Privacy Policy

1. Who we are

Properlianceis a property-compliance platform for UK landlords and letting agencies. This policy applies to personal data we process as described below, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Properliance is operated by Vyrovo, a company registered in the United Kingdom, which is the data controller for personal data processed through the service. For privacy questions or to exercise your rights, contact us at properliance@vyrovo.com.

2. Controller and processor roles

For the property, document, tenant and maintenance data that a customer organisation stores in the platform, that organisation is the data controller and Properliance acts as a data processor on its instructions. A Data Processing Agreement (DPA) governs this relationship and is available to customers.

For account, sign-in, billing and marketing data we collect directly from users of the service, Properliance acts as the data controller.

3. Data we collect

• Account data: name, email address, organisation name, role, and authentication details (passwords are stored only as salted hashes by our authentication provider).
• Property & compliance data: properties, compliance documents (e.g. EPC, gas safety, EICR), certificate metadata and expiry dates, and maintenance tickets.
• Sign-in session data:IP address, the approximate city/country it maps to, device and browser, and session activity times — shown only to you on your Security page so you can spot and end sessions you don't recognise.
• Billing data: billing email, VAT/company registration numbers, plan and invoice history. Card payments are handled by our payment processor; we do not store card numbers.
• Audit logs: records of security- and compliance-relevant actions taken in the platform.
• Cookies & analytics: see section 8.

4. Lawful bases for processing

• Contract (Art 6(1)(b)) — to provide the service to you and your organisation.
• Legitimate interests (Art 6(1)(f)) — to keep accounts secure (sign-in session records), prevent abuse, and improve the product. You can object to processing based on legitimate interests.
• Legal obligation (Art 6(1)(c)) — to retain records we are required to keep, including compliance-related audit records.
• Consent (Art 6(1)(a)) — for optional analytics cookies and any marketing email. You can withdraw consent at any time.

5. Where your data is stored (data residency)

Application data is hosted in the European Union. Our primary database and file storage run on Supabase in the eu-central-1 (Frankfurt, Germany) region. Documents are held in private, encrypted storage and are accessible only via short-lived signed links. Hosting and content delivery are provided by Vercel.

6. Processors and sub-processors

We use the following service providers to operate Properliance:

• Supabase — database, authentication and encrypted file storage (EU, eu-central-1).
• Vercel — application hosting and content delivery.
• Stripe — payment processing and billing.
• Resend — transactional email (e.g. sign-in, verification and reminder emails).

Each provider processes personal data only as needed to deliver its service and under appropriate data-processing terms. A current sub-processor list is available to customers on request.

7. International transfers

Our application data stays in the EU. Where a provider (for example a payment or email provider) processes limited data outside the UK/EU, those transfers are protected by an appropriate safeguard under UK GDPR, such as the UK International Data Transfer Agreement / Addendum or Standard Contractual Clauses, together with any required additional measures.

8. Cookies

We use strictly necessary cookies to keep you signed in and remember your preferences — these are always on. With your consent we also set optional analytics cookies to understand and improve the product. You choose via the cookie banner on first visit, and your choice is stored for 12 months; clear your browser cookies to be asked again. We do not use advertising cookies.

9. How long we keep data (retention)

• Account & organisation data: kept while your account is open. When you request closure, a 30-day grace periodbegins; you can cancel during this time. If it isn't cancelled, all of your data, files, compliance records, audit logs and user accounts are permanently and irreversibly deleted at the end of the grace period — nothing is retained.
• Sign-in session records: kept for up to 90 days of inactivity, then deleted.
• Backups:residual copies in routine encrypted backups are overwritten on our provider's normal backup cycle after deletion.

10. Your data subject rights

Subject to applicable law, you have the right to:

• Accessa copy of your personal data — agency admins can export their organisation's data from the app.
• Rectification of inaccurate data.
• Erasure("right to be forgotten") — by requesting account closure. After a 30-day grace period (during which you can cancel), your data is permanently and irreversibly deleted.
• Portability — receive your exported data in a structured, machine-readable format.
• Restriction or objection to certain processing, and the right to withdraw consent at any time.

To exercise a right, contact us using the details in section 1. If your data is held by a customer organisation as controller, we will forward your request to them. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

11. Security

We use appropriate technical and organisational measures to protect personal data, including HTTPS-only access, encryption in transit and at rest, strict access controls and tenant data isolation, optional multi-factor authentication, and audit logging.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the service. The "last updated" date above reflects the current version.

13. Contact

For privacy questions or to exercise your rights, contact properliance@vyrovo.com.