Privacy Notice

Who is responsible

Daryl Summers trading as UpRently is the data controller for this site. You can contact us about anything on this page, including a request to see, correct or delete your data. Our email address and postal address are both in the trader details at the top of our terms.

The short version

You do not need an account. We do not track you across the web, and we do not sell or share your data for marketing. Nothing is stored on your device until you open the payment form. A free check that you do not buy anything from is deleted within 48 hours.

What we collect and why

When you run a free check

We collect your full postcode, the property type, the number of bedrooms, the current and proposed rent, and any notice or tenancy dates you enter.

The step headed “About your home” also collects the internal floor area, the number of bathrooms, roughly when the property was built, the standard of finish, what outdoor space there is, and how many off-street parking spaces there are. These are what let us value your home rather than only the area around it.

We need all of these to produce a result. We store them briefly so that if you buy an Evidence Pack, the document is built from the figures our server calculated rather than from anything sent back by your browser.

Our lawful basis is legitimate interests: running the service you asked for, and making sure a paid document is accurate.

When you buy an Evidence Pack

Stripe handles the payment. Your card details are entered into Stripe’s own form and never reach us. We do not see, receive or store your card number.

Stripe gives us your email address so we can send you the pack. We keep a record of the order: the outward part of your postcode, the property details, the rent figures, the result, the amount paid, and your consent to immediate delivery.

Our lawful basis is performance of a contract for the order itself, and legal obligation for the financial records we have to keep.

When you contact us

The contact form collects your name, your email address, the subject you pick, your message, and an order reference if you give one. We need your email address to reply to you. We do not use any of it for marketing, and we never add you to a list.

Please do not put anything into the message box that you would not want kept in an email inbox. If you are writing about an order, the reference on your pack is enough to find it, and you do not need to repeat your address or your rent.

Our lawful basis is legitimate interests: answering the person who has written to us. Where you are writing about an order you have placed, it is performance of a contract. Where you are making a data protection request, it is a legal obligation.

Preventing abuse

Every check costs us money, because it calls paid services. To stop the site being used to run up that cost, we count requests per visitor. We do this by turning your IP address into a one way hashed value using a secret key, and counting against that. Your IP address itself is never written down.

We will not tell you that reversing the hashed value is impossible, because that would overstate it. Anyone who held both our database credentials and the secret key could work back from one, since there are only about four billion addresses to try. That is why these counters hold nothing except a count and a reset time, and why they are deleted about an hour after they stop being used.

Our lawful basis is legitimate interests: keeping the service available and affordable.

Counting checks

We keep a count of the checks that are run: the date, whether it was a tenant or a landlord check, the result, and how strong the evidence was. Nothing in that count identifies you. It holds no postcode, no rent figures and no link to your check, and it is what lets us see whether the service is being used.

There is no lawful basis to give for this one, because the count is not personal data. It cannot be traced back to you, to your check or to your device, so data protection law does not apply to it. We say so here rather than leaving the only gap in this list unexplained.

Page views

We use Vercel Web Analytics to count visits and see which pages people use. It is cookieless. It stores nothing on your device, does not follow you to other websites, and does not build a profile of you. It records the page visited, the referring site, and general details such as country, browser and device type. It does not record your name, your email address, or anything you type into the checker.

Our lawful basis is legitimate interests: understanding whether the service works and is being found. You can block it with any standard content blocker and the checker will still work normally.

Cookies and similar storage

We set no cookies of our own. While you are filling in the checker your answers are kept in your own browser, so a reload or a stray tap does not lose them. They never leave your device, we never see them, and they are cleared when you select start again, when you close the tab, or after 24 hours. This is storage of what you typed into a form, which the law treats as strictly necessary for the service you asked for, so we do not ask you to accept it.

When you open the payment form, Stripe loads its payment script and sets two cookies to detect card fraud. These are strictly necessary for the payment you have asked to make, which is why we do not ask you to accept them either, and why they are not set until you ask to pay.

If you close the payment form without paying, you can delete both in your browser settings. Nothing on this site depends on them outside checkout.

How long we keep things

• Free checks you do not buy from: deleted automatically after 48 hours.
• The comparable properties behind any check: deleted after 60 days, which is the limit our data supplier’s licence allows. The figures worked out from them, and any pack already produced, are not affected.
• Orders, the check behind them and the pack we generated: deleted six years after the order. That is the period UK law requires transaction records to be kept, and the period during which a claim about the sale could still be brought.
• Abuse prevention counters: deleted about an hour after they stop being used.
• Messages you send us: kept in our email inbox for up to two years, then deleted. A message about an order is kept with the order records for six years instead, because it may matter if there is ever a dispute about that sale.

Everything in the database is deleted automatically. A scheduled job runs daily and removes everything that has passed the dates above.

Email is the exception, and we would rather say so than imply otherwise. Our inbox is not on that schedule and messages are cleared by hand. If you want a message you have sent us deleted sooner, ask, and we will do it.

Who we share it with

Only the six suppliers that make the service work. Each one’s own privacy notice is linked, so you can see what it does with what it receives.

• Stripe takes the payment and holds your email address for the receipt. Stripe’s privacy notice(opens in new tab).
• Supabase holds our database and the packs we generate. Supabase’s privacy notice(opens in new tab).
• Vercel hosts the site and does the cookieless page view counting described above. Vercel’s privacy notice(opens in new tab).
• Resend sends your emails. Resend’s privacy notice(opens in new tab).
• Anthropic writes the short summary of your result. Only the property type, bedroom count, outward postcode and rent figures are sent. Your name, your email address and your full postcode are never sent. Anthropic’s privacy notice(opens in new tab).
• postcodes.io tells us whether a postcode exists and which country it is in, so we can say straight away if we cannot cover it. Our server asks, not your browser, so it never sees your device or your IP address, and we send the postcode on its own with nothing else attached.
• PropertyData, our rent data supplier, receives your full postcode, the property type and the bedroom count to find comparable local rents. To value your particular home it also receives the floor area, the number of bathrooms, roughly when the property was built, the standard of finish, the outdoor space and the parking. It does not receive your name, your email address or your rent figures. PropertyData’s privacy notice(opens in new tab).

We do not sell your data, and we do not share it for anyone else’s marketing.

Automated decisions

The result you see is produced by a calculation, and the summary paragraph is written by an AI assistant from the figures. Neither has any legal effect on you and neither decides anything about you. They are information you can act on, or ignore, as you choose.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to our using it. Send us a data protection request and we will respond within one month, which is the time the law allows. Because we do not run accounts, please include the email address you used at checkout, or your order reference, so we can find your order. Every time we commit to is listed in how quickly we respond.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk(opens in new tab).

Where your data is held

PropertyData is a UK company. Stripe, Vercel, Resend, Supabase and Anthropic are based in the United States, and some of what they hold for us may be processed there or in the European Economic Area. Where a supplier processes data outside the UK, it relies on UK adequacy regulations or on standard contractual clauses with the UK addendum, and its privacy notice linked above says which.

Last updated 6 September 2026