Privacy policy

1. Who this policy is for

MProp is a property management platform used by landlords and letting agents to manage properties, tenancies, statutory compliance, repairs and contractors.

This policy covers everyone whose personal data the platform holds:

• Account users — the landlords, agents and their staff who sign in to the platform.
• Tenants — people renting a property managed through the platform, whether or not they ever use the tenant portal.
• Contractors — the people named as contacts at firms carrying out work.
• Invited people — anyone sent an invitation to join an account, whether or not they accept.

It also explains what happens to a tenant's personal data when it appears inside a document — for example a name on a gas safety record — that is uploaded to the platform.

2. Who is responsible for your data

Madison Web Solutions Ltd, The Bank Chambers, 239 South Coast Road, Peacehaven, BN10 8LD, company number [COMPANY NUMBER], operates the platform.

There are two distinct relationships, and which one applies determines who you should contact.

For property, tenancy, tenant, contractor, compliance and repair records, the landlord or letting agent whose account holds the record is the data controller. They decide what to record and why. Madison Web Solutions Ltd acts as a data processor, handling that data on their instructions in order to provide the platform. If you are a tenant and you want a copy of your data, or want something corrected or erased, the quickest route is to ask your landlord or letting agent directly — their contact details are on your tenancy paperwork and in the tenant portal. You may also contact us at [CONTACT EMAIL] and we will pass the request on and help fulfil it.

For account users' own login and account records — your name, email address, password, role, notification preferences and sign-in activity — Madison Web Solutions Ltd is the data controller.

Our data protection contact is [DATA PROTECTION CONTACT], [CONTACT EMAIL]. Madison Web Solutions Ltd is registered with the Information Commissioner's Office under [ICO REGISTRATION NUMBER].

3. What personal data the platform holds

The platform is a property management system rather than a marketing product, so what it holds is what a landlord needs to let and maintain a property lawfully. This section lists it in full.

3.1 Account users

• Name, email address and platform role.
• A password, stored only as a one-way hash — the platform never holds a readable copy.
• Which accounts you belong to, and your role in each (owner, manager or staff).
• Your email digest preferences — how often, and what scope.
• Records of what you did: every create, update and delete you perform is recorded with your user id, a timestamp and the before-and-after values of the fields that changed. See 3.7.
• Sign-in sessions, including the IP address and browser user-agent of the device used.
• API access tokens, if you create any, stored as hashes.

3.2 Tenants

• Name, date of birth, email address and telephone number.
• A photograph, if one is added to the tenant record.
• Address history, including previous addresses with dates.
• Tenancy details: the property, start and end dates, rent, deposit, collection frequency, notice period, and any end-of-tenancy notice.
• Rent review history: proposed and previous rent, effective dates, how the tenant responded and any document recording that response.
• Free-text notes recorded about the tenant or the tenancy by account staff.
• Fault reports the tenant raises or that are raised on their behalf: what was reported, when, how urgent, photographs attached, and the full conversation thread of comments between tenant and landlord.
• Records of visits arranged at the property — the date, the contractor attending, and notes on what happened.
• Property inspection records, including any actions the tenant is asked to take.
• Personal data appearing inside uploaded documents — a tenancy agreement, a gas safety record or an inspection report will usually carry a name and the property address.
• Tenant portal access records: the email address a sign-in link was sent to, when it was sent and used, and the IP addresses it was requested and used from.

3.3 Contractors

• Company name, contact name, email address, telephone number, website and postal address.
• The trades the firm offers, and free-text notes about rates, availability and who to ask for.
• Works orders issued to them, prices agreed and invoiced, visits arranged and their outcomes.

3.4 Invited people

The email address an invitation was sent to, the role offered, who sent it, when, and whether it was accepted, expired or revoked. An invitation record is kept whether or not the invitation is accepted.

3.5 Property data

Property records — address, coordinates, type, number of rooms, council tax band, EPC rating, compliance facts, mortgage and fixed-cost figures, notes — are principally business data, but a single-property landlord's address may also be personal data about them, so it is covered here.

3.6 Documents and photographs

Uploaded files — certificates, tenancy agreements, inspection reports, invoices, tenant photographs, photographs attached to a fault report — are stored with their original filename, type, size, the time of upload and, where applicable, who uploaded them. Files are held on private storage and are only served to people the platform has checked are entitled to see them.

3.7 Activity and change history

The platform keeps a durable audit trail. Every change to a tracked record is stored as a change record holding the field values before and after, the user who made the change and when. Deletions are stored the same way, including a snapshot of the deleted record. Property pages also show a plain-English activity log derived from those records.

This is deliberate — a compliance system whose history could be rewritten would be worth little — but it has a consequence for erasure, explained in section 8.

3.8 Data we do not collect

The platform has no analytics, advertising, tracking or profiling of any kind. It does not use cookies for anything except keeping you signed in — see section 10. It does not ask for or store payment card details, bank details, national insurance numbers, immigration documents or credit checks. It does not knowingly collect special category data such as health, religion or ethnicity; however, free-text fields — tenant notes, fault report descriptions, visit notes — will accept whatever is typed into them, and a repair report may mention a health condition. Account users should record only what they need to.

4. Where the data comes from

• Typed in by account users.
• Submitted by tenants through the tenant portal — fault reports, photographs, rent review responses.
• Read from documents uploaded to the platform, either by a person or by the document-reading feature described in section 6.
• Address lookups: when someone types an address, the search text is sent to Google's Places API and the matching address and coordinates come back.

5. Why we process it, and our lawful basis

Where Madison Web Solutions Ltd is the controller — account users' own records:

Where the account holder is the controller — property, tenancy, tenant, contractor and repair records — the bases they will usually be relying on are:

Account holders are responsible for confirming their own lawful bases and for telling their tenants how they use their data.

6. Automated reading of documents

The platform can read an uploaded compliance document and pre-fill a form from it, using the Claude API provided by Anthropic. How this works matters for your privacy, so it is set out in full.

• It is off unless switched on for an account. Document reading is disabled by default and is enabled per account by us, with an optional monthly usage limit.
• Attaching a certificate to a single compliance item never reads it on its own. A person has to press “Read this document”. Files dropped into a property’s bulk upload queue are read once queued, which is the purpose of that screen, and what it costs is shown beside the drop area before anything is dropped in.
• What is sent: the document itself — either the text extracted from it, or the file, or an image of its pages — together with the property's address and the type of certificate expected, so the model can say whether the document matches. Nothing else from the account is sent: no tenant record, no portfolio data, no user account details.
• What comes back and is stored: the dates, reference numbers and findings read off the document, the address printed on it, the tenant name where the document names one, a confidence figure per field, and the raw response. These are stored as a proposal, separate from the compliance record itself.
• Nothing the model produces is treated as authoritative. A proposal is only ever used to pre-fill a form. A person reviews every value and presses save, and that act — not the model's output — is what creates the compliance record. The model is specifically prevented from confirming that a document meets a compliance requirement; it can only withdraw that confirmation for a person to consider.
• No solely automated decision-making. There is no decision within the meaning of Article 22 of the UK GDPR — no decision with legal or similarly significant effects is made without human involvement, and no profiling is performed.
• Anthropic does not train on this data. Anthropic's commercial terms state that data submitted through the API is not used to train their models. See section 7 for transfer details.
• Documents longer than 25 pages are refused rather than partially read, and the file is checked before anything is sent.

7. Who we share data with

The platform uses a small number of third parties. It shares nothing with anyone else, and sells nothing to anyone.

Two of these deserve a note.

In-app feedback. A screenshot of this application routinely contains a tenant's name and address. That is why the feedback dialog previews the screenshot before it is sent, asks explicitly whether to include it, and previews the browser error log separately — both can be declined, and the report will still send. Feedback reports become cards on a Trello board used by the development team.

Maps. The map component is loaded from Google by your browser, so Google receives your IP address independently of us. Address searching, by contrast, is done by our server, so Google sees the search text but not your IP address.

We may also disclose data where we are legally required to, or to establish or defend legal claims.

8. How long we keep it

Records are kept for as long as the account holds them. The platform does not automatically delete property, tenancy, tenant, contractor, compliance, repair or document records. This is intentional: compliance and repair history has to be produceable years later, and a tenancy record that vanished would leave a landlord unable to evidence that a gas safety check was done. Account holders can delete records they no longer need, and are responsible for deciding when that is. Madison Web Solutions Ltd deletes an account's data on request when the account closes, subject to the audit-trail caveat below and any legal retention requirement.

The platform does delete some things on a schedule:

Account membership records are never deleted. When someone's access to an account is revoked, their membership row is kept with the role set to “removed”, as a record that they once had access. Their responsibilities — properties, tasks and compliance items assigned to them — are transferred to another member at the same time.

The audit trail survives deletion. Because the change history records the values of a deleted record, deleting a tenant removes them from the working system but leaves a snapshot of their details in the change history, attached to the user who deleted them. A request for erasure that must reach the change history as well needs to be made to us at [CONTACT EMAIL], and is handled manually.

9. Your rights

Under the UK GDPR you have the right to:

• be told how your data is used — this policy;
• access a copy of the personal data held about you;
• rectification of data that is wrong or incomplete;
• erasure, in the circumstances the law allows;
• restrict processing while a dispute about accuracy or legitimacy is resolved;
• portability of data you provided, in a machine-readable form;
• object to processing carried out on the basis of legitimate interests;
• not be subject to solely automated decisions with legal or similar effects — as section 6 explains, the platform makes none.

How to exercise them. If you are a tenant or a contractor, contact the landlord or letting agent you deal with; they hold the record and decide what happens to it. If they need our help to find or extract it, we will provide it. If you are an account user, or you cannot reach the account holder, contact us at [CONTACT EMAIL].

We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

Complaints. If you are unhappy with how your data has been handled, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113.

10. Cookies

The platform uses cookies only to make signing in work. There are no analytics, advertising or tracking cookies, and no third-party cookies are set by us.

All are strictly necessary for the service to function, which is why the platform does not show a cookie consent banner. The web font is requested from Bunny Fonts, which sets no cookies.

Tenants using the portal get the same session cookie, holding nothing but a reference to the tenancy the sign-in link was for.

11. How we protect it

• Passwords are stored as one-way hashes and are never recoverable.
• Tenant portal sign-in links and account invitations are stored as SHA-256 hashes; the usable link exists only in the email that was sent. A portal link lasts 15 minutes, works once, and is limited to one every two minutes and ten a day per tenancy.
• Access is checked twice: what your role permits in principle, and which specific records that applies to. Staff members see only what they are assigned; account-wide access is held by owners and managers only.
• Correcting a tenant's email address revokes every portal pass already sent to the old one.
• A tenant portal session expires 30 minutes after sign-in regardless of activity, and is revoked immediately if the portal link is reset or the tenancy ends.
• Uploaded files are held on private storage and are served only after an authorisation check. A file you are not entitled to see returns “not found” rather than “forbidden”, so its existence is not disclosed.
• Before a tenant is sent a sign-in link, the platform shows only a masked version of the email address it will go to — never the full address, the tenant's name or the property address.
• An account owner cannot discover whether an email address already has a login on the platform; inviting someone behaves identically either way.
• Requests are rate limited, and the document-reading feature has its own tighter limits and a per-account budget.
• Documents sent for automated reading are treated as untrusted input: the model is given no tools, can take no action, and its output is validated before a person ever sees it.
• The platform is served over HTTPS. Data is held in the United Kingdom (Brighton).

12. International transfers

Anthropic, Google and Atlassian are United States companies, and the transfers described in section 7 leave the UK. Each is relied on under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.

13. Changes to this policy

We will update this policy when the platform changes in a way that affects it. The date at the top shows when it was last revised. Material changes will be notified to account users by email.

14. Contact

Madison Web Solutions Ltd
The Bank Chambers, 239 South Coast Road, Peacehaven, BN10 8LD
[CONTACT EMAIL]