Privacy Policy

Lettings Desk (“we”, “us”, “our”) provides an AI front-desk service that answers routine landlord and tenant queries and delivers documents on behalf of letting agents.

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), the data controller is [Company legal name], a company registered in England & Wales under company number [company number], with its registered office at [registered address]. We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO reg. number].

You can reach us about anything in this policy via our contact form.

Our role depends on whose data is involved:

• Letting agents and prospective customers. When an agency contacts us, signs up, or uses our dashboard, we are the controller of that business contact data.
• Landlords and tenants.When our AI front desk handles calls and documents for an agency’s landlords and tenants, we act as a processoron that agency’s instructions. The agency is the controller of that data. This is governed by the data processing terms in our agreement with the agency.

From prospective and active agency customers:

• Your name, agency name, email address, and phone number when you complete our enquiry form.
• Details you choose to share about your agency (number of properties under management, operational challenges).
• Account and sign-in information when you use the agency dashboard.

When our AI handles a call for an agency (landlord/tenant data):

• The caller’s phone number and the name they give.
• A record of the conversation: what was asked, which documents were requested or sent, and what was escalated to the agency’s team.
• The registered email address a document was delivered to (we deliver documents only to the address held on file, never to the calling number).

We do not ask for, and our AI is not designed to collect, special category data (such as health information). Please don’t share it during a call.

• To respond to enquiries and provide the service: lawful basis: performance of a contract, or our legitimate interest in responding to business enquiries.
• To verify a callerbefore releasing documents: on the agency’s instruction, for the legitimate interest of keeping landlord and tenant documents secure.
• To deliver requested documents(e.g. statements, tenancy agreements, gas safety, EPC, EICR certificates): on the agency’s instruction in performance of its services.
• To keep a log of every conversation so the agency has a record of what was answered, sent, and escalated: legitimate interest in service quality, security, and accountability.
• To secure and improve the service: legitimate interest. We do not use call content, tenant, or landlord data to train AI models.

Calls are handled by an automated voice assistant. It answers only from the facts and documents an agency has approved, and hands anything ambiguous, legal, or unusual to a human. Conversations are processed to understand the request, verify the caller, and deliver documents.

Your personal data is notused to train any AI model, ours or our providers’.

We don’t sell your data. We share it only with service providers who process it on our behalf under contract, and only as needed to run the service:

• Vercel:application hosting.
• Neon:database for the conversation log.
• ElevenLabs:the voice AI that answers calls.
• Postmark:sending document delivery emails.
• Clerk:dashboard authentication.
• Formspree:processing website enquiry-form submissions.

We may also disclose data where required by law, or to establish, exercise, or defend legal claims.

We host data on UK/EU infrastructure. Where a provider processes data outside the UK or EEA, we rely on an adequacy decision or appropriate safeguards (such as the UK International Data Transfer Agreement or Standard Contractual Clauses) to protect it.

• Enquiry-form data: kept while we’re in contact and for a reasonable period afterwards, then deleted.
• Conversation logs and document-delivery records: retained for the agency under our agreement with them; deleted on the agency’s instruction or when our relationship ends.
• Document links sent to recipients expire after 24 hours.

Data is encrypted in transit and at rest. Document delivery is protected by short-lived, signed links, and documents are sent only to the verified address on file. Access to the agency dashboard requires authentication.

Our public website uses only the cookies necessary to make it work. The agency dashboard uses essential cookies for sign-in and session management (via Clerk). We don’t use advertising cookies.

Under UK data protection law you have the right to access, correct, delete, or restrict the processing of your personal data, to object to processing, and to data portability.

If you’re a landlord or tenant and your data was handled on an agency’s behalf, please contact that agency first, as they control the data. We’ll support them in responding. For data we control, get in touch via our contact form.

You also have the right to complain to the ICO at ico.org.uk, though we’d appreciate the chance to resolve things first.

Our service isn’t directed at children, and we don’t knowingly collect their data.

We may update this policy from time to time. We’ll change the “last updated” date above, and for material changes we’ll take reasonable steps to let affected agencies know.