Privacy Policy

1. Who we are

Comprent is run by Grafikui Ltd, a company registered in England and Wales (company number 16426243), registered office 3 Anlaby Road, Teddington, England, TW11 0PT. For your account data, Grafikui Ltd is the data controller.

Information you add about your tenants belongs to you: you are its data controller, and Comprent processes it on your behalf as your data processor, only to provide the service to you.

2. What we collect

• Your account: name, email address, a securely hashed password, your plan and subscription history.
• Your properties and tenancies: addresses, property details, tenancy dates, rent, deposit details, compliance tasks and deadlines, and anything else you enter, including tenant names and contact details.
• Your files: certificates, evidence and photos you upload, and the documents Comprent generates for you.
• Compliance history: a daily record of your portfolio compliance score, to show your trend over time.
• Assistant conversations: the questions you ask the AI assistant and its answers, kept so you can return to them.
• Tenant maintenance reports: if you share a property’s maintenance link, tenants can report an issue without an account. A report holds the description and, if they give it, their name.
• Payments: handled by Stripe. Comprent never sees or stores your full card details.
• PRS Database checker: lookups are counted by region only. The postcode you enter is sent to postcodes.io to find the region and is not stored.
• Registration reminders: if you ask the checker to email you when your region opens, we keep your email address and region, send one confirmation email, then one reminder on the day the region opens.
• Product emails: after you sign up, a few emails over the first weeks with tips and plan information. Each one has an unsubscribe link, and you can switch them off in Settings. Emails about your account and your deadlines are separate and continue.
• Beta waitlist: if you join the waitlist on the beta page, we keep your email address so we can tell you when a place opens, and we are notified that you joined.
• Emails you send us: messages to info@comprent.co.uk and our replies, including your name and email address and anything you write.
• Technical data: when something breaks, an error report with the error and the page (no IP address, cookies or form contents), and a notification to us that a page was visited, saying only which page, whether the visitor was signed in and, if so, on which plan.

3. Why we use it, and our lawful basis

• To provide Comprent (tracking deadlines, generating documents, storing files, the assistant, account emails): performance of our contract with you.
• To take payment and keep financial records: contract, and our legal obligations for tax and accounting.
• To keep Comprent secure and working (error reports, uptime checks, rate limits, preventing misuse): our legitimate interest in running a reliable, secure service.
• To send a PRS registration reminder: your consent, which you give by confirming the sign-up and can withdraw at any time with the cancel link.
• To send product emails: our legitimate interest in telling people who have signed up about the features and plans that fit them, with an opt-out in every email.
• To tell you when a beta place opens: your consent, which you give by joining the waitlist and can withdraw at any time by emailing privacy@comprent.co.uk.
• To reply to your emails: our legitimate interest in answering you, or performance of our contract with you if you are a customer.

4. The AI assistant

To answer your questions, Comprent sends the assistant’s model provider your question and a summary of your portfolio: property addresses, rent, tenancy status, open tasks, expiring certificates and open maintenance items. Tenant names from your records are not sent. Please don’t type tenant names or other details about your tenants into your questions.

Comprent currently uses Google’s Gemini API. On the tier Comprent uses, Google’s terms allow it to use the content it receives to improve its services, which is a further reason we keep tenant names out of what is sent.

5. Who we share it with

We never sell personal data or use it for advertising. We share it only with the services that run Comprent:

• Supabase: database, sign-in and file storage, hosted in the EU (Frankfurt).
• Vercel: hosting for the website and app. Requests are processed in the United States. Vercel Web Analytics also counts page views of the public pages and where visitors came from, without cookies and without identifying you.
• Stripe: subscription payments.
• Resend: sending Comprent’s emails, including sign-up and password emails.
• Zoho Mail: hosting the info@comprent.co.uk mailbox, where emails you send us and our replies are stored.
• Google (Gemini API): the AI assistant, as described in section 4.
• Sentry: error reports, stored in the EU, without IP addresses.
• Cloudflare (Turnstile): a check on the sign-up and sign-in forms that tells people from bots. It reads signals from your browser when you use those forms, and does not set advertising cookies.
• postcodes.io: finding the region for a postcode entered in the PRS checker.
• ntfy.sh: notifications to us that a page was visited (the page, and the website the visitor came from), that someone signed up, joined the waitlist, started a checkout or used the PRS checker, without names, emails or IP addresses.
• GitHub: an encrypted nightly backup of the database, kept for 30 days.
• Google Fonts: the typefaces in documents Comprent generates, which your browser loads when you open one.

We may also disclose data where the law requires it, for example to a court or regulator.

6. Transfers outside the UK

Some of these providers process data in the EU or the United States. Transfers to the EU rely on the UK’s adequacy regulations for the EEA. Transfers to the United States rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or on the ICO’s International Data Transfer Addendum to the standard contractual clauses in the provider’s terms.

7. How long we keep it

• Your account and everything in it: until you delete it. You can delete any property, tenancy or document at any time, use Delete my data on the Billing page to clear your records, or Delete account in Settings to close your account.
• When you delete your account: your profile, properties, tenancies, tasks, assistant conversations, uploaded files and generated documents are deleted straight away. Copies in our encrypted nightly backups are gone within 30 days.
• Registration reminders: deleted once the reminder has been sent or when you cancel. Unconfirmed sign-ups are deleted after 30 days.
• Waitlist emails: kept until we have offered you a place, or until you ask us to remove your address.
• Emails you send us: kept in our mailbox for as long as we need them to deal with your request and our business records.
• Error reports: kept by Sentry for up to 30 days.
• Payment records: kept by Stripe and in our accounts for as long as tax and company law require.

8. Cookies and storage on your device

Comprent uses only what it needs to work. There are no advertising or tracking cookies.

• Sign-in cookies from Supabase, which keep you signed in. Essential.
• comprent-cookie-consent in your browser’s local storage, which remembers that you have dismissed the cookie notice.
• comprent-changelog-seen in local storage, which remembers which “What’s new” entries you have seen.

9. Security

Connections to Comprent are encrypted with HTTPS. Database access is restricted with row-level security, so each account can reach only its own records, and nightly backups are encrypted. Uploaded files and generated documents are kept in private storage and open only through short-lived links for the account they belong to. No system is perfectly secure; if a breach affected your data, we would tell you and, where required, the ICO.

10. Your rights

Under UK GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. We reply within one month.

Tenants whose details a landlord has added should contact that landlord first, since the landlord is the controller of that information. We will help the landlord respond.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

11. Landlords’ responsibilities

As the controller of your tenants’ information, you are responsible for having a lawful basis to add it to Comprent and for telling your tenants how you use their data.

12. Changes and contact

Comprent is for landlords and letting agents, not for children. If this policy changes, we will update the date at the top and tell account holders about significant changes by email. For any privacy question or request, contact privacy@comprent.co.uk.