Privacy notice
Last updated 5 October 2026
This notice explains what personal data RentAProperty holds, why, for how long, and your rights. The controller is Byte Projects Ltd; details are in the legal notice. Our registration number with the Information Commission is ZA895112. Write to [email protected] about anything here.
What we hold
- Your account: your email address, name and photo if you give them, when you joined, and whether your email address is verified. Sign-in itself (codes, Google sign-in, sessions) is handled by Clerk for us.
- Letting agency details, if you add them: your branch's name, address, phone, website, Companies House number, redress scheme and membership number, client money protection scheme and fees link, and the results of our verification checks (see where we get data). For an agent who is a sole trader or partnership, these are personal data. Staff see all of them; once the agency is verified, its adverts show the name, branch address, schemes and fees link.
- Your adverts: what you write, and the photos and floor plans you upload. The exact point you drop on the map and any address you add are private: only our staff see them, and staff use the address only to check that the home is where your pin says. The public map shows only a circle about 1 km across, and the home could be anywhere inside it. We remove all hidden information, including location, from photos and floor plans. The EPC details you give, including any exemption reason or "EPC to follow" declaration and its dates, are part of the advert. When you close an advert, we keep how it ended and, if you choose to say, the conversation it came from, for our statistics.
- Where you post from: the country Cloudflare reports for your connection when you send an advert for review, kept with the review, as a weak sign of adverts posted far from the home.
- Messages you send and receive, and whether a message was held by our checks.
- Saved searches and saved adverts, and the digests we send you. Unless you untick the box when you post, an advert also follows the other side near it (new homes in your areas within your budget, or new tenants looking near your home whose budget covers the rent), as saved searches you can pause or delete.
- Reports you make, and reports and decisions about you or your adverts.
- Results of our checks: what our automated checks noticed about your adverts, messages and account, the AI's suggestions about your adverts, and, for a letting agency, which approvals were automatic and which safeguard paused them.
- Security signals: salted, pseudonymous fingerprints (hashes) of your network address range and browser, used only to spot someone returning after a suspension.
- How you found us: your answer to "How did you hear about us?", and any ref or campaign code in the link you signed up from.
- Technical records: our servers keep logs that can include IP addresses, for security and to fix faults.
- Visit statistics: the pages viewed, where a visit came from, the type of browser and device, and the country and city worked out from a shortened IP address, collected by Zooch and never linked to your account. You can turn them off in the cookie policy.
We also count searches (the place, filters and number of results) without any link to you or your account. To count how many different people search each day, each search carries a code made from the first part of your network address and your browser type, mixed with a key that changes every day and is then deleted: searches can be counted per day, but never linked to you, to your device from one day to the next, or to your IP address.
Where we get data
Most of what we hold comes from you, or from how you use RentAProperty. For a letting agency that gives us a Companies House number, we send that number to the public Companies House API and keep what the register returns (the company's name, status, registered office and business activity codes) as evidence for verification. While the agency is verified, we check it again every month.
Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Running your account, publishing adverts, delivering messages and the emails you asked for | Our contract with you (UK GDPR Art. 6(1)(b)) |
| Checking adverts and messages for scams and rule breaking, verifying letting agencies, handling reports, preventing repeat accounts | Our legitimate interest, and yours, in a safe service (Art. 6(1)(f)) |
| Understanding how the service is used (counts and visit statistics, not individuals) | Legitimate interest |
| Keeping records of moderation decisions and answering authorities | Legal obligations (Art. 6(1)(c)) and legitimate interest |
| Keeping EPC declarations, to show what an advertiser told us | Legitimate interest (Art. 6(1)(f)) |
You can object to processing based on legitimate interest by writing to us; we will stop unless we have compelling grounds, such as preventing fraud.
Automated checks and AI
Automated checks look for signs of scams and rule breaking in adverts and messages. Two AI models read the text of adverts (not messages, and not photos) and suggest to our staff what to do. They are run for us by OVHcloud in France; OVHcloud does not keep or share what it reads.
A person decides whether to refuse or remove an advert, remove a message, or suspend an account, and a person approves every advert from private landlords and tenants.
Automatic approval for letting agencies. A verified letting agency's routine changes (the rent and its period, the deposit, the available date and the order of photos) are approved automatically. So are its new adverts, once a person has approved three of them, if both AI models judge the advert clear and no automatic check flags a serious problem. Safeguards send the change to a person instead, and pause automatic approval for the agency until our staff resume it; the terms list them. A person checks one automatic approval in twenty afterwards.
Three things happen automatically, before a person has looked, and each waits for one:
- Held messages. A message that matches known scam wording, an offer of a home in exchange for sex, or a phrase we have blocked is held, and the other person does not see it until our staff release it.
- Hidden adverts. An advert reported by three different people is hidden until our staff have looked at it.
- Limited accounts. An account that sends the same first message to more than three adverts within an hour keeps a new account's daily limits until our staff have reviewed it. We email you the reasons when this happens.
To challenge any of these, reply to the email about it or write to [email protected], and a person will look at it again.
Our staff read a conversation only if someone reports it. When a message is held, they see that message and the two before it, and nothing else of the conversation.
Who we share it with
Other users see what you publish: your adverts, your first name, when you joined, whether your email is verified, and the messages you send them. A verified letting agency's adverts also show its name, branch address, redress scheme and membership number, client money protection scheme and fees link. Nobody sees your email address or a home's exact location through RentAProperty.
These companies process data for us, under contracts that protect it:
| Company | What for | Where |
|---|---|---|
| Clerk | Sign-in and accounts | USA |
| Novu | Deciding how notifications reach you, and the notification feed | EU |
| Postmark (ActiveCampaign) | Sending email | USA |
| Microsoft Azure | Storing photos, floor plans and backups | Germany |
| OVHcloud | Servers and the database; AI review of advert text | Germany and France |
| Cloudflare | Delivering the site securely, bot protection | Worldwide |
| Google (Workspace) | Our support mailbox, when you write to us | EU and USA |
| Zooch | Visit statistics | Germany |
Data held in the EU is covered by the UK's adequacy regulations for the European Economic Area. Transfers to the USA, and through Cloudflare's worldwide network, rely on the UK Extension to the EU–US Data Privacy Framework, with standard contractual clauses and the UK Addendum in each company's contract.
Maps are drawn from OpenFreeMap tiles that your browser loads directly, so OpenFreeMap sees your IP address, as any website you visit does.
We give information to authorities only when the law requires it, or to protect someone from serious harm.
How long we keep it
| Data | How long |
|---|---|
| Your account and profile | While your account is open; erased within 30 days of deletion |
| Letting agency details and verification evidence | While your account is open; deleted when you delete your account |
| Adverts | While your account is open. An expired advert can be renewed for 90 days, then it closes. Photos and floor plans of closed, removed or refused adverts are deleted 30 days after they stop being shown |
| Messages | While either person's account is open; a deleted account shows as "Deleted user" |
| Uploads never finished | 24 hours |
| Notification records | 90 days |
| Server logs, which can include IP addresses | Overwritten as they grow, usually within a few weeks |
| AI review records | 12 months, then only counts and costs |
| Results of our checks | 12 months; 3 years if they were serious or we acted against you |
| Security signals | 12 months |
| Search counts | 13 months, then monthly totals |
| Visit statistics | 25 months, then anonymised |
| Moderation decisions, reports, audit records and evidence of abuse | 3 years from the decision; a report not yet decided is kept until it is |
| Backups | Up to about 45 days, including 7 days in which deleted backup files can still be recovered, plus monthly backups for 12 months; deletions are applied again after any restore |
Deleting your account
Delete your account from your profile. Your adverts close at once and leave the site, and your letting agency's details and verification evidence are deleted. Your profile, your photos and floor plans, and your adverts' text, exact location and address are erased within 30 days. What is left of an advert, such as its rent, the home's details and approximate area, is kept for our statistics without anything that identifies you. Messages stay visible to the other person, from "Deleted user", until they delete their account too. If we refused or removed one of your adverts, or suspended your account, that advert is kept as evidence for up to three years; an advert with a report still being decided is kept until the report is decided.
Your rights
Under UK data protection law you can ask for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive the data you gave us in a portable format. Write to [email protected]; we reply within a month.
If you are unhappy with how we use your data, complain to us at the same address: we acknowledge a complaint within 30 days and tell you the outcome. You can also complain to the Information Commission, the UK's data protection regulator (ico.org.uk).
Cookies
We use the cookies the site needs to work, and cookies for visit statistics that you can turn off. See the cookie policy.
Children
RentAProperty is for people aged 18 and over.
Changes
We will update this notice when what we do changes, and tell you about important changes before they apply.