TenancyKit

Privacy notice · UK GDPR Art. 13

How TenancyKit handles your data, plainly.

This notice explains who we are, what personal data we collect from you, why we collect it, who we share it with, how long we keep it, and what rights you have. Written under UK GDPR Article 13. Last updated 2026-05-06.

Data controller	Morgan and Co. Enterprise Limited, a company registered in England.
Trading name	TenancyKit (tenancykit.org)
Director	Cai Morgan
Contact for privacy	cai@tenancykit.org
ICO registration	Pending — registration in progress under Tier 1 of the Data Protection (Charges and Information) Regulations 2018
Last updated	2026-05-06

The personal data TenancyKit processes.

To produce a Renters Rights Act 2026 Information Sheet for you, we process the following categories of personal data:

• Your identity: name, email address, landlord name (if different from yours).
• Your portfolio: property count, property addresses for each Information Sheet ordered.
• Tenant identity: tenant name(s), tenancy start date, optionally email address (only if you choose electronic service).
• Payment data: Stripe processes your card details; we never see or store the card number. We retain the Stripe transaction reference and the amount paid.
• Audit-trail metadata: what we delivered, when, and how. The customer email recipient is stored as a SHA256 hash inside the audit JSON, not in plaintext.
• Communications: any email correspondence with cai@tenancykit.org.

Why we are allowed to process it.

Our lawful basis under UK GDPR Article 6(1)(b) is performance of a contract — you have asked us to produce a regulated document for your property, and we cannot do that without the data above. Tenant data specifically is processed under Article 6(1)(f) legitimate interest, balanced against tenant rights as set out in our internal Legitimate Interest Assessment available on request.

We do not process personal data on the basis of your consent for marketing — we do not run marketing communications at Stage 1.

Recipients of your data.

• Stripe Payments Europe Ltd (Ireland) — payment processing. Stripe's privacy policy.
• Supabase Inc. (data residency: EU-West) — order database. Customer name, email, intake data, audit-trail JSON stored here. Supabase's privacy policy.
• Sendinblue SAS (Brevo) (France) — transactional email delivery. Recipient email and message content pass through Brevo. Brevo's privacy policy.
• Netlify Inc. (US) — website hosting. Standard server logs (IP address, user agent, page views) processed under Netlify's privacy framework. Netlify's privacy policy.

We do not sell personal data. We do not share it with marketing partners, data brokers, or analytics platforms beyond what's listed above. Stage 1 has no third-party analytics installed.

Where your data goes.

Stripe and Brevo process EU/UK customer data within the EU. Supabase customer data is hosted in EU-West. Netlify is US-based — IP addresses and server logs may be processed in the US under the UK Extension to the EU-US Data Privacy Framework. No customer order content (your intake data, the Information Sheet, the audit trail) is transferred to the US — those are stored in Supabase EU-West only.

How long we keep it.

• Order data + audit trail: 7 years from delivery, matching the Limitation Act 1980 contract claim window. After 7 years, your order row is purged from the Supabase database; your customer-side copy of the audit trail remains verifiable indefinitely.
• Stripe transaction records: retained by Stripe under their own retention policy (typically 7 years for tax purposes).
• Email correspondence: 3 years from last contact, then deleted.
• Server logs (Netlify): 30 days, per Netlify's default retention.

You can request earlier deletion at any point — see your rights below — except where retention is mandated by tax law (Stripe transaction records).

What you can ask us to do.

Under UK GDPR you have the right to:

• Access — request a copy of all personal data we hold about you.
• Rectification — correct any inaccurate data.
• Erasure — request deletion (subject to retention obligations above).
• Restriction — pause processing while a dispute is resolved.
• Portability — receive your data in a machine-readable format.
• Object — challenge processing under Article 6(1)(f) legitimate interest.
• Complaint — lodge a complaint with the UK Information Commissioner's Office at any time. ico.org.uk/make-a-complaint.

Email cai@tenancykit.org with your request. We respond within one calendar month, free of charge for the first request.

What we do not do.

This site uses no third-party analytics, no advertising pixels, no behavioural tracking cookies. The only cookies are functional (Stripe checkout session, Netlify form submission). No consent banner is required because no consent-bearing tracking is in place. If we add analytics in future, we will publish a cookie banner and update this notice before the change goes live.

How we update it.

Material changes will be announced by email to all customers with active orders, at least 14 days before they take effect. The "Last updated" date at the top of this page reflects every revision. Prior versions are kept on request.