Privacy Policy

Propertira is a rental-property profit dashboard for small landlords. It is operated by Origin Collective Limited, a company registered in England and Wales, which is the data controller for the personal data described here.

For any privacy question or request, please use our contact page. We reply by email.

This policy applies to information we process when you:

• visit or use the Propertira website and app;
• create an account and sign in;
• add or manage properties and enter income, expense and mortgage figures;
• use calculators, dashboards, reports and other product features;
• buy or manage a paid subscription;
• contact us through the contact form;
• interact with cookies, browser storage and similar technologies we use.

We collect most information directly from you — when you create an account, add properties, enter figures, use the product, subscribe or contact us. We receive billing and subscription information from Stripe, and certain technical and security information is generated automatically by your device and by our hosting and database providers when you use the service.

• creating, maintaining and securing your account, and signing you in;
• storing your properties, expenses and monthly history;
• running calculations and producing your dashboard, insights, comparisons, reports and the optional monthly summary email;
• selling, renewing, changing and cancelling paid subscriptions, and applying plan limits;
• replying to your messages and providing support;
• detecting and preventing fraud, abuse and security incidents;
• diagnosing errors and improving reliability;
• optional usage analytics, if you have enabled it;
• keeping tax, accounting and other business records required by law.

We do not sell your personal information, and we do not use your property figures for advertising.

Under UK GDPR and EU GDPR we must have a lawful basis for each purpose. In short:

Where we rely on consent, you can withdraw it at any time — through Cookie settings for analytics, or in Settings for the monthly summary email. Withdrawing consent does not affect processing that already took place.

Paid plans are live. Payment processing and subscription management are provided by Stripe. You enter your card details directly into Stripe's checkout, and Stripe collects a billing address there. Propertira does not receive or store complete card details.

Stripe tells us what we need in order to run your subscription: the customer and subscription identifiers, the plan and price, the status, the billing period, and whether the subscription is set to cancel. Stripe processes payment data both on our behalf and for its own purposes as a regulated payment provider, under its own privacy notice and terms.

We use a small number of providers to run Propertira:

• Supabase — database, storage of your account and property data, and authentication (sign-in, sessions, password resets).
• Lovable — the application platform and hosting infrastructure the website and app run on, including application-level error reporting.
• Stripe — payments and subscriptions.
• Resend — delivery of transactional email such as contact-form forwarding and the optional monthly summary.

We may also disclose information where we are legally required to, to respond to lawful requests from authorities, to establish or defend legal claims, to protect the rights, safety or security of Propertira and its users, or to a buyer or successor in connection with a business reorganisation or acquisition. In practice this is rare.

Other Propertira users cannot access your properties, expenses, monthly history, profile or settings. Access is scoped per account and enforced at the database level with row-level security policies, so a signed-in session can only read and write rows belonging to that account.

Authorised personnel and our service providers may process your information where reasonably necessary to operate, secure and support Propertira — for example to investigate a fault or suspected misuse, to maintain the database and its backups, or to comply with a legal obligation.

Origin Collective Limited is based in the United Kingdom, and the providers listed above operate internationally. Depending on the provider and its infrastructure, your personal information may be processed outside the UK or outside the country you live in, including in countries whose data-protection laws differ from your own.

Where personal data is transferred out of the UK or the EEA, we rely on the transfer mechanisms made available by the relevant provider — such as an adequacy decision where one applies, or the provider's standard contractual clauses and UK international data transfer addendum. We are keeping our documentation of these arrangements under review as the product grows, and we will describe them more specifically here as that work completes. If you would like to know how a specific provider handles transfers, please ask us through the contact page.

Propertira uses very little browser storage, and most of it is not a traditional cookie but your browser's localStorage or sessionStorage. The same rules apply to those technologies as to cookies.

We send service emails you cannot opt out of while you hold an account — for example password resets, and messages about your subscription or important changes to the service.

The monthly Property Pulse summary is optional: it is off until you enable it in Settings and can be switched off there at any time. Propertira does not currently run a promotional marketing email programme. If we start one, we will ask for consent where required and every marketing email will include an unsubscribe link. Unsubscribing from marketing would not stop essential account and service emails.

• Account, property, expense and monthly history data — kept while your account exists. You can delete individual properties and expenses at any time, and deleting your account removes this data from the live application.
• Subscription, payment and business records — transaction, invoice and accounting information may be kept after account deletion for as long as UK tax and accounting law requires, and while it may be needed for disputes or chargebacks. Stripe applies its own retention to the records it holds.
• Security and error logs — kept for a limited period, determined by our hosting and database providers' logging settings, and longer only where needed to investigate a specific security or abuse incident.
• Contact and feedback messages — kept for as long as reasonably needed to resolve the issue and to keep a record of what was asked and answered.
• Backups — our database provider takes routine backups, so deleted data can persist in backup copies until those copies are cycled out in the normal course of the provider's backup rotation. We do not state a fixed number of days here because that period is set by the provider's backup configuration rather than by us.

You can delete your account yourself from Settings. Doing so deletes, from the live application, your properties, expenses, monthly history, profile and settings, your subscription record, your monthly-email log and any in-app feedback tied to your account, and then deletes your sign-in credentials with our authentication provider.

Deleting your account removes or anonymises application data according to the retention practices above, except information we must or may lawfully retain — for example for accounting and tax, fraud prevention, security, dispute resolution or other legal obligations. Copies may also remain in routine backups until those are cycled out, and payment records held by Stripe are subject to Stripe's own retention.

If you would prefer us to handle the deletion, or you can no longer sign in, contact us through the contact page.

Depending on where you live and the circumstances, you may have the right to ask us to:

• give you access to the personal information we hold about you;
• correct information that is inaccurate or incomplete;
• delete your personal information;
• restrict how we process it;
• object to certain processing (see the next section);
• provide certain information in a portable, machine-readable format;
• withdraw consent where our processing relies on consent;
• complain to a data-protection authority.

These rights have legal conditions and exceptions, so we may not be able to grant every request in full — if that happens we will explain why. Where we cannot reasonably be sure who is making a request, we may ask you to confirm your identity, for example by writing from the email address on the account, before we act on it.

To exercise any of these rights, use our contact page.

Please come to us first — we would like the chance to put things right. You also have the right to complain to a data-protection authority.

In the UK, that is the Information Commissioner's Office (ICO), ico.org.uk. If you are in the EU or EEA, you may instead be able to complain to the supervisory authority in the country where you live or work, or where you think the issue arose.

Propertira uses automated calculations and rule-based labels — such as “Strong cash flow”, “Thin margin” or “Negative cash flow” — to present information about your properties. These features organise and explain the figures you entered. They do not make legal or similarly significant decisions about you: Propertira does not carry out credit scoring, lending decisions, tenant screening or profiling of that kind.

Results are estimates based on your inputs and are not financial, tax, legal or investment advice.

• An email address and a password (or a supported sign-in method) are required to create an account — without them we cannot give you one.
• A display name is optional. Property city, country and expense notes are optional too.
• Property and financial figures are yours to choose, but Propertira cannot produce meaningful profit, cash-flow or comparison results without the relevant inputs.
• Payment and billing details are needed only if you buy a paid plan; without them you can continue on the Free plan.
• Analytics and the monthly summary email are optional and off unless you turn them on.

Propertira is intended for adults managing their own rental properties. Our Terms of Service require you to be at least 18 years old, and the service is not directed at children. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will remove it.

We use technical and organisational measures appropriate to a service of this kind. Traffic to Propertira is encrypted in transit over HTTPS. Authentication is handled by our authentication provider and passwords are stored only in hashed form. Access to your rows in the database is enforced per account by row-level security policies, and administrative database access is restricted to server-side code. Sensitive credentials are held as server-side secrets and are never sent to your browser.

No internet service can promise absolute security. We make no claim to any certification or audit that has not actually been carried out.

We may update this policy when Propertira's features change, when we change providers, when our privacy practices change, or when the law requires it. The “Last updated” date at the top will change when we do. If a change is material, we will give additional notice where appropriate — for example in the app.

For privacy questions, data requests or anything else in this policy, use our contact page and we will reply by email. You can also review our Terms of Service.