Privacy notice

1. The valuation enquiry form

When you fill in the enquiry form on the contact page or anywhere else on the site and press send, the following is stored in our database:

• Your name and phone number. Both are required, because a lead we cannot reply to is no use to you or to us.
• What you told us you are: homeowner, hotel or aparthotel operator, portfolio investor, an owner who self-manages, or other.
• The property and location you typed in, and your message, with a note of which page the form was on.
• The page that referred you to the site, and any campaign tags (utm_source, utm_medium, utm_campaign) on the link you arrived through.
• Your country (derived by our host from your IP address), your device type, and your browser's user-agent string.
• The same hashed visitor identifier described below, so we can see which pages a lead read before enquiring.

Pressing send also opens WhatsApp with a pre-filled message. That is your choice to send or not. The enquiry is saved on our side either way, which is deliberate: we would rather have your details than lose you to a blocked pop-up.

2. Analytics, without the cookies

We record which pages are viewed and a handful of events: a phone number tapped, a WhatsApp link clicked, an email address clicked, the income estimator on the fees page used, an enquiry submitted. With each one we store the path, the referrer, the UTM tags, country, device type, browser, operating system and browser width.

We do not store your IP address. To count one visitor rather than twenty pageviews, our server takes your IP address and user-agent string, mixes them with a secret salt and the current date, and keeps only a SHA-256 hash of the result. The hash changes every day, so it cannot be used to follow you across days, and the raw IP is never written down anywhere.

3. Whatever you send us directly

If you phone, email or message us on WhatsApp, we keep what you send so that we can reply and keep track of the conversation. Requests for a valuation usually include an address and details about the property.

• Your enquiry. We rely on Article 6(1)(b) of the UK GDPR: taking steps at your request before entering into a contract. Where you are asking about our services rather than about a specific property, we rely instead on Article 6(1)(f), our legitimate interest in answering people who ask us a question.
• Analytics. Article 6(1)(f), legitimate interests: knowing which pages are read and which are ignored is how the site gets better. We have kept the collection to the minimum that answers that question, with no cookies and no raw IP addresses, precisely so that the balance falls in your favour.
• Marketing. If we ever send marketing that is not a direct reply to your enquiry, we will ask for your consent first, and every message will carry a one-click way out. Today we do not run a marketing list.

We do not make automated decisions about you that produce a legal or similarly significant effect. A person reads every enquiry. The number the estimator on our pricing page shows you is an indicative model run in your own browser, not a decision about you.

• Supabase hosts the database that holds enquiries, pageviews and events. They process the data on our instructions, as our processor. They do not use it for their own purposes.
• Vercel hosts and serves this website. Their servers see the requests your browser makes, including your IP address, in order to deliver the pages.
• WhatsApp (Meta) sees your message if you choose to message us there, on their own terms rather than ours. If you would rather not, phone or email us instead.
• Google and jsDelivr serve the typeface, the icons and the map embed, as described above.
• Our trusted partners. If you become a client, we share what is needed to do the job with the vetted partners who deliver cleaning, linen and laundry and maintenance and repairs, and with the booking channels your property is listed on. Only what is needed, and only when it is needed.
• Professional advisers and authorities, where we are required by law to hand something over.

We do not sell personal data. We do not share it with advertising networks. Some of the companies above may store or process data outside the UK. The specific hosting regions and the transfer safeguards in place are {{TODO: confirm with FSM}}.

Security. The database is reachable only from our server, using a secret key that never reaches a browser. The site is served over HTTPS. No system is perfect, and we will tell you promptly if something goes wrong in a way that affects you.

Children. This site sells property management to adults. It is not aimed at children and we do not knowingly collect their data.

Changes. If we change what we collect, we change this notice. Material changes will be flagged at the top of this page.

Your contract with us. This notice covers the website. The website terms of use are separate, and the management agreement for the fully managed plan or for listing on Flexiestays is a separate document again, given to you before you sign anything.