Privacy Policy

OwnProperly is a property portfolio management platform operated by OwnProperly Ltd, a company registered in England and Wales. We help UK landlords and property investors manage their portfolios, compliance, maintenance, tenancies, finances and tax submissions.

For the purposes of UK GDPR we are the data controller for personal data about you (the account holder). For tenant data, contractor data and similar third-party data you enter into the platform, we act as a data processor on your behalf — you are the controller and bear responsibility for the legal basis on which you process it.

Contact: hello@ownproperly.com

Account data: Your email, name, password (hashed), phone number (optional), and account preferences. Collected when you sign up.

Property data: Addresses, purchase prices, valuations, rental income, mortgage details, photos, compliance dates (gas/EICR/EPC) and any other portfolio data you choose to enter.

Tenant data (processor): Tenant names, contact details, tenancy dates, rent figures, references, and any documents you upload. You enter this — we hold it on your behalf.

Financial data: Rent payment records, expense records, deal analysis, and (if you connect Open Banking) read-only access to bank transactions for matching rent payments.

Tax data (HMRC MTD ITSA): If you enable HMRC integration, we store your National Insurance Number, HMRC property business ID, and OAuth access/refresh tokens issued by HMRC. We use these to file quarterly Making Tax Digital submissions on your behalf.

Document data: PDFs and images you upload (tenancy agreements, gas certificates, EICRs, EPCs, mortgage offers, insurance policies, receipts). We extract structured fields from these using AI — see section 6.

Usage data: Log entries of significant actions, timestamps, IP addresses (for security and abuse detection), browser type, and the device used to access the platform.

Payment data: Subscription billing is processed by Stripe. We store the Stripe customer ID and subscription status — we never see or store your card details.

To provide and operate the platform, including:

— Showing you your portfolio, finances, compliance and tax position
— Sending you service notifications (rent arrears, compliance expiry, weekly digests, MTD deadlines)
— Processing your subscription via Stripe
— Filing tax submissions to HMRC on your behalf when you authorise us
— Pulling bank transactions via Plaid when you authorise us
— Pushing transactions to Xero when you authorise us
— Extracting fields from documents you upload using AI
— Detecting and preventing abuse or fraud
— Providing customer support when you contact us
— Improving the platform based on aggregated usage patterns
— Complying with our legal obligations (e.g. HMRC record-keeping)

We process your personal data under the following UK GDPR bases:

Contract: Most processing is necessary to provide the service you have subscribed to.

Legitimate interests: Security monitoring, fraud prevention, platform improvement, and direct service communications about features you actively use.

Legal obligation: Where we are required to retain or process data by law (financial records, HMRC compliance).

Consent: For marketing emails about new features (you can unsubscribe at any time), and for each third-party integration you choose to enable (HMRC, Plaid, Xero) — each requires explicit OAuth consent that you can revoke.

If you enable HMRC integration in Settings → MTD Tax:

— We redirect you to the gov.uk website to sign in and authorise OwnProperly to file MTD ITSA submissions on your behalf.
— HMRC returns OAuth tokens (access + refresh) to us. We store these encrypted at rest in our database, scoped strictly to your user account via row-level security.
— When you submit a quarterly summary, we send HMRC the aggregated income and expense totals you have approved — never your raw tenant data, property addresses or supporting documents.
— HMRC requires us to send certain anti-fraud headers describing your device and browser (e.g. screen resolution, timezone, IP address). This is HMRC's mandatory requirement, not ours.
— You can disconnect HMRC at any time from Settings → MTD Tax → Disconnect. Tokens are deleted immediately.
— Submitted records remain in our database for 7 years to satisfy HMRC's record-keeping rules.

When you upload a document (tenancy agreement, certificate, receipt, mortgage offer, etc.), we send the document to Anthropic (https://anthropic.com) to extract structured fields such as dates, amounts and parties. This makes data entry faster.

— Anthropic processes the document under their data processing agreement and does not retain it for model training.
— Documents are sent over TLS-encrypted connections.
— The extracted fields and the original document are stored in our database, scoped to your account.
— You can delete any document from the platform at any time via the property's Documents tab.

If you connect a bank account via the Bank Feeds feature, you authorise Plaid Financial Ltd (FCA-regulated, FRN 804718) to provide us with read-only access to your bank transactions under the EU PSD2 framework. We never see or store your bank login credentials.

— Plaid's consent expires every 90 days as required by PSD2. We will prompt you to reauthorise.
— We receive only the transaction data needed to match rent payments and categorise expenses.
— You can revoke consent at any time from Bank Connections → Disconnect or directly through your bank's portal.
— Plaid's own privacy policy applies to their handling of your data: https://plaid.com/legal/

If you connect Xero, you authorise OwnProperly to push rent payments and expenses to your Xero organisation as bank transactions. We store the Xero OAuth tokens and the IDs of records we have synced.

You can disconnect at any time from Settings → Integrations → Xero → Disconnect. Already-synced records remain in Xero — we don't delete them.

Your data is stored in Supabase (Postgres database, file storage, authentication), hosted on AWS infrastructure in the EU West (London) region. Data does not leave the UK/EU for storage.

Security controls:

— All connections use TLS 1.2+
— Postgres row-level security ensures users can only read their own data
— Edge functions run with strict JWT verification (where applicable) and never expose service-role keys to the browser
— Files are stored in private buckets; access is mediated by signed URLs
— At-rest encryption is provided by Supabase / AWS RDS
— Regular automated backups; manual on-demand backups available to you via Settings → Backups
— Audit logging of significant platform actions
— Multi-factor authentication available on your account (recommended)

Supabase Inc. — database, authentication, file storage, serverless functions. EU-hosted.

Stripe, Inc. — subscription billing and payments.

Vercel Inc. — application hosting and global content delivery.

Postmark (ActiveCampaign LLC) — transactional emails and inbound statement-email parsing.

Anthropic, PBC — AI-assisted document field extraction. Documents are not retained for model training.

Mapbox, Inc. — interactive property maps.

Plaid Financial Ltd — Open Banking (only when you connect a bank account).

Xero Ltd — accounting sync (only when you connect Xero).

HMRC — Making Tax Digital submissions (only when you authorise the gov.uk OAuth flow).

All sub-processors are bound by data processing agreements requiring GDPR-equivalent protections.

— Your account profile is deleted within 30 days of you closing the account.
— Property and financial records are retained for 7 years from the end of the relevant tax year, as required by HMRC.
— Tax submissions to HMRC are retained for 7 years and include the snapshot we sent.
— HMRC, Plaid and Xero OAuth tokens are deleted immediately when you disconnect.
— Backups may retain copies for up to 90 days after deletion.
— Anonymised aggregate usage data may be retained indefinitely for analytics.
— Trash items (soft-deleted records) remain recoverable for 30 days, then hard-deleted on the next sweep.

Under UK GDPR you have the rights to:

Access: Request a copy of your data. Use Settings → Backups → Export, or email us.

Rectification: Correct inaccurate data — most of it is directly editable within the platform.

Erasure: Request deletion of your account and personal data. Email hello@ownproperly.com. We may retain some data for the 7-year HMRC period.

Portability: Download your data in a machine-readable format (CSV/JSON) using Settings → Backups.

Object / restrict: Object to processing based on legitimate interests or restrict our use.

Withdraw consent: For any third-party integration (HMRC, Plaid, Xero, etc.) by disconnecting in the platform. For marketing emails, unsubscribe.

We respond to rights requests within 30 days.

We use only essential cookies and local storage required for authentication, theme preferences and session management. We do not use third-party tracking cookies, advertising cookies or analytics that profile you. No cookie consent banner is required under UK PECR.

OwnProperly is not intended for use by anyone under 18. We do not knowingly collect data from minors.

Your data is held in the UK/EU. Some sub-processors (e.g. Stripe, Anthropic) may transfer data to the United States under UK-approved transfer mechanisms (Standard Contractual Clauses + UK Addendum, and the UK-US Data Bridge where applicable).

We may update this policy. Material changes will be announced by email and an in-app notice at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the current version. Continued use after the effective date constitutes acceptance.

If you're unhappy with how we handle your data, please contact us first at hello@ownproperly.com. You also have the right to complain to the UK Information Commissioner's Office:

ICO · ico.org.uk · 0303 123 1113