Privacy
Effective
What this covers
Property Potential turns a property listing into an analysis pack. This page says what data that involves, where it goes, and how to remove it.
What we store
Your email address. It is the whole account — there is no password.
Packs you create: the listing facts you paste or type (asking price, postcode, address hint, beds, property type), the photos and floorplan you upload — or copies fetched from a listing link you pasted — the room-by-room analysis, the works schedule including your edits, the comparable sold prices frozen at analysis time, and the deal inputs you enter, such as offer price and expected rent.
A credit ledger: every grant and every spend, so your balance is a sum of records rather than a number we assert.
Sign-in links and sessions, stored only as one-way hashes — reading the database cannot yield a working link or session.
Where it runs
Vercel hosts the application. Neon holds the database, in AWS eu-west-2 (London). Cloudflare R2 stores the images.
Anthropic receives a pack's photos, its floorplan and the listing's description text when the analysis runs. Its output describes rooms and works; the figures come from our own published cost config and sold-price data, not from it.
Replicate receives one room photo per requested after-works visual.
Resend sends the sign-in emails.
Lemon Squeezy is the merchant of record for credit purchases: checkout, card handling and VAT happen with them, and a card number never touches our servers.
Sentry receives error reports and PostHog receives product-usage events, when we have them switched on.
What we do not do
No selling or renting of your data. No advertising networks. No tracking cookies — one cookie keeps you signed in, and that is all of them.
Addresses derived from Energy Performance Certificate data are never used for marketing.
Photographs taken from a property portal stay out of public share views and PDFs — they are shown only to you, inside your account.
Open data in packs
Packs include HM Land Registry sold prices and EPC floor areas under their open licences, with attribution. A comparable's street and sold price is public record about a property, not information about you.
Share links
A pack is private to your account until you create a share link. Anyone holding the link can read that pack — read-only, without portal media. Revoking the link kills it immediately. A PDF you download is a copy outside our reach.
How long things live
Sign-in links die after one use or 15 minutes, whichever comes first. Sessions last 30 days, or until you sign out — signing out deletes the session server-side, so it ends everywhere at once. Everything else stays while your account exists.
Deleting your account
The account page has a delete control. It removes the account, sessions, packs, photos, visuals, analysis output and the credit ledger — images go from storage, not just from the database. Deletion is immediate and cannot be undone.
Two things survive. Anonymous calibration figures — a work category, a postcode area such as BH, and what the work cost — are kept with nothing linking them to you or to a property. And the merchant of record keeps its own purchase records, which are theirs and required of sellers.
Contact and changes
Questions, or a data request the account page cannot satisfy: [PHASE 8: set a contact address before beta]. When this page changes, the date at the top changes with it.