What we hold, and why.

Last updated 6 October 2026

Who we are

Latchkey is provided by Bright Web Limited. For anything about your data, email hello@latchkey.co.uk.

Whose data it is

Your account. For your own details and your team’s, and for how you pay us, we are the controller: we decide why and how they are used, and this notice tells you how.

What you put in about other people. For tenants, applicants, guarantors, owners and contractors, you are the controller and we are your processor. We use that data only to run Latchkey for you, on the terms in our data processing terms, which form part of the agreement you accept when you sign up.

What we collect

• Your account: your name, email address, the business you set up and your team’s names and email addresses.
• Your plan and billing history. Card details are held by Stripe, not by us.
• What you put in: properties, tenancies, tenants, applicants, owners, payments, documents, messages and photos.
• A record of changes that move money or alter a tenancy, with who made them and when.
• Short server logs: the address your browser connects from, the time and what it asked for.
• What you write to us when you email.

We don’t sell anybody’s data, we don’t run advertising or analytics trackers on this website or the apps, and we don’t read your messages with tenants unless you ask us to look into a fault.

Why, and on what legal basis

UK data protection law asks us to say which legal basis we rely on for each use.

Creating your account and signing you in

We need your name and email address to give you the service you signed up for.Contract

Holding and working on what you put into Latchkey

For your own details. For tenants’, owners’ and applicants’ details, we act on your instructions as your processor.Contract

Taking payment for your plan and sending invoices

Stripe takes the payment. We keep the invoice record because tax law requires it.Contract

Keeping billing and tax records

Invoices and payments are kept for six years.Legal obligation

Emails about your account

Sign-in links, invitations, notices about rent and repairs, and your trial ending. These are part of the service, not marketing.Contract

Keeping Latchkey secure

A record of changes that move money or alter a tenancy, limits on repeated attempts, short server logs, and a check that listing enquiries come from a person. Our interest is keeping your data and everyone else’s safe.Legitimate interests

Answering your questions

When you email us, we use what you send to reply.Legitimate interests

Answering lawful requests

If a court, the police or a regulator lawfully requires information, we give only what is required.Legal obligation

If you are a tenant

Your landlord or letting agent uses Latchkey to manage your tenancy, so they are the controller of your data and decide what is kept. Latchkey holds it for them.

In the tenant app you see only your own tenancy, and you can change your contact details yourself. After a tenancy ends the record stays open to you, because a deposit settlement and a rent record both outlast the tenancy.

To see, correct or delete your data, ask your landlord: they can download a copy for you or erase your details from your record in Latchkey. If you write to us instead, we will pass your request to them and help them answer it.

Right to Rent and references

A landlord in England has a legal duty to check that every adult who will live in a home has the right to rent, and to keep a copy for the tenancy and a year after. Latchkey holds those checks for your landlord: the route used, the result and copies of the documents or the gov.uk result. Only their team can see them. A share code is kept only until it has been looked up, then just its last three characters. When a tenancy has been over for a year the evidence is deleted. Checks and reference reports for somebody who did not become a tenant are deleted six months after the application closed.

Who we share it with

These companies process personal data for Latchkey today:

Supabase

Hosts the database, file storage and sign-in, in London. Everything you and your tenants put into Latchkey is held here.

Cloudflare

Serves this website and both apps, so it sees the address your browser connects from and which pages it asks for.

Resend

Sends our email: sign-in links, invitations and notices to tenants. It handles the recipient’s name, email address and what the email says.

Stripe

Takes payment for your Latchkey plan. It holds your billing name, email, address and card details; we never see the full card number.

Google Fonts

Supplies the typeface the website and apps use. Your browser fetches it from Google, which sees your browser’s address.

These are used only when you switch them on, and only for the job described:

Stripe, for rent

When you connect your own Stripe account to collect rent, tenants pay into that account under your agreement with Stripe. We pass Stripe the tenant’s name, email and the amount due.

TrueLayer

When you connect a bank account, TrueLayer reads its transactions and passes them to us so we can match rent.

Goodlord and Yoti

When you order a reference or a digital Right to Rent check, the applicant’s details go to Goodlord or Yoti.

Cloudflare Turnstile

Checks that the enquiry form on a public listing page was sent by a person.

The government EPC register

When you look up a building’s EPC, we send its postcode or property reference to the register and keep only the energy band and expiry date it sends back.

If you connect Xero or QuickBooks, your book entries go to your organisation there: amounts, dates, account codes, property names and what each entry is for. Tenants’ names are not sent; entries name the tenancy by its reference. Once there, the copy is held under your accounting package’s terms, and the same goes for anything you send to HMRC.

Data sent outside the UK

Your database, files and sign-in are held in London. Cloudflare, Resend, Stripe and Google can handle some data in the United States or elsewhere. Where they do, it is protected by the UK’s data bridge with the United States or by the International Data Transfer Agreement approved by the Information Commissioner. Ask us for a copy of the safeguards that apply.

How long we keep it

Your account and everything in it

Until you close the account. Closing it deletes everything at once; copies in our backups are overwritten within 30 days.

Invoices and payments for your plan

Six years, because tax law requires it. This is kept even after you close the account.

Right to Rent evidence

For the tenancy and one year after it ends, then deleted. For someone who did not become a tenant, six months after the application closed.

Server logs

No more than 30 days.

Emails you send us

Two years after the conversation ends, unless the account is still open and the email is about it.

Your rights

You have these rights over your personal data:

To see it

Ask for a copy of the personal data we hold about you.

To correct it

Most of your details you can change in the app yourself. Anything else, ask and we will fix it.

To have it deleted

Close your account from Settings and everything is deleted. We keep only what the law makes us keep, listed above.

To take it with you

Download everything as one file from Settings, under Close your account (you don’t have to close it to download), or ask us for it in a common format.

To limit what we do with it

Ask us to pause using it while a complaint or a correction is looked at.

To object

Where we rely on legitimate interests, you can object and we will stop unless we have a strong reason that overrides yours.

Not to be judged by a machine

Latchkey makes no decisions about you by automated means that have legal or similarly significant effects.

To use any of them, email hello@latchkey.co.uk. We answer within one month, and it is free. We may ask you to prove who you are first.

Your browser

The apps keep you signed in by storing your session in your browser. That is needed for the apps to work, so it needs no consent. We don’t set advertising or analytics cookies, and this website stores nothing about you.

Changes to this notice

When this notice changes, the date at the top changes too. If a change affects how we use your data, we will email account owners before it takes effect.

Complaints

Tell us first, because we would rather fix it. If that doesn’t settle it, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.