Privacy notice
Last updated: 24 April 2026
This notice explains how Tenantory processes your personal data when you use our tenancy agreement scanning service. We have written it to be read in under two minutes.
The short version
You paste your tenancy agreement or upload a file. We send the text to an AI service to analyse it. We return the results to you. We do not store your contract. We do not sell your data. Full stop.
1. Who we are
Tenantory is a trading name of a UK-registered sole trader based in England. The sole trader is the data controller for any personal data processed through this service.
ICO Registration Number: ZC129413
To request full controller details or exercise any data protection right, contact: privacy@tenantory.co.uk
2. Service scope
Tenantory is built specifically for tenancies governed by housing law in England. We do not currently support tenancies in Wales, Scotland, or Northern Ireland. We apply UK GDPR to all personal data we process, regardless of where the data subject is located. The substantive analytical service is England-only.
3. What personal data we process
When you submit a tenancy agreement to Tenantory, either by pasting text directly or uploading a file, that document typically contains personal data including:
- Your full name
- Your home address
- Your landlord's name and contact details
- Financial information such as rent and deposit amounts
- Potentially: guarantor names, employment references, or other personal details included in the agreement
If you upload a file (PDF, DOCX, or TXT), the file itself is never transmitted to our servers. Text extraction happens entirely within your own web browser using client-side JavaScript libraries (PDF.js and Mammoth.js). Only the extracted text is then sent to our AI sub-processor for analysis, exactly as if you had pasted it directly.
We also process minimal technical data: your IP address (held transiently by our hosting provider) and browser type for security purposes. We do not use cookies for tracking or advertising.
4. Special category data
Tenancy agreements can incidentally contain special category data under Article 9 UK GDPR. For example, Right to Rent check information may include nationality and immigration status, reasonable adjustment clauses may reference disability, and some clauses may relate to religious observance, ethnicity, or trade union activity.
We do not deliberately solicit special category data. To the extent it appears in submitted tenancy agreements, our processing is necessary for the legitimate interest of providing the service that the user has explicitly requested, and is supported by our technical measures: the contract text is processed in real time and immediately discarded, never stored. The user has voluntarily submitted the document and exercised meaningful control over the data shared.
Where we process such data, our lawful basis under Article 9(2)(a) UK GDPR is your explicit consent, which is given when you choose to submit your tenancy agreement to Tenantory after reading this notice.
5. Why we process your data and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Analysing your tenancy agreement and returning results | Contract, processing is necessary to deliver the service you have requested (UK GDPR Article 6(1)(b)) |
| Sending your detailed report by email after payment | Contract, processing is necessary to deliver the paid service you have purchased (UK GDPR Article 6(1)(b)) |
| Special category data incidentally included in tenancy agreements | Explicit consent (UK GDPR Article 9(2)(a)) |
| Security and fraud prevention | Legitimate interests (UK GDPR Article 6(1)(f)) |
| Complying with legal obligations | Legal obligation (UK GDPR Article 6(1)(c)) |
6. How long we keep your data
We do not retain your tenancy agreement text after your scan is complete. The text is processed in real time and immediately discarded. We do not hold a database of contracts.
If you purchase a detailed report, your email address is used once to send you the report, then retained by our email processor (Resend) for up to 30 days in their standard sending logs before automatic deletion. Stripe retains your payment record for accounting and regulatory compliance purposes in line with their own retention policy.
Minimal server logs (IP address, timestamp) are retained for up to 30 days for security purposes, then automatically deleted.
7. Who we share your data with
We use the following third-party sub-processors to deliver this service:
| Processor | Purpose | Safeguard |
|---|---|---|
| Anthropic, PBC | AI analysis of tenancy agreement text via Claude API | USA. SCCs apply via Anthropic DPA. Anthropic does not train on API inputs. |
| Netlify, Inc. | Website hosting and serverless functions | USA / EU. SCCs apply via Netlify DPA. |
| Stripe, Inc. | Payment processing for paid reports | USA. SCCs apply via Stripe DPA. |
| Resend, Inc. | Sending the detailed report by email to customers who purchase it | USA. SCCs apply via Resend DPA. |
We do not sell, rent, or share your personal data with any other third party for marketing purposes.
8. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Rectification of inaccurate data
- Erasure (the "right to be forgotten"), noting we hold minimal data and retain contract text for zero time
- Restriction of processing
- Data portability
- Object to processing based on legitimate interests
- Lodge a complaint with the Information Commissioner's Office (ico.org.uk, 0303 123 1113)
To exercise any right, email privacy@tenantory.co.uk. We will respond within one calendar month.
9. Changes to this notice
If we make material changes we will update the date at the top of this page and, where appropriate, notify you. Continued use of the service after changes constitutes acceptance.