your browser the floor areas of the other homes in the list.

We use your address to fill in that floor area and to print it in your Evidence Pack, so the document says which home it is about. It is not used to work out your result, and it is not sent to PropertyData, to our AI supplier or to anyone else. Only your postcode is sent to find the list, and the list is not stored: it is held in the page while you use it, not in your browser’s storage, and it is gone if you reload. Our server keeps the list for a postcode in its memory for up to 15 minutes, so that a second look does not ask PropertyData again. It is never written to our database.

A free check you do not buy from is deleted, address included, within 48 hours. If you buy an Evidence Pack, we keep your address until the pack has been made, stored and sent to you, and then remove it from our records; a nightly check removes any that was missed. It stays in the pack itself, which we keep with your order so that, if you ask, we can send you the same document again.

Our lawful basis is legitimate interests for the free check, and performance of a contract for the Evidence Pack.

When you buy an Evidence Pack

Stripe handles the payment. Your card details are entered into Stripe’s own form and never reach us. We do not see, receive or store your card number.

Stripe gives us your email address so we can send you the pack, and Resend processes your email address and the pack itself to deliver that email. We do not store your email address in our own database. It is not one of the fields in our own order record, which holds the outward part of your postcode, the property details, the rent figures, the result, the amount paid, and your consent to immediate delivery. On the Resend plan we use, the email content and delivery logs it holds are kept for 30 days.

Our lawful basis has three parts. Performance of a contract covers producing and sending you the pack. Legal obligation covers the financial and tax records we are required to keep. Legitimate interests covers the rest of what we hold about the check and the pack: enough to answer a question you raise about what you bought, to deal with a complaint or to establish, exercise or defend a legal claim if a dispute about the sale were ever raised.

When you contact us

The contact form collects your name, your email address, the subject you pick, your message, and an order reference if you give one. We need your email address to reply to you. We do not use any of it for marketing, and we never add you to a list.

Please do not put anything into the message box that you would not want kept in an email inbox. If you are writing about an order, the reference on your pack is enough to find it, and you do not need to repeat your address or your rent.

Our lawful basis is legitimate interests: answering the person who has written to us. Where you are writing about an order you have placed, it is performance of a contract. Where you are making a data protection request or a data protection complaint, it is a legal obligation.

Preventing abuse

Every check costs us money, because it calls paid services. To stop the site being used to run up that cost, we count requests per visitor. We do this by turning your IP address into a one way hashed value using a secret key, and counting against that. Your IP address itself is never written down.

We will not tell you that reversing the hashed value is impossible, because that would overstate it. Anyone who held both our database credentials and the secret key could work back from one, since there are only about four billion addresses to try. That is why these counters hold nothing except a count and a reset time, and why they are deleted about an hour after they stop being used.

Our lawful basis is legitimate interests: keeping the service available and affordable.

Counting checks

We keep a count of the checks that are run: the date, whether it was a tenant or a landlord check, the result, and how strong the evidence was. Nothing in that count identifies you. It holds no postcode, no rent figures and no link to your check, and it is what lets us see whether the service is being used.

The count also records the page on this site you came from, such as a guide, and the name of the website that sent you, such as google.com. It does not record the full web address of that website or anything you searched for.

There is no lawful basis to give for this one, because the count is not personal data. It cannot be traced back to you, to your check or to your device, so data protection law does not apply to it. We say so here rather than leaving the only gap in this list unexplained.

Page views

We use Vercel Web Analytics to count visits and see which pages people use. It is cookieless. It stores nothing on your device, does not follow you to other websites, and does not build a profile of you. It records the page visited, the referring site, and general details such as country, browser and device type. It does not record your name, your email address, or anything you type into the checker.

Our lawful basis is legitimate interests: understanding whether the service works and is being found. You can block it with any standard content blocker and the checker will still work normally.

Cookies and similar storage

We do not set any cookies of our own. UpRently uses browser session storage while you complete the checker. This is not a cookie.

This storage keeps your checker answers so a reload or a stray tap does not lose them. It stays on your device while you complete the checker, we never see it, and it is cleared when you select start again, when you close the tab, or after 24 hours. It does not hold your address or the list of homes at your postcode: those are kept only in the page while you use it. It is used only for the checker journey you asked for. The law treats this as strictly necessary for the service you requested, so it does not require consent and we do not ask you to accept it.

When you open the payment form, Stripe loads its payment script and sets two cookies to assess payment risk and detect fraud. These are strictly necessary to provide and secure the payment you have asked to make, which is why we do not ask you to accept them either. Verified directly in the browser: they are genuinely not present until you open the payment form, and nothing else is set by Stripe before or during an ordinary checkout.

If you close the payment form without paying, you can delete both in your browser settings. Nothing on this site depends on them outside checkout.

How long we keep things

• Free checks you do not buy from: deleted automatically after 48 hours.
• The comparable properties behind any check: deleted after 60 days, which is the limit our data supplier’s licence allows. This applies whether or not you bought a pack. The figures worked out from them, and any pack already generated, are not affected: a pack is a finished document, not a live link back to that data.
• Orders, the check behind them and the pack we generated: deleted six years after the order. Six years is our own retention period, not a period the law sets for everything we keep. We chose it because it covers what a purchase can reasonably need: supporting you if you have a question about a pack you bought, dealing with a complaint, and covering the Limitation Act 1980 time limit for bringing a contract claim if a dispute about a sale were ever raised. We also keep the financial records we need to meet our tax and accounting obligations, for the period HMRC requires. The one exception is your address: it is removed from our records once your pack has been sent, and is then kept only in the pack itself.
• Abuse prevention counters: deleted about an hour after they stop being used.
• Messages you send us: kept in our email inbox for up to two years, then deleted. A message about an order is kept with the order records for six years instead, because it may matter if there is ever a dispute about that sale.

Personal data covered by the automated retention periods above is removed by a scheduled job once its retention period has passed. The database also holds records outside those categories, such as aggregate counts that are not personal data and day-to-day operational records, and those follow their own rules rather than this list.

Email is the exception, and we would rather say so than imply otherwise. Our inbox is not on that schedule and messages are cleared by hand. If you want a message you have sent us deleted sooner, ask us. We will delete it where we no longer need to keep it for a legal, contractual or dispute-related reason.

Who we share it with

Only the suppliers that make the service work. Each one is listed below with its own privacy notice, so you can see what it does with what it receives.

• Stripe takes the payment and holds your email address for the receipt. Stripe’s privacy notice(opens in new tab).
• Supabase holds our database and the packs we generate. Supabase’s privacy notice(opens in new tab).
• Vercel hosts the site. As well as the cookieless page view counting described above, hosting itself means Vercel handles ordinary request information, including your IP address, to serve pages securely. This is separate from the page view counting, which is deliberately built not to store that. Vercel’s privacy notice(opens in new tab).
• Resend sends your emails. Resend’s privacy notice(opens in new tab).
• Google hosts our email inbox (Google Workspace). Messages you send through the contact form, and emails you send us, are kept there. Google’s privacy notice(opens in new tab).
• Anthropic writes the short summary of your result. Only the property type, bedroom count, outward postcode and rent figures are sent. Your name, your email address and your full postcode are never sent. Anthropic’s privacy notice(opens in new tab).
• postcodes.io tells us whether a postcode exists and which country it is in, so we can say straight away if we cannot cover it. It is maintained by Ideal Postcodes, who say that processing associated with address requests is hosted in UK or EU data centres. Our server asks, not your browser, so it never sees your device or your IP address, and we send the postcode on its own with nothing else attached. The public postcodes.io service does not publish a specific log-retention period, or a privacy notice of its own. See the postcodes.io documentation(opens in new tab), and Ideal Postcodes’ privacy policy(opens in new tab), which covers its own services and does not name postcodes.io.
• PropertyData, our rent data supplier, receives your full postcode, the property type and the bedroom count to find comparable local rents. For the separate estimate for your own home it also receives the floor area, the number of bathrooms, roughly when the property was built, the standard of finish, the outdoor space and the parking. To list the homes at your postcode it receives the postcode on its own. It does not receive your name, your email address, your address or your rent figures. PropertyData’s privacy notice(opens in new tab).

We do not sell your data, and we do not share it for anyone else’s marketing.

AI and automated decisions

The verdict is worked out by fixed rules from the figures: give the checker the same figures and it gives the same result. The short summary paragraph is written by Anthropic’s AI model from those figures. Before you see it, we check it against them, and if it names a figure we did not give it or describes the comparison the wrong way round, we replace it with a paragraph written by fixed rules.

Neither has any legal effect on you, and neither decides anything about you, so this is not the kind of automated decision-making that Article 22 of the UK GDPR covers. They are information you can act on, or ignore, as you choose. How UpRently works sets out the method.

Your rights

Depending on why we are processing your data, you can ask us to give you a copy of it, correct it, delete it, or restrict how we use it. Not every right applies to every kind of processing on this page; which ones apply depends on the circumstances. Send us a data protection request and we will normally respond within one month. If your request is complex, or you have made several, we may need up to two more months; if so, we will tell you within the first month and explain why. Because we do not run accounts, please include the email address you used at checkout, or your order reference, so we can find your order. Every time we commit to is listed in how quickly we respond.

Where the right applies, meaning where we are using your information under a contract and processing it by automated means, you can also ask for the information you gave us in a structured, commonly used and machine-readable format, so you can pass it to someone else. This is sometimes called the right to data portability. It mainly covers what we hold about a purchased order rather than a free check, and it does not cover the verdict we calculate or the summary the AI writes, since those come from our own processing rather than from you.

Your right to object

We rely on legitimate interests for some of what we do with your information, for example running a free check and preventing abuse of the service. Where we do, you can object. If you object, we will stop that particular use of your information unless we have compelling legitimate grounds to continue, or we need to keep using it to establish, exercise or defend a legal claim.

If you are unhappy with how we have handled your data, tell us. Send us a data protection complaint through the contact form, choosing that subject. We will acknowledge it within 30 days, look into it without unnecessary delay, keep you updated and tell you what we found and what we did about it.

You do not have to complain to us first, or at all. You can complain to the Information Commissioner’s Office instead, or as well, at any time, at ico.org.uk(opens in new tab).

International transfers

PropertyData is a UK company. Stripe, Vercel and Resend are US companies certified under the UK Extension to the EU-US Data Privacy Framework, the UK’s approved arrangement for sending personal data to a certified US company. Resend’s transfers are also covered, in addition, by the EU Standard Contractual Clauses as amended by the UK Addendum, under Resend’s own data processing agreement with us. Google is a US company certified under the UK Extension to the EU-US Data Privacy Framework.

Supabase is a US company that relies on standard contractual clauses with the UK addendum. Anthropic is also a US company: its data processing agreement is incorporated into its Commercial Terms, and that agreement incorporates the EU Standard Contractual Clauses and the ICO’s UK International Data Transfer Addendum. Standard Claude API inputs and outputs, meaning what we send it and what it returns, are normally deleted from Anthropic’s systems within 30 days.

postcodes.io, run by Ideal Postcodes, is not part of this international-transfers list: Ideal Postcodes say the processing it involves is hosted in UK or EU data centres, not transferred outside them. See “Who we share it with” above for what we send it.

You can contact us if you want more information about the safeguards used for these transfers or, where applicable, a copy of them.

Last updated 19 October 2026