Privacy Notice

1. What we collect and why

• Account data (email address, password credentials managed by our authentication provider, sign-in timestamps) — to create and secure your account. Legal basis: performance of our contract with you.
• Tenancy data you enter (property address, landlord name and contact details, lease and move-in/move-out dates, deposit amount, room names, checklist notes) — to build your condition report, calculate deadlines, and prepare documents. Legal basis: contract performance.
• Photos and uploaded documents (room photos with server-set capture timestamps, landlord notices you upload) — to store your evidence and, where you ask for it, to extract itemized deductions. Legal basis: contract performance.
• Communication preferences and email logs (reminder opt-in status, which reminders were sent and when) — to send the reminders you enabled and to avoid duplicates. Legal basis: contract performance and your consent for optional reminders.
• Purchase records (which product you bought, purchase status, transaction reference from Paddle) — to unlock paid features. We do not receive or store your card number. Legal basis: contract performance and legal obligation.
• Technical and security data (IP address, device/browser information, error and access logs) — to keep the Service secure, prevent fraud and abuse, and diagnose faults. Legal basis: our legitimate interest in a secure, working service.

We do not sell your personal data, and we do not use your photos to train third-party models beyond processing your own request.

2. Who we share it with

• Hosting, database, and storage providers — to run the application and store your photos in private, access-controlled storage.
• Merchant of Record — Paddle.com — Paddle is the Merchant of Record for all our orders and independently processes payment, subscription management, tax compliance, invoicing, and refunds. Paddle handles your payment details directly under its own privacy notice.
• Email delivery provider — to send transactional reminders and account emails.
• AI processing provider — when you use document reading or drafting features, the relevant text or image is sent for processing and returned to you.
• Address lookup (Google Maps Platform) — the text you type into the address field is sent to Google to return suggestions. Manual entry is always available if you prefer not to use it.
• Professional advisers (legal, accounting) and authorities where we are legally required to disclose.

3. Retention

We keep your account, tenancy records, and photos for as long as your account is active, so your evidence stays available through a dispute. You can delete individual rooms, photos, or your whole account at any time; deleted content is removed from our database and storage. Email logs and security logs are kept for a limited period for troubleshooting and abuse prevention. Purchase records are retained as long as required for tax and accounting purposes. When data is no longer needed we delete or anonymize it.

4. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent (for example by turning reminders off in Settings). Residents of the EEA/UK may also complain to their supervisory authority; California residents may exercise CCPA rights including the right to know and delete, and we do not sell or share personal information for cross-context behavioral advertising. Email support@savemydeposit.com to exercise any right — we aim to respond within 30 days.

5. International transfers

Our providers may process data in the United States and other countries. Where data leaves the UK/EEA, transfers rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

6. Security

We use appropriate technical and organizational measures: encryption in transit, row-level access rules so you can only reach your own records, a private photo bucket served through short-lived signed links, and server-set photo timestamps that clients cannot alter. No system is perfectly secure, but we work to protect your data and to notify you of incidents where required.

7. Cookies

We use strictly necessary cookies and browser storage to keep you signed in and to operate checkout. We do not run advertising cookies. You can clear or block cookies in your browser, though sign-in will not work without the essential ones.

8. Contact

Save My Deposit operator, savemydeposit.com — support@savemydeposit.com. See also our Terms & Conditions and Refund Policy.