Privacy

Letbook is run by [to be confirmed], which decides how personal data in Letbook is used (the "controller" under UK GDPR) for landlord accounts.

ICO registration number: [to be confirmed].

For the records a landlord keeps about their tenants, the landlord is the controller and Letbook acts on their behalf.

• Landlords: your email address, your account and property details, and the compliance records you enter.
• Tenants: the name and email address a landlord adds when inviting you, and what you submit through the portal.
• Documents: certificates and other files that landlords upload.
• Issue threads: reports, replies and attachments exchanged between tenants and landlords.
• Technical data: a session cookie that keeps you signed in, error reports, analytics events (pages viewed and key actions such as signing up or adding a property), and a cookie that remembers your analytics choice.

• To provide the service you or your landlord asked for, including sign-in, records, reminders and the tenant portal (contract, or legitimate interests for tenants invited by a landlord).
• To keep the service secure and fix faults (legitimate interests).
• To understand how the product is used and whether it works, using PostHog analytics (legitimate interests).
• To take payment and keep financial records (contract and legal obligation).

We do not sell personal data or use it for advertising.

In your browser, analytics only stores something on your device if you choose Accept in the banner. Until then a visit is counted, but your browser is not recognised across visits. You can change your mind by clearing the haus_consent cookie, and the banner will ask again. There is no session recording. Events sent from our servers, such as signing up, adding a property or tenancy, and billing, use your internal user id and are not affected by the banner.

The database is hosted in Western Europe and documents and backups are stored in the EU. The exception is PostHog, which may process analytics data in the United States. Those transfers are covered by the UK International Data Transfer Addendum and standard contractual clauses.

• Cloudflare: hosting, the database, document storage and backups.
• Resend: sending sign-in, invitation and reminder emails.
• Sentry: error monitoring, which receives an anonymous user id but not your email.
• PostHog: product analytics, which receives an internal user id but not your email or name.
• Stripe: payment for Premium; we never see or store your card details.

• When an account is deleted it is kept for 30 days, so you can cancel, and then permanently deleted.
• A tenant keeps access to their records for 12 months after a tenancy ends.
• Nightly database backups and the document trash are kept for 90 days in an EU storage bucket. Erased data can therefore persist in backups for up to 90 days after the 30-day grace period.

You can ask to see, correct, export or erase your personal data, or object to how it is used. If you are a tenant, send the request to your landlord, who is the controller of your tenancy records. If you cannot reach them or they do not respond, write to hello@letbook.app and we will help. Landlords can write to the same address.

You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.