Your information, in plain English
We collect as little as we can, we never sell it, and we never use it for advertising. Here’s exactly what we hold and the control you have over it, whether you rent in the US or the UK.
What we collect and why
Your email address and the state or nation you rent in
- When
- When you request the free Deposit Protection Kit
- Why
- To send your kit, tailor it to local rules, and email you early-access updates.
- Legal basis
- Your consent (UK/EU GDPR Art. 6(1)(a)). You can withdraw it at any time.
A cookie recording that you've requested the kit
- When
- After you submit the kit form
- Why
- So we don't show you the same form twice.
- Legal basis
- Strictly necessary for the service you asked for (PECR reg. 6(4)).
Aggregate usage data via Google Analytics (pages viewed, device type, approximate location)
- When
- Only if you allow analytics (see below)
- Why
- To understand which pages help renters, and improve them.
- Legal basis
- UK/EU: your consent. US: our legitimate business purpose, with an opt-out.
Cookies and analytics
- UK and EU visitors (and anywhere we can’t place you): analytics stays off until you choose “Accept all”. Rejecting is one click, just like accepting.
- US visitors: we show a notice and run analytics unless you opt out. If your browser sends a Global Privacy Control signal, we treat it as an opt-out automatically.
- Google Analytics runs with advertising features and Google signals switched off. Withdrawing consent deletes its cookies straight away.
Change your choice any time: . The full list is on our cookie notice.
We don’t sell or share your personal information
We have not sold or “shared” (for cross-context behavioural advertising) personal information in the past 12 months, and we don’t knowingly collect information from anyone under 16. We don’t use your information for profiling or automated decisions.
Your rights
UK & EU (UK GDPR / GDPR)
Access, correct, delete or export your data; object to or restrict how we use it; withdraw consent at any time. You can also complain to the ICO or your local EU data protection authority.
United States (CCPA/CPRA & state laws)
Know what we collect, get a copy, correct it, delete it, and opt out of any sale or sharing, without being treated differently for asking. An authorized agent can make a request for you. If we decline a request, you can appeal.
To make a request, reply to any email we’ve sent you. We’ll confirm we’ve received it and respond within one month (UK/EU) or 45 days (US).
How long we keep it
We keep your kit request for as long as you’re subscribed to early-access updates, and delete it when you unsubscribe or ask us to. Google Analytics data is kept for Google’s standard retention period and is only ever viewed in aggregate. Some of our service providers (like Google) may process data outside the UK/EU under appropriate safeguards such as standard contractual clauses.
Last updated 20 October 2026. We’ll update this page if what we collect changes.