Privacy Policy

This policy explains how HomeTenant collects and uses personal data. It covers four different people, and the rules are different for each:

• Landlords who hold a HomeTenant account (you sign up, you are billed, you use the dashboard);
• Tenants whose landlord has added them to HomeTenant, who use WhatsApp or the chat app to report repairs and get updates;
• Engineers and contractors a landlord adds to their roster, who receive job dispatches over WhatsApp;
• People who sign up to HomeTenant Acquire, our property screening tool, with their email address (see section 3).

HomeTenant is operated by Cressoft Consultancy Limited, a company registered in England and Wales under company number 07628636, with its registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, England ("HomeTenant", "we", "us").

Questions about this policy or your data: support@hometenant.ai, or see our Contact page.

This is the part that matters most and is easy to get backwards, so we set it out plainly.

• For your own account data as a landlord (your name, email, billing details, how you use the dashboard), HomeTenant is the data controller. We decide why and how that data is processed, and this policy is our controller notice to you.
• For your tenants' and engineers' personal data that you add to HomeTenant or that flows through it (names, phone numbers, messages, photos, videos, voice notes, rent and tenancy information, signatures), you, the landlord, are the data controller, and HomeTenant is your data processor. You decide to add a tenant to HomeTenant, you decide what property and room they're linked to, and you are the one with a relationship with them as their landlord. We process that data only on your instructions, as set out in our terms of service and in the data processing terms there.
• This means it is your responsibility, as landlord, to have a lawful basis for giving us your tenants' data and, where appropriate, to tell your tenants how their data will be used. This includes telling them that an AI assistant reads their messages and photos, and that some messages may be read by our staff. We give you a suggested tenant-facing notice in the dashboard guide; using it is your choice and does not by itself guarantee your own compliance.
• Where a support request or a safety escalation means our staff read a tenant's message directly (see section 8), we are still acting as your processor for that tenant's underlying personal data, but we are the controller for the fact that a support ticket exists and its content (see section 8).

About you, the landlord: your name and email address (from Google sign-in); billing details, held by our payment processor Stripe (we do not store full card numbers ourselves); your properties, rooms and the tenants and engineers you add; your use of the dashboard and WhatsApp/chat channel (messages you send, approvals you give, settings you change); and technical data (IP address, browser/device information, and diagnostic logs, mainly for security and fault-finding).

• Identity and contact: name, phone number (WhatsApp), and, where used, an email address for the chat app or e-signature flow.
• Tenancy details: which property and room they're linked to, tenancy dates, rent amount and payment status.
• Messages they send us: text messages, voice notes (which we transcribe to text, see section 5), photos and videos of maintenance issues, and AI-generated descriptions of that photo/video content used to triage the report.
• Language: the language they write in, used to reply in the same language.
• Compliance records: certificates sent to them (for example gas safety records) and their acknowledgement of having received them.
• Signatures: where a tenant signs a document electronically (for example a tenancy document), we record the typed name or drawn signature, the date and time, the IP address and browser/device information (user agent) at the moment of signing, and confirmation that a consent checkbox was ticked. This is a plain audit trail, not a biometric or device fingerprint, and we do not use it to identify the tenant's device beyond that one signing event.
• Support conversations: if a tenant contacts HomeTenant support directly (as opposed to reporting a repair to their landlord), we keep that conversation. See section 8.

About engineers and contractors: name, phone number, trade/specialism, and which properties they're assigned to; job dispatch messages and their replies (accepting a job, confirming a time, marking work done); and invoices or amounts they report, where your plan uses that feature.

People who sign up to HomeTenant Acquire, our property screening tool: your email address and, if you give them, your name and company; the sign-in codes we email you (we keep only a scrambled form of each code, and only to check it and to limit how many are sent); a record of whether our team approved your account, and when; and the properties you screen, with the listings, floorplans and photos you add. We use these to run your account and decide who can use the tool.

What we do not knowingly collect: we do not ask for or knowingly process special category data (for example health data, in the general data protection sense) about tenants. Where a tenant volunteers something sensitive in a free-text message (for example mentioning a health condition as context for a repair, such as needing heating fixed urgently for a medical reason), that text is processed the same way as any other message, for the same purpose (triaging the repair), and is not used for any other purpose.

• Landlord account and billing: running your account, charging fees. Our lawful basis is contract, with you.
• Tenant identity, tenancy and rent, tenant messages, photos, videos and voice notes, AI processing of messages, compliance certificates and acknowledgement, signatures, engineer details and dispatch messages: operating the maintenance and rent-reminder service you've asked for. We process this data on your instructions; your basis as controller is typically contract (the tenancy) or your legitimate interests in managing the property.
• Support conversations: answering questions and fixing problems with the HomeTenant service. Our lawful basis is our legitimate interest in running and supporting the service (we are the controller for this, see section 8).
• Technical and security logs: keeping the service secure and working. Our lawful basis is legitimate interests (security, service integrity).

Some or all of a message, photo, video or document you or your tenant sends may be sent to the following AI providers to be processed:

• Anthropic (Claude models): reads message text, photos, transcribed voice notes and video descriptions to judge severity, decide what to do, and draft replies. This is the core of how HomeTenant works.
• Groq: transcribes voice notes to text (speech-to-text only).
• Google (Gemini models): produces a text description of video content sent by a tenant, which is then used by the triage process.

These providers process the data we send them to return a result to us; they do not use it to market to the tenant or landlord directly, and our agreements with them restrict use of the data to providing us the service.

International transfer: these providers may process data outside the UK/EEA (typically the US). See section 9.

We use the following organisations to help us provide HomeTenant. Each only receives the data needed for its role.

• Vercel, hosting the website, dashboard and API: all data passing through the web app. Region: global edge network with US and EU infrastructure.
• Supabase, hosting our Postgres database (all account, tenant, ticket and message data at rest): all stored data. Region: London, UK (eu-west-2).
• Anthropic, AI processing of messages, photos, and document/report drafting: message text, images, transcribed voice notes, video descriptions. Region: United States.
• Groq, voice note transcription: audio content of voice notes. Region: United States.
• Google (Gemini API), video content description: video content. Region: United States.
• Stripe, payment processing and billing for landlord accounts: landlord billing details, payment history. Region: United Kingdom and European Union, with global supporting infrastructure.
• Resend, sending transactional emails (confirmations, reminders, support replies): recipient email address, email content. Region: United States.
• Google (OAuth), landlord sign-in: landlord name and email. Region: United States.
• WhatsApp (Meta), the messaging channel tenants and engineers use to reach HomeTenant: messages sent over WhatsApp, processed by Meta under its own terms.

A note on WhatsApp. HomeTenant connects to WhatsApp through an unofficial linked-device connection, using the open-source Baileys library (similar to using WhatsApp Web), not Meta's official WhatsApp Business API. The device we use to run this connection is a small computer (a Raspberry Pi) that we operate and control; it is not hosted by a third party. Messages still pass over WhatsApp's own infrastructure (operated by Meta) to reach it, in the same way any WhatsApp message does.

We do not sell personal data, and we do not share tenant or engineer data with anyone else, except: where the law requires it; to protect someone's safety in an emergency; or if HomeTenant's business is sold or merged (in which case tenants and landlords would be told).

We review our sub-processors periodically and will tell landlords by email before we add a new one that processes their tenants' data.

• While your account is active, we keep your data for as long as you use HomeTenant.
• If a free trial ends without a subscription, your account is paused. We keep all your data, readable but not editable, for 30 days after pausing.
• If your account is paused for 30 days without being reactivated, we permanently delete your account's data: your properties, tenants, engineers, tickets, messages, documents, signatures and related records. This deletion is deliberate, logged, and does not happen automatically without an explicit setting being enabled, but the policy you should rely on is that paused data is kept for 30 days and is then eligible for deletion.
• If you cancel or close your account directly, the same 30-day countdown applies, starting when you close it.
• Support tickets (section 8) are kept for 365 days after a ticket is closed, then deleted.
• Billing records are kept for as long as required by UK tax law (normally 6 years) even after other data is deleted, because we are legally required to.
• We do not keep data for longer than necessary for the purposes it was collected for.

If you (landlord, tenant, or a visitor) contact HomeTenant support directly (for example by typing "SUPPORT" on WhatsApp, using the dashboard help panel, or the public contact form), this is different from a maintenance report:

• We, HomeTenant, are the controller for support conversations. We decide how they're handled and who at HomeTenant can see them.
• A tenant's support conversation is never shown to their landlord. It is visible only to HomeTenant staff.
• An AI assistant answers first, grounded in our own help documentation. If it can't resolve your question, it's handed to a person, who replies within one working day, Monday to Friday, UK time.
• The one exception: if a support conversation reveals a genuine safety risk (for example a tenant mentions a gas smell while asking a support question), that specific safety information is passed to the landlord through our normal safety-escalation process, because life and safety always come first. We tell you when this happens.
• We keep support conversations as described in section 7, so we can review how well we're helping people and handle any follow-up.

Some of the organisations listed in section 6 may process data outside the UK, including in the United States. Where we transfer personal data outside the UK, we rely on one of the following safeguards, as applicable: the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, an adequacy decision made by the UK government for the destination country, or another lawful transfer mechanism recognised under UK data protection law.

If you are an individual whose data we process (landlord, tenant, engineer), UK data protection law gives you the right to:

• be told how your data is used (this policy, plus what your landlord tells you, if you are a tenant);
• ask for a copy of the data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data, in some circumstances;
• ask us to restrict or object to some processing;
• ask for your data in a portable format, in some circumstances;
• not be subject to a decision based solely on automated processing that has a significant effect on you without human review. HomeTenant's AI assistant's decisions (for example how a repair is triaged) can be reviewed and overridden by your landlord, who can see the AI's reasoning in the dashboard and step in.

If you are a tenant or engineer, your landlord is the controller of your personal data, so in the first instance you should contact your landlord to exercise these rights. If you contact us directly, we will either help you or pass your request to your landlord as appropriate, and let you know which.

If you are a landlord, contact us directly at support@hometenant.ai to exercise these rights over your own account data.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, if you're unhappy with how your data has been handled: ico.org.uk, or by phone on 0303 123 1113. We'd appreciate the chance to address your concern first, but you don't have to come to us before contacting the ICO.

• We encrypt data in transit, over HTTPS/TLS, between your browser or WhatsApp and our servers, and between our servers and the database that stores your data.
• Access to our database and hosting accounts is restricted to the people at HomeTenant who need it to run the service, through individual, logged accounts rather than shared passwords.
• If we become aware of a data breach affecting your personal data, UK GDPR requires us to assess it and, where there's a risk to you, notify the ICO within 72 hours and tell affected individuals without undue delay. We follow that requirement.
• No system connected to the internet is completely secure, and we can't guarantee absolute security.

HomeTenant is not directed at children. Landlord accounts must be held by adults. Where a household includes a minor as an occupant, their data may appear in the tenancy records the landlord has responsibility for, but HomeTenant does not knowingly communicate with, or collect data directly from, anyone under 18 as a HomeTenant user in their own right.

We may update this policy from time to time. If we make a material change, we'll let landlords know (for example by email) and update the date at the top of this page.

Questions, requests, or complaints about how we handle personal data: support@hometenant.ai

HomeTenant is operated by Cressoft Consultancy Limited, a company registered in England and Wales under company number 07628636, with its registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, England.

You can also complain to the ICO at ico.org.uk or 0303 123 1113.