Privacy Policy

1. INTRODUCTION

This Privacy Policy explains how House Made Ready Ltd ("we", "us", "our") collects, uses, shares, and protects your personal data when you use our website, services, and products.

We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

Please read this policy carefully. By using our services, you acknowledge that you have read and understood how we process your personal data.

2. WHO WE ARE (DATA CONTROLLER)

House Made Ready Ltd is the Data Controller for the personal data you provide to us. This means we determine how and why your personal data is processed.

For questions about this Privacy Policy or to exercise your data rights, contact us at:

You also have the right to contact the Information Commissioner's Office (ICO) at www.ico.org.uk if you have concerns about how we handle your data.

3. WHAT PERSONAL DATA WE COLLECT

3.1 Information You Provide Directly

For Homeowners and Property Buyers:

• Full name, email address, phone number
• Property address and postcode
• Property ownership status (owner, tenant, buyer)
• Property details (bedrooms, bathrooms, current condition)
• Development preferences (extensions, lofts, conversions, annexes)
• Financial information (current property value estimates, investment budgets)
• Communication preferences

For Estate Agents (Business Subscribers):

• Business name and trading address
• Contact person name, email, and phone number
• Company registration number (if applicable)
• Payment and billing information
• Property portfolio and listing data
• Marketing preferences and content requirements
• Subscription tier and usage data

For Trades, Architects, and Professional Partners:

• Business name and registration details
• Professional qualifications and accreditations
• Service areas and specialisms
• Contact details and availability
• Insurance and certification documents
• Project portfolio and case studies
• Public business information that may be displayed to homeowners/buyers within reports and partner directories

For Developers (Property Development Professionals):

• Business name and company registration details
• Director/owner name and primary contact information
• Business address and operating locations
• Company structure and VAT registration
• Development portfolio and properties per year
• Subscription tier and usage data
• Business goals and intentions with the platform
• Payment and billing information

For Paid Services (£195 Architectural Reports):

• Payment card details (processed securely via Stripe)
• Billing address
• Purchase history and transaction records

Living Vault & Property Wallet Data:

When you use the Living Vault and property wallet features within the homeowner portal, we collect and store:

• Ownership proof documents: Utility bills, council tax bills, mortgage statements or title deeds you upload to verify property ownership. These are stored securely and accessible only to you and our admin review team.
• Property documents: Floor plans, EPC certificates, planning permissions, building control approvals, insurance documents and other property-related files you choose to store in your vault.
• Property photos: Interior and exterior photos you upload for AI analysis, staging reports or architectural insight generation.
• Wallet & credits data: Credit balance, credit purchase history, subscription status, transaction records and refund history. Payment card details are processed by Stripe and are not stored on our servers.
• Report purchase records: Which reports you have purchased (full scorecard, staging report, architectural insight pack, concept sketches, measured survey), purchase dates and download history.
• Lead share consent status: Whether you have opted in to share your contact details with partner professionals, the date consent was given, and which partner types you consented to share with.

3.2 Information We Collect Automatically

When you visit our website or use our services, we automatically collect:

• IP address and device identifiers
• Browser type and version
• Operating system
• Pages visited and time spent on each page
• Referral source (how you found us)
• Search terms used
• Geographic location (country, region, city-level only)
• Usage patterns and interaction with AI-generated reports

3.3 Third-Party Data Sources

To generate accurate property intelligence reports, we collect and process data from:

• HM Land Registry (sold price data, title information)
• Ordnance Survey (mapping and boundary data)
• Local Planning Authorities (Article 4 directions, conservation areas, permitted development rights)
• Energy Performance Certificate Register
• Companies House (for business verification)
• Credit reference agencies (for fraud prevention on paid services only)

4. HOW WE USE YOUR PERSONAL DATA

We process your personal data for the following purposes:

4.1 Service Delivery

• Generate your free Property Intelligence Report
• Produce AI-powered property scorecards and ROI projections
• Provide architectural drawings and PDR (Permitted Development Rights) analysis
• Deliver purchased architectural reports (£195 service)
• Process payments securely through our payment provider
• Provide customer support and respond to enquiries

4.2 Lead Generation and Matching Services

• Connect homeowners with relevant estate agents in their area when they express interest in selling
• Match property owners with verified trades and professionals based on their development needs
• Share anonymised or aggregated property data with business partners to improve market intelligence
• Send introductory communications on behalf of matched partners (with your explicit consent)
• Display professional partners' public business profile information within homeowner/buyer-facing reports

4.3 Estate Agent Services (SaaS Subscription)

• Provide access to the Estate Agent Marketing Suite
• Generate AI-powered listing descriptions and social media content
• Enable direct messaging tools
• Deliver lead alerts when homeowners in their area request services
• Provide analytics and performance dashboards

4.4 Marketing and Communications

• Send service updates and product announcements
• Share educational content about property development
• Conduct customer satisfaction surveys
• Send promotional offers (only with your consent)

4.5 Legal and Operational Requirements

• Comply with legal obligations and regulatory requirements
• Prevent fraud, security threats, and abuse of our services
• Enforce our Terms of Use and resolve disputes
• Maintain business records and accounting obligations
• Improve our AI algorithms and service accuracy

4.6 Artificial Intelligence & Automated Processing (Maggie AI)

We use AI and large language models (collectively, "Maggie AI") to generate scorecards, reports, staging advice, architectural insights, marketing copy, contact summaries, next-best-actions and conversational guidance within the homeowner portal. Maggie AI is powered by third-party LLM providers — Google (Gemini), Anthropic (Claude) and OpenAI. When processing personal data these systems may receive:

• Property address, postcode and property attributes
• Lead-brief answers (timeline, budget, intentions) you provide
• Vault document content (floor plans, EPC data, planning history) when generating reports that reference those documents
• For Business Users: contact names, deal context and notes you have entered, where relevant to generating a summary or action

Data minimisation & provider controls: We configure prompts to minimise the personal data transmitted to LLM providers and instruct these providers not to use your data for model training. Some processing may occur outside the UK under Standard Contractual Clauses or the UK-US / EU-US Data Privacy Framework (see Section 14).

Advisory-only outputs: AI-generated outputs — including scorecards, ROI projections, architectural insights, staging recommendations, Maggie chat guidance and next-best-actions — are informational, decision-support tools. They do not constitute professional architectural, legal, financial or surveying advice, and are not solely automated decisions with legal or significant effects. A human (you, or your team) reviews AI-generated reports and advice before acting on them. You have the right to request human review of any AI-generated output that affects you by contacting privacy@housemadeready.com. We have completed Data Protection Impact Assessments (DPIAs) for our AI processing; copies are available on request.

5. LEGAL BASIS FOR PROCESSING

We process your personal data under the following legal bases:

• Consent: When you explicitly agree to receive marketing communications or to have your details shared with specific partners.
• Contract: To provide the services you've requested (free reports, paid architectural drawings, SaaS subscriptions).
• Legitimate Interests: To improve our services, prevent fraud, and conduct business analytics. We balance our legitimate interests against your rights and freedoms.
• Legal Obligation: To comply with UK law, tax regulations, and regulatory requirements.

7. DATA PROCESSING FOR BUSINESS CUSTOMERS

7.1 Roles: Independent Controllers vs Processor

(A) Connection / Matching Service (Independent Data Controllers)

When we connect homeowners with partners, House Made Ready is an Independent Data Controller for operating the connection service. Each Partner is also an Independent Data Controller for the lead data they receive.

(B) Professional Account Tools (Processor in certain cases)

When partners subscribe to our SaaS tools and upload their own customer data, we act as a Data Processor. The Partner remains the Data Controller.

7.2 CRM & Contact Data (Estate Agents & Developers)

Estate Agents and Developers who subscribe to our CRM and pipeline tools may create and store records about individuals who are not registered users of House Made Ready — for example homeowners, buyers, vendors, solicitors, conveyancers, surveyors, mortgage brokers, tradespeople and other chain parties. This data may include:

• Full name, email address, telephone number and postal/property address
• Company name and role (e.g. solicitor, buyer, seller)
• Deal or pipeline stage, value, notes and key dates
• Chain position, upstream/downstream properties and fall-through risk indicators
• Communication history and status updates
• Maggie AI-generated summaries, next-best-actions and deal-health scores derived from the above

Who is the Data Controller for this data? The Estate Agent or Developer (the Business User) is the Data Controller for any personal data they enter about their own clients and contacts. House Made Ready acts as a Data Processor for that data, storing and processing it solely to provide the CRM functionality the Business User has requested. A Data Processing Agreement (DPA) governs this relationship and is available on request from privacy@housemadeready.com.

Sensitive or special-category data. Our CRM fields are not designed to store special-category data (health, ethnicity, religion, sexual orientation, biometric, etc.). Business Users must not enter such data into the platform. If you believe special-category data has been recorded in error, contact privacy@housemadeready.com so it can be securely removed.

7.3 Chain Repair & Third-Party Contact Data

When an Estate Agent uses the Chain Repair tools, the platform sends invitation emails to external chain parties (solicitors, conveyancers, brokers, buyers, sellers) and may host a public "chain status" page accessed via a unique token. In these cases:

• The Estate Agent is the Data Controller for the contact data they enter and is responsible for having a lawful basis (typically legitimate interests or consent) to invite those parties.
• Invitation emails display the agent's name and agency, not House Made Ready branding, so recipients know who is contacting them.
• Recipients can decline or unsubscribe from further chain communications at any time, and we will action opt-outs promptly.
• Public chain-status pages show anonymised display names (e.g. "Solicitor (Smith & Co)") rather than full personal data wherever possible.

7.4 Team Members & Multi-User Business Access

Business Users may invite team members and colleagues to access their account. The inviting Business User is responsible for:

• Ensuring each invited team member has a legitimate need to access the personal data within the account
• Removing team member access promptly when a person leaves the business or no longer requires access
• Not sharing login credentials; each team member must use their own account
• Ensuring team members are trained on their data-protection responsibilities

House Made Ready processes team member names and email addresses (as the inviting Business User provides them) for the sole purpose of administering access. The inviting Business User is the Controller for team member personal data.

7.5 Business User Obligations

Estate Agents, Developers, Trades and Professionals who enter personal data about third parties into the platform must:

• Obtain any necessary consent or establish a valid lawful basis before uploading a contact's personal data
• Provide those individuals with a privacy notice explaining how their data is used (you may reference this Policy where relevant)
• Respond to data-subject access, rectification and erasure requests from your own contacts within the statutory one-month period
• Keep contact data accurate and up to date, and delete it when it is no longer needed
• Notify us promptly at privacy@housemadeready.com if you receive an erasure or objection request relating to data stored in the platform so we can action it on your behalf
• Not use the platform to store data you have no lawful basis to hold, or to send marketing to individuals who have opted out
• Maintain your own independent GDPR compliance posture and Privacy Policy for your business

8. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to provide and improve our Service. We use:

• Strictly necessary cookies (e.g., session management)
• Analytics cookies (e.g., Google Analytics)
• Third-party service cookies (e.g., Stripe for payment processing)

You can manage cookie preferences through your browser settings or our cookie consent banner. Detailed information is available in our Cookie Policy.

9. DATA SECURITY

We implement industry-standard security measures including:

Technical Measures:

• SSL/TLS encryption for all data transmission
• Encrypted storage of sensitive data
• Regular security audits and penetration testing
• Secure cloud hosting with AWS (UK region)
• Multi-factor authentication for business accounts

Organisational Measures:

• Staff training on data protection
• Access controls limiting who can view personal data
• Confidentiality agreements for all employees
• Incident response procedures for data breaches

We will notify you and the ICO within 72 hours if a data breach occurs that poses a risk to your rights and freedoms.

10. YOUR RIGHTS UNDER UK GDPR

You have the following rights regarding your personal data:

10.8 How to Exercise Your Rights

To exercise any of these rights, contact us at:

We will respond within one month (or two months for complex requests). We may ask for proof of identity to prevent fraud.

11. DATA RETENTION

We retain your personal data only as long as necessary:

11.2 Deletion Procedures

After retention periods expire, we will:

• Securely delete or anonymise personal data
• Remove identifying information from aggregated datasets
• Ensure backups are overwritten according to our schedule

You can request earlier deletion by exercising your Right to Erasure (see Section 10.3).

12. DISPUTES AND COMPLAINTS

12.1 How to Raise a Complaint

If you are dissatisfied with our services or data handling, contact us at complaints@housemadeready.com with:

• Your full name and contact details
• A clear description of the issue
• Relevant dates and reference numbers
• What outcome you are seeking

12.2 Independent Dispute Resolution

For Data Protection Complaints:

13. THIRD-PARTY SERVICES AND LINKS

We share data with:

13.1 Service Providers (Data Processors)

We share personal data with the following sub-processors, all under Data Processing Agreements with appropriate safeguards:

• Cloud hosting: our hosting provider (UK/EU region) for application and database storage
• Stripe – payment processing and subscription billing (stripe.com/gb/privacy)
• AI / Large Language Model providers – Google (Gemini), Anthropic (Claude) and OpenAI, used to generate scorecards, reports, Maggie AI conversations and summaries. Personal data you submit (such as property address and contact details) may be sent to these providers for processing. We configure prompts to minimise the personal data transmitted and instruct these providers not to use the data for their own training. Some processing may occur outside the UK under Standard Contractual Clauses or the UK-US / EU-US Data Privacy Framework.
• Email delivery – transactional and marketing email (e.g. our email service provider)
• Mapping & location data: OpenStreetMap, Ordnance Survey and Mapillary for property mapping and street imagery
• Property & market data: HM Land Registry, ONS demographics, EPC register, local-authority planning data
• Social distribution (Business Users only): LinkedIn, Instagram and Google, used to publish AI-generated marketing posts on behalf of agents who have connected those accounts
• Website analytics – analytics and search-console providers
• Credit reference / fraud-check providers – for business verification and fraud prevention only

A current list of sub-processors with their locations is available on request from privacy@housemadeready.com.

13.2 Business Partners (Data Controllers)

Once we share your data with a business partner (with your consent), they become an independent Data Controller responsible for their own privacy practices.

14. INTERNATIONAL DATA TRANSFERS

We primarily store and process data within the United Kingdom. Some third-party providers may transfer data outside the UK:

• AWS servers (UK region, but backup in EU region)
• Stripe payment processing (may involve US servers)
• Google Analytics (US-based with EU-US Data Privacy Framework compliance)

When data is transferred outside the UK, we ensure adequate safeguards through Standard Contractual Clauses or approved certification schemes.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect:

• Changes in our services or business model
• New legal or regulatory requirements
• Improvements to data protection practices

When we make material changes, we will update the "Last Updated" date and notify active users by email. Continued use constitutes acceptance of the updated policy.

16. CONTACT US

For any questions about this Privacy Policy, data protection, or how we handle your personal information: