Privacy Policy

3. The personal data we collect

We process only the data necessary to provide a high-quality property management service:

• Account profiles (Name, Email, Job Title)
• Security data (Encrypted password hashes)
• Billing metadata (via our secure payment provider)
• Usage logs (IP address, device type, interactions)
• Tenant portal document activity (shown, opened, downloaded, acknowledged)
• Support history (Emails and chat transcripts)
• Property data uploaded by you

4. Partner offers

Inside the HomeDash app we sometimes suggest organisations that can help with something you need to do. For example, when a deposit has not been protected yet, we show the three government-approved deposit protection schemes. Every suggestion says whether HomeDash is paid for it.

• Suggestions appear in the app only. We do not send them to you by email or WhatsApp.
• When you click one, we record the click: which suggestion, when, and where in the app it was shown. We then send you to the organisation's website with a random reference code.
• The reference code contains no personal data. We do not pass your name, contact details, properties or your tenants' details to the organisation, and it cannot see which page of HomeDash you came from.
• An organisation may tell us that a reference code led to a sign-up or purchase, so we can see which suggestions are useful. We share only totals with them, never who clicked.
• If an organisation ever needed more than a reference code to help you, we would ask for your explicit consent first, for that organisation only.
• You can hide any suggestion, and the account owner can turn them off for the whole account in Settings → Notifications.

We keep these records under our legitimate interests, to measure whether suggestions are useful.

5. Connected accounting software (Xero)

If the owner of a HomeDash account connects their Xero organisation, HomeDash reads from it so the landlord does not have to upload bank statements. The owner chooses to connect, chooses which bank accounts HomeDash reads, and can disconnect at any time.

• HomeDash only reads. It never creates, changes or deletes anything in Xero.
• We read the bank transactions in the bank accounts the owner chooses (date, amount, contact name, reference, description and the Xero accounts they are coded to), the organisation's list of accounts and tracking categories, and the organisation's name.
• We use this only to show the landlord's finances in HomeDash: their ledger, profit and loss by property, and matching payments to rent. Where a transaction names a tenant or another person, we process it on the landlord's behalf, as described in section 2.
• Xero data is never sent to our AI assistant or to any AI provider, and it is never used to train AI models.
• The keys that let HomeDash read from Xero are stored encrypted. Disconnecting revokes them. Transactions already read stay in the landlord's HomeDash account, and are kept and deleted as described in section 8.

We process this data to provide the service the account owner has asked for (performance of our contract with them).

6. Cookies & Tracking

We use cookies to ensure our platform functions correctly and to understand how visitors use our site. Google Analytics loads only if you accept it. When you create an account, the app also sends Google Analytics one sign-up event carrying no name or email. The full list of what this website stores in your browser, and the control to change your choice, is on our Cookies page.

7. Legal bases for processing

Under the UK GDPR, we rely on the following legal grounds:

8. Data Retention

We keep your account data while your account is open. Cancelling a subscription does not delete your data; closing your account does.

When you close your account, we stop billing, revoke API access and block sign-in straight away. We keep your data for 30 days in case you change your mind, then permanently delete your account, properties, tenancies, documents, photos and other files. Copies of documents you sent for e-signature are deleted from our signing service on request. Database records in our encrypted backups are gone within about four months of closure. Backup copies of uploaded files are currently kept longer; we are changing this.

Some records are kept for longer, with your email address and IP address removed:

• our activity log keeps routine events for 12 months, security events for 24 months and financial events for up to 7 years from the date of each event, for legal, tax and dispute purposes;
• we keep a minimal record that the deletion took place;
• technical logs for our API and webhooks are kept for up to 180 days.

Records of tenants being given documents through the tenant portal are kept while the landlord's account exists, because they can be needed as evidence long after a tenancy ends. They are deleted with the account.

Tenants have their own HomeDash sign-in, which is not deleted when their landlord closes an account. A tenant can ask us to delete it at any time by emailing support@homedash.co.uk. Accounts that are created but never verified are closed automatically after 48 hours and deleted 30 days later.

9. Your Rights

You have the right to access, correct, or delete your personal data. You can also object to processing or request data portability.

To exercise these rights, contact our privacy team at support@homedash.co.uk.

Note: We do not use automated decision-making or profiling that produces legal effects on you.

10. Business contacts we may approach

We look for property companies, and for firms that work with landlords (such as accountants, mortgage brokers and property sourcers), who might find HomeDash useful or want to refer their clients to it. If we contact you about HomeDash, this is how we found you and what we keep.

• Where the details come from: the public register at Companies House, your company's own website, public business profiles, and our own LinkedIn connections.
• What we keep: your name, your role, your company, business contact details published by your company (such as an email address on its website), links to the public pages we used, and notes on our contact with you. We never use home addresses, personal phone numbers, personal email addresses or dates of birth, and we never guess an email address.
• Why: to offer HomeDash to businesses it could help, or to ask whether a firm would like to recommend it. Our legal basis is legitimate interests. Every message is written and sent by a person, never automatically.
• How long: if you don't reply, we delete your details 12 months after we first found them. If you ask us not to contact you, we keep only your name and company on a do-not-contact list, so that we never contact you again.
• Who sees it: only HomeDash. We do not sell or share it. It is stored with Google (Google Workspace), and we use Anthropic's Claude to help research public business information. Neither uses it to train AI models.
• Your choice: reply "no thanks" to any message, or email support@homedash.co.uk, and we will stop the same day. You can also ask to see or delete what we hold, as in section 9.