Privacy Policy
This Privacy Policy explains how MyTenancyFile ("we", "us", "our") collects, uses, and protects your personal data when you use the Service at mytenancyfile.co.uk. We are committed to handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
The data controller is Richard Miles, trading as MyTenancyFile, of 3 Daffodil House, Warwick Road, Redhill, Surrey, RH1 1DH, United Kingdom. For any privacy questions or to exercise your rights, contact support@mytenancyfile.co.uk.
2. Personal data we collect
- Account data: email address, encrypted password, and authentication identifiers.
- Tenancy data you provide: property address, tenancy dates, room and condition notes, and the photographs you upload as part of your inspection.
- Subscription and billing data: plan, status and renewal dates. Card details are collected and processed by Paddle (our Merchant of Record) — we never see or store your full card number.
- Support communications: the contents of emails or messages you send us.
- Technical and analytics data: IP address, device and browser type, pages visited, referring URL, and interaction events collected via Google Analytics.
3. How we use your data and our legal basis
- To provide the Service (creating your account, storing your tenancy files, generating PDF reports) — legal basis: performance of our contract with you.
- To process payments and manage subscriptions via Paddle — legal basis: performance of contract and legal obligation (tax and accounting).
- To keep the Service secure, prevent fraud, and investigate abuse — legal basis: our legitimate interests in protecting the Service and our users.
- To improve the Service through analytics — legal basis: your consent (where required) or our legitimate interest in understanding usage.
- To send essential service emails (e.g. password resets, billing receipts, important changes) — legal basis: performance of contract.
- To comply with legal obligations, including responding to lawful requests from authorities — legal basis: legal obligation.
4. Who we share data with
We share personal data only with the following categories of recipients:
- Hosting and infrastructure providers who host the application, database and image storage on our behalf.
- Paddle.com Market Ltd, our Merchant of Record, for processing payments, managing your subscription, calculating and remitting taxes, and issuing invoices.
- Google Analytics (Google Ireland Ltd) for website analytics. We configure analytics to minimise personal data exposure where possible.
- Professional advisers (legal, accounting) where reasonably necessary.
- Authorities or third parties where required by law or to protect our rights.
We do not sell your personal data.
5. International transfers
Some of our service providers (including Google) may process data outside the United Kingdom or European Economic Area. Where this happens, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses.
6. How long we keep your data
- Account and tenancy data: for as long as your account is active. If you delete your account, we delete or anonymise your data within 30 days, except where we must keep records to comply with a legal obligation.
- Billing records: retained for at least 6 years as required by UK tax law.
- Support emails: retained for up to 24 months after the issue is resolved.
- Analytics data: retained according to Google Analytics' default retention settings (currently 14 months).
7. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- request correction of inaccurate or incomplete data;
- request erasure of your data ("right to be forgotten");
- restrict or object to certain processing;
- request a portable copy of data you have provided;
- withdraw consent at any time where processing is based on consent;
- complain to the Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any of these rights, email support@mytenancyfile.co.uk. We will respond within one month.
8. Security
We use appropriate technical and organisational measures to protect your data, including TLS encryption in transit, encryption at rest for stored files, access controls, and regular security reviews. No system is 100% secure, but we take reasonable steps to prevent unauthorised access, loss or disclosure.
9. Cookies and tracking
We use a small number of cookies and similar technologies:
- Essential cookies for authentication and session management. These cannot be switched off.
- Analytics cookies set by Google Analytics to help us understand how the Service is used. These are only set where local law allows or where you have given consent.
You can manage cookies through your browser settings. Disabling essential cookies may prevent you from signing in.
10. Children
The Service is not directed at children under 16, and we do not knowingly collect data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Changes to this Policy
We may update this Privacy Policy from time to time. If we make material changes we will notify you by email or via a notice on the Service. The "Last updated" date at the top shows when the policy was last revised.