Privacy notice

Last updated: 24 April 2026

This notice explains how Tenantory processes your personal data when you use our tenancy agreement scanning service. We have written it to be read in under two minutes.

1. Who we are

Tenantory is a trading name of a UK-registered sole trader based in England. The sole trader is the data controller for any personal data processed through this service.

ICO Registration Number: ZC129413

To request full controller details or exercise any data protection right, contact: privacy@tenantory.co.uk

2. What personal data we process

When you submit a tenancy agreement to Tenantory, either by pasting text directly or uploading a file, that document typically contains personal data including:

• Your full name
• Your home address
• Your landlord's name and contact details
• Financial information such as rent and deposit amounts
• Potentially: guarantor names, employment references, or other personal details included in the agreement

If you upload a file (PDF, DOCX, or TXT), the file itself is never transmitted to our servers. Text extraction happens entirely within your own web browser using client-side JavaScript libraries (PDF.js and Mammoth.js). Only the extracted text is then sent to our AI sub-processor for analysis, exactly as if you had pasted it directly.

We also process minimal technical data: your IP address (held transiently by our hosting provider) and browser type for security purposes. We do not use cookies for tracking or advertising.

3. Why we process your data and our lawful basis

Purpose	Lawful basis
Analysing your tenancy agreement and returning results	Contract, processing is necessary to deliver the service you have requested (UK GDPR Article 6(1)(b))
Security and fraud prevention	Legitimate interests (UK GDPR Article 6(1)(f))
Complying with legal obligations	Legal obligation (UK GDPR Article 6(1)(c))

4. How long we keep your data

We do not retain your tenancy agreement text after your scan is complete. The text is processed in real time and immediately discarded. We do not hold a database of contracts.

If you purchase a detailed report, your email address is used once to send you the report, then retained by our email processor (Resend) for up to 30 days in their standard sending logs before automatic deletion. Stripe retains your payment record for accounting and regulatory compliance purposes in line with their own retention policy.

Minimal server logs (IP address, timestamp) are retained for up to 30 days for security purposes, then automatically deleted.

5. Who we share your data with

We use the following third-party sub-processors to deliver this service:

Processor	Purpose	Safeguard
Anthropic, PBC	AI analysis of tenancy agreement text via Claude API	USA. SCCs apply via Anthropic DPA. Anthropic does not train on API inputs.
Netlify, Inc.	Website hosting and serverless functions	USA / EU. SCCs apply via Netlify DPA.
Stripe, Inc.	Payment processing for paid reports	USA. SCCs apply via Stripe DPA.
Resend, Inc.	Sending the detailed report by email to customers who purchase it	USA. SCCs apply via Resend DPA.

We do not sell, rent, or share your personal data with any other third party for marketing purposes.

6. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate data
• Erasure (the "right to be forgotten"), noting we hold minimal data and retain contract text for zero time
• Restriction of processing
• Data portability
• Object to processing based on legitimate interests
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk, 0303 123 1113)

To exercise any right, email privacy@tenantory.co.uk. We will respond within one calendar month.

7. Changes to this notice

If we make material changes we will update the date at the top of this page and, where appropriate, notify you. Continued use of the service after changes constitutes acceptance.