GDPR Compliance

1. INTRODUCTION

House Made Ready Limited ("we", "us", or "our") is committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how we collect, use, store, and protect your personal information.

House Made Ready Limited is registered as a Data Controller. Company No: 16933702. You can contact us at privacy@housemadeready.com with any data protection queries.

2. WHAT PERSONAL DATA WE COLLECT

We may collect and process the following categories of personal data:

• Identity data: Name, title, username or similar identifier
• Contact data: Email address, telephone number, postal address
• Property data: Property address, postcode, property type and attributes you provide when generating a scorecard
• Financial data: Payment card details processed securely via Stripe (we do not store card details directly)
• Technical data: IP address, browser type and version, time zone, operating system, and platform
• Usage data: Information about how you use our website and services
• Marketing data: Your preferences in receiving marketing communications from us
• CRM & contact data (Business Users): Names, contact details, deal context, chain and pipeline data that Estate Agents and Developers enter about their own clients and contacts. For this data House Made Ready acts as a Data Processor; the Business User is the Data Controller.
• AI processing data: Property and contact information sent to our AI/LLM providers (Google Gemini, Anthropic Claude, OpenAI) to generate scorecards, reports, summaries and next-best-actions. We minimise the personal data transmitted and instruct providers not to use it for model training.
• Demographic & area data: Aggregated ONS statistics (crime, connectivity, employment, deprivation) about a postcode area. This is not personal data about you but may appear in your report.
• Vault document data: Ownership proof documents (utility bills, council tax bills, mortgage statements, title deeds), property documents (floor plans, EPC certificates, planning permissions, building control approvals) and property photos you upload to the Living Vault. These are stored securely and accessible only to you and our admin review team.
• Wallet & credits data: Credit balance, credit purchase history, subscription status, transaction records, report purchase history and refund history. Payment card details are processed by Stripe and are not stored on our servers.
• Lead share consent data: Your consent status for sharing contact details with each partner type (estate agents, developers, trades, mortgage brokers), the date consent was given, and the date consent was withdrawn (if applicable).
• Maggie AI conversation data: The content of your conversations with Maggie AI within the portal, including prompts you send and AI-generated responses, stored to provide the conversational guidance feature and improve response quality.

We do not knowingly collect special-category data (health, ethnicity, religion, sexual orientation, biometric or criminal-conviction data). Our CRM fields are not designed to hold such data — Business Users must not enter it. Contact privacy@housemadeready.com if you believe special-category data has been recorded in error.

3. LAWFUL BASIS FOR PROCESSING

We process your personal data under the following lawful bases:

• Contract: Processing necessary to deliver property scorecards, reports, vault storage, wallet functionality and related services you have requested
• Legitimate interests: Improving our platform, preventing fraud, operating our business in a responsible manner, and generating AI-powered insights and next-best-actions via Maggie AI. We have completed a Legitimate Interests Assessment (LIA) balancing our interests against your rights and freedoms.
• Consent: Where you have given explicit consent, such as for marketing communications and for Lead Share Consent — sharing your contact details with specific categories of partner professionals (estate agents, developers, trades, mortgage brokers). Consent is given via separate, unticked checkboxes for each partner type and can be withdrawn at any time.
• Legal obligation: Where we are required to process data to comply with UK law, including retaining payment records for 7 years under UK tax law

AI processing (Maggie AI): We process property and contact data through Maggie AI under the lawful basis of legitimate interests for generating scorecards, reports, insights and next-best-actions. We minimise the personal data sent to LLM providers (Google Gemini, Anthropic Claude, OpenAI) and instruct them not to use your data for model training. You have the right to object to this processing and request human review of any AI output. See our Privacy Policy Section 4.6 for full details.

4. HOW WE USE YOUR DATA

We use your personal data for the following purposes:

• Generating and delivering AI-powered property scorecards and reports
• Processing payments for paid reports and subscriptions
• Creating and managing your account
• Communicating with you about your reports and account
• Connecting you with relevant estate agents, trades, and professionals (with your consent)
• Sending marketing communications where you have opted in
• Improving our services and platform through analytics
• Complying with legal and regulatory obligations

5. DATA SHARING & THIRD PARTIES

We do not sell your personal data. We may share your data with trusted third parties only where necessary:

• Stripe: Secure payment processing (stripe.com/gb/privacy)
• Cloud hosting: Our hosting provider (UK/EU region) under a Data Processing Agreement
• AI / LLM providers: Google (Gemini), Anthropic (Claude) and OpenAI process property and contact data to generate AI reports. Transfers outside the UK are protected by Standard Contractual Clauses or the UK-US / EU-US Data Privacy Framework.
• Mapping & data sources: OpenStreetMap, Ordnance Survey, Mapillary, HM Land Registry, ONS, EPC register and local authorities
• Social channels: LinkedIn, Instagram and Google, when a Business User connects an account to publish marketing posts
• Service providers: Email delivery and analytics providers who process data on our behalf under Data Processing Agreements
• Estate agents / trade professionals: Only where you have explicitly requested a referral or connection
• Regulatory authorities: Where required by law

A Data Processing Agreement (DPA) is available for all Business Users who act as Data Controller for contact data stored in the platform. Request it from privacy@housemadeready.com.

6. DATA RETENTION

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Free guest scorecards: retained for up to 3 days unless you create an account.
• Account data: retained for the duration of your account and for up to 6 years thereafter for legal compliance purposes.
• Business User CRM & pipeline data: retained for the duration of the Business User's account plus 2 years, or until the Business User deletes the record (whichever is sooner).
• Chain-repair contact data: retained for the duration of the active chain matter plus 12 months, unless the contact opts out sooner.
• Team member data: retained for the duration of the inviting Business User's account, plus 6 months after removal.
• Payment records: retained for 7 years as required by UK tax law.
• Living Vault documents: retained for the duration of your account; deleted within 30 days of account closure. Ownership proof documents are deleted from active storage immediately upon admin verification decision. You can delete individual vault documents at any time from the portal.
• Wallet & credits data: credit balance and transaction history retained for the duration of your account; payment records retained for 7 years for UK tax law compliance. Credit purchase history retained for the duration of your account plus 2 years.
• Lead share consent records: retained for the duration of your account plus 2 years, or until you withdraw consent (whichever is sooner).
• Maggie AI conversation history: retained for the duration of your account; you can delete individual conversations at any time from the portal.

Business Users can delete individual CRM records, pipeline deals and chain contacts directly from the platform at any time. Full account and data deletion can be requested at privacy@housemadeready.com.

7. YOUR RIGHTS UNDER UK GDPR

You have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you, including vault documents, wallet transaction history and Maggie AI conversation logs
• Right to rectification: Request correction of inaccurate or incomplete data, including property attributes used in scorecard generation
• Right to erasure: Request deletion of your personal data, including vault documents and Maggie AI conversation history. You can also delete individual vault documents and conversations directly from the portal at any time without making a formal request.
• Right to restriction: Request that we restrict processing of your data in certain circumstances
• Right to data portability: Receive your data — including vault documents and wallet transaction records — in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests, including Maggie AI processing of your property data, or for direct marketing
• Right to withdraw consent: Withdraw Lead Share Consent at any time via your portal dashboard or by emailing privacy@housemadeready.com. Withdrawal does not affect the validity of sharing that occurred before withdrawal.
• Rights related to automated decision-making: Not be subject to solely automated decisions that significantly affect you. You can request human review of any Maggie AI output by contacting support@housemadeready.com.
• Right to query credit balance: Request a statement of your current credit balance and transaction history from your wallet at any time via the portal or by contacting support@housemadeready.com.

To exercise any of these rights, please contact us at privacy@housemadeready.com. We will respond within 30 days.

8. DATA SECURITY

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption of data in transit and at rest, access controls, and regular security reviews. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you and the ICO as required by UK GDPR.

9. INTERNATIONAL TRANSFERS

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR, including Standard Contractual Clauses or adequacy decisions by the UK Government.

LLM provider transfers (Maggie AI): When Maggie AI processes your property and contact data, it may be transferred to the following LLM providers located outside the UK:

• Google (Gemini): Processing may occur in the US or EU. Protected by the UK-US / EU-US Data Privacy Framework and Standard Contractual Clauses.
• Anthropic (Claude): Processing may occur in the US. Protected by Standard Contractual Clauses.
• OpenAI: Processing may occur in the US. Protected by Standard Contractual Clauses.

We minimise the personal data transmitted to these providers and instruct them not to use your data for model training. You have the right to object to this transfer; contact privacy@housemadeready.com if you wish to do so. Alternative processing arrangements may be available for specific features.

10. COMPLAINTS

If you have concerns about how we handle your personal data, please contact us first at privacy@housemadeready.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

11. CONTACT US