Privacy Policy
1. Introduction
HouseFile ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our compliance document platform and website.
2. Information we collect
We collect information that you provide directly to us, including:
- Account information (name, email address, password)
- Your name and email address from Google, if you choose to sign in with Google
- Property details and addresses
- Documents you upload (EPCs, gas safety certificates, etc.)
- Details of tenants and other people you add, such as their names and email addresses
- Payment information (processed securely via Stripe)
- Communications you send to us
When a tenant uses a tenant link, we record which documents they open and when, the name they enter, their responses, and the IP address they used, so the landlord has a record of delivery.
We automatically collect certain information when you use our service:
- Log data (IP address, browser type, pages visited)
- Device information
- Usage data and analytics, including through Google Analytics (see section 8)
3. How we use your information
We use the information we collect to:
- Provide, maintain, and improve our services
- Read the documents you upload so we can suggest their title, category and expiry date
- Process transactions and send related information
- Send you reminders, technical notices and support messages
- Respond to your comments and questions
- Track document access for compliance purposes
- Find and fix errors, and detect and prevent fraud or abuse
4. Information sharing
We do not sell your personal information. We may share your information in the following circumstances:
- With tenants you choose to share property information with via tenant links
- With letting agents or other people you give access to your account
- With the service providers listed in section 9, who process it for us to run HouseFile
- If required by law or to protect our rights
- In connection with a merger, acquisition, or sale of assets
5. Data security & document storage
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.
All documents uploaded to HouseFile are stored with Supabase, on AWS infrastructure in Zurich, Switzerland, with the following protections:
- Encryption at rest: all stored files and data are encrypted using AES-256 encryption
- Encryption in transit: all data transferred between your device and our servers is protected via TLS/HTTPS
- Access controls: documents are only accessible to the property owner, people they give access to, and tenants who have been given a valid sharing link
- Infrastructure compliance: Supabase, which stores our data, and Vercel, which hosts the website, are both SOC 2 Type II certified
- Isolation: each user's data is logically separated using row-level security policies, ensuring no cross-account access
- No selling or advertising: uploaded documents are never sold or used for advertising, and are only processed by the service providers in section 9 to run HouseFile
- Limited staff access: only the people who run HouseFile can reach the systems that hold your data, and they only look at your documents or property information when you ask for support, to fix a problem, or when the law requires it
Payment information is handled exclusively by Stripe and is never stored on our servers. Stripe is PCI DSS Level 1 certified, the highest level of certification in the payments industry.
6. Data retention
We retain your personal information for as long as your account is active or as needed to provide you services. You can request deletion of your account and associated data at any time by contacting us.
7. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Object to processing of your data
- Request data portability
- Withdraw consent at any time
To exercise these rights, please contact us using the details below. You can also complain to the Information Commissioner's Office at ico.org.uk.
8. Cookies
We use essential cookies to keep you signed in and to make the service work. These cookies are necessary for the website to function and cannot be switched off.
We also use Google Analytics, which sets cookies to help us understand how people use the website, such as which pages they visit and how they found us. You can block these cookies in your browser settings or with Google's opt-out browser add-on. We do not use cookies for advertising purposes.
Some pages offer a video that is hosted on YouTube. Nothing is loaded from YouTube until you press the button to watch it. When you do, the player comes from YouTube, which is part of Google. It receives your IP address and may store cookies or similar data on your device, under Google's own privacy policy. We use YouTube's privacy-enhanced mode, in which watching isn't used to personalise what YouTube shows you.
Under each video there is a box you can tick to load videos straight away from then on. If you tick it, the player comes from YouTube as soon as you open a page with a video on it. We remember that choice in your browser only, and we don't send it anywhere. Untick the box under any video to stop.
9. Third-party services
These service providers process data for us to run HouseFile:
- Supabase: data storage, sign-in and file hosting, with data held in Zurich, Switzerland (SOC 2 Type II certified)
- Vercel: hosting the website and app (SOC 2 Type II certified)
- Stripe: payment processing (PCI DSS Level 1 certified)
- Resend: sending emails, such as password resets, reminders and notifications
- Anthropic: reading the documents you upload so we can suggest their title, category and expiry date. The file is sent to Anthropic's API for this, and under Anthropic's commercial terms it isn't used to train its models
- Google: Google Analytics for website usage, Google sign-in if you choose it, and YouTube for the videos on some pages, which load only when you press to watch one, or straight away if you have chosen that
- Sentry: error monitoring, which can include your account ID but not your email address
- ImprovMX: forwarding emails sent to our support addresses
- postcodes.io and the government EPC register: looking up a property's location or EPC from the postcode or address you enter
Each of these services has their own privacy policy governing their use of your data. We only share the minimum information necessary for each service to function. Some of them process data outside the UK, including in the United States. Where they do, we rely on the safeguards UK data protection law requires, such as adequacy regulations or standard contractual clauses.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.
11. Contact us
If you have any questions about this Privacy Policy or our data practices, please contact us at: