Legal
Privacy Policy
Last updated
This policy explains what personal data InventorySafe collects, why we use it, who we share it with, how long we keep it and where it is stored, and the rights you have. It covers our website and the InventorySafe application.
We handle property inspection media and reports that can contain personal data about the people connected to a tenancy. Protecting that data — and being able to show what a report said on the day — is central to what the service is for.
1. Who we are
InventorySafe Ltd (“InventorySafe”, “we”, “us”) provides property inventory services and the software behind them to letting agents, landlords and their inventory clerks in the United Kingdom. We are the data controller for the personal data described in this policy except where we act as a processor on behalf of a business customer (see section 2).
- Legal entity
- InventorySafe Ltd
- Company number
- [Company number — from Companies House]
- Registered office
- [Registered office address]
- ICO registration
- [ICO registration number]
- Data protection contact
- contact@inventorysafe.co.uk
2. Controller and processor: our two roles
Whether we are the “controller” or a “processor” of a given piece of information depends on who decides why it is used:
- We are the controller
- for the personal data of our account holders (agents, landlords and clerks), website visitors, and enquirers — the people we deal with directly to run and improve the service.
- We are a processor
- for the contents of an inventory — the capture media and the report about a specific property and its occupants. Our business customer (the letting agent or landlord who instructed the inspection) is the controller for that data; we process it on their documented instructions to produce the report.
If your data appears in a report because you rent or occupy a property, the controller is usually the letting agent or landlord who commissioned the inspection. We will help them respond to any request, but they are your first point of contact — see section 10.
3. The information we collect
Account and contact data
Name, email address, telephone number, employer or agency, role, and the credentials used to sign in. Authentication is handled through Google Firebase Authentication; we do not store your password.
Property capture media
Video, photographs, voice notes and typed notes recorded by a clerk during an inspection. This media documents the condition of a property and its contents. It can incidentally include images or voices of people present, personal possessions, and — where visible — documents or meter readings. Photographs and video carry technical capture metadata such as the time of capture.
Report data
The structured record built from the capture: rooms and items, their described condition and cleanliness, alarms, meters and keys, and any clerk observations. Reports are produced as evidence to help settle tenancy deposit disputes.
Technical and usage data
IP address, device and browser information, and log records of actions taken in the service (for security, troubleshooting and audit). See section 11 for cookies.
We do not intentionally collect special category data (such as health or biometric data). Please avoid dictating such details into voice or typed notes unless they are strictly necessary for the report.
4. How and why we use your information
We use personal data only where the law provides a basis for it. The bases we rely on are:
- To perform our contract with you or your organisation — creating and securing accounts, running inspections, producing and delivering reports and summaries, and handling billing and support.
- Legitimate interests — keeping the service secure, preventing misuse, maintaining an audit trail, understanding how the product is used so we can improve it, and contacting business users about the service. We balance these against your interests and rights.
- Legal obligation — meeting our accounting, tax and other statutory duties, and responding to lawful requests.
- Consent — where we ask for it, for example for non-essential cookies or optional marketing. You can withdraw consent at any time.
Where we act as a processor for report content, we use that data only to provide the service to the controller who instructed us, on their instructions.
5. How we use artificial intelligence
To turn hours of raw capture into a draft report quickly, we use Google’s Vertex AI (the Gemini models) to transcribe voice notes and to draft descriptions and condition observations from the media. This processing takes place within Google Cloud in our UK region.
A qualified clerk reviews, corrects and signs every report. The clerk is the author of record — nothing an AI drafts reaches a finished report without human review, and every observation must cite the media it came from.
Because a person makes the decisions that matter, we do not carry out automated decision-making that produces legal or similarly significant effects about you within the meaning of Article 22 UK GDPR. The AI assists the clerk; it does not replace their judgement.
Our AI provider does not use the content we send it to train its foundation models. We do not sell personal data, and we do not use the contents of your inventories to train models for other customers.
7. Where your information is stored
Tenant and property data — capture media, reports and the database — is stored in London, United Kingdom (Google Cloud region europe-west2). Keeping this data in the UK is a deliberate residency commitment, not a matter of performance.
A limited amount of data (for example website delivery, error logs and some email routing) may be processed by providers located outside the UK. Where personal data is transferred outside the UK, we rely on an adequacy decision or on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
8. How long we keep your information
A deposit dispute can surface long after a tenancy ends, so evidence has to outlast it. We retain inventory media and reports for approximately 6 years to support dispute defence, unless the controller who instructed the inspection asks us to delete them sooner and there is no legal reason to keep them. Media moves to lower-cost archival storage over time but remains available throughout the retention period.
Account and contact data is kept for as long as your account is active and for a reasonable period afterwards. We keep records needed for accounting and tax for the period the law requires (generally six years). When data is no longer needed, we delete it or irreversibly anonymise it.
9. How we protect your information
We take appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls and least-privilege access for staff and clerks, network isolation of the database and application, audit logging, and pinning data to our UK region. Signed reports are immutable: a correction creates a new version with a visible amendment trail, so what a report said on a given day — and who changed what — can always be established.
No system is perfectly secure, but we work to protect your data and to meet our obligations if something goes wrong, including notifying the ICO and affected people where the law requires.
10. Your rights
Under UK data protection law you have rights over your personal data. Depending on the circumstances, these include the right to:
- be informed about how we use your data (this policy);
- access a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have data erased in certain circumstances;
- restrict or object to certain processing;
- data portability, where processing is by automated means and based on consent or contract; and
- withdraw consent at any time, where we rely on consent.
To exercise any of these, contact contact@inventorysafe.co.uk. We will respond within the statutory time limit (usually one month). Where your data appears in a report and we are acting as a processor, please contact the letting agent or landlord who commissioned the inspection — they are the controller — and we will support them in responding.
You also have the right to complain to the Information Commissioner's Office. We would ask for the chance to resolve your concern first, but you can contact the ICO at ico.org.uk or on 0303 123 1113.
12. Changes to this policy
We may update this policy as the service and the law evolve. When we make a material change we will update the “last updated” date above and, where appropriate, tell you directly. Please review it from time to time.
13. How to contact us
For any question about this policy or your personal data, contact our data protection contact at contact@inventorysafe.co.uk, or write to us at our registered office ([Registered office address]). For general enquiries, email hello@inventorysafe.co.uk.
This Privacy Policy should be read alongside our Terms of Service.