Privacy in the Keymews app.

1. Who we are

Keymews is provided by Keymews Ltd, a company registered in England and Wales (company number 17569958), whose registered office is at 13 Pontypool Walk, Romford, England, RM3 8YD. Our registration with the Information Commissioner’s Office (ICO) is pending; we’ll add the registration number here once it’s issued. Contact us about privacy through the contact form or at keymews@gmail.com.

2. Two roles: ours and your landlord’s

Landlords use Keymews to keep records about their tenants, contractors and properties. For that information, the landlord is the controller: they decide what to record and why, and they are responsible for telling you about it. We process it on their behalf under our data processing agreement.

This notice covers the information we are responsible for as controller: your account and sign-in, plan billing, security, service emails, Keymews AI and your contact with us.

The same applies to people who use a landlord’s public forms without an account: someone who asks about a listing, books a viewing or applies (on a landlord’s listing page), and referees who fill in a reference form. The landlord is the controller of what they send, and we process it for the landlord.

Property search, at lettings.keymews.co.uk, is open to anyone without an account; an account is only needed to save homes. For searches and those accounts, we are the controller. Once you contact a landlord about a home, through its listing page, the landlord is the controller of what you send, as above.

If you’re a tenant or contractor and want to see, correct or delete what a landlord has recorded about you, ask the landlord. If you contact us instead, we’ll pass your request on to them.

3. What we collect

• Account details: your name, email address and role, and the organisation you belong to. Passwords are stored only in a scrambled (hashed) form. If you turn on two-step sign-in, we store what’s needed to check your codes.
• Plan billing (landlords): your plan, billing period and the Stripe references for your subscription. Stripe handles card details; we never see or store them.
• Online payments: for landlords who collect rent online, the Stripe account reference and its status; for payments, the amount, date, status, what it was for and the last 4 digits of a Direct Debit account. Card and bank details stay with Stripe.
• Keymews AI: the questions you ask, the answers, and, if you allow it in Settings → AI, details of the page you have open and a summary of your portfolio’s records (addresses, rents and arrears, compliance dates, repairs, spending totals and lettings counts; no tenant names or contact details). If you ask it to improve a listing description, the listing’s facts (not its full address). If you scan a receipt or a gas safety certificate, the photo, used only to read the details. A receipt photo isn’t stored by us or the AI provider; a certificate photo is stored as evidence on the compliance item only when you save it. If you ask it to suggest a repair’s priority, the repair’s title, description and category. If you ask it to explain a report, that report’s figures: tax-year totals by heading and by property, or the 12-month forecast’s monthly figures and assumptions, with rent reviews, tenancies ending, arrears and empty units by property and unit name (no tenant names). If you rate an answer with a thumbs up or down, the rating and the reason you choose, to improve Keymews AI. We also count messages to apply allowances.
• E-signatures: when you sign or decline a document, the name you type, the time, your IP address and browser, and a fingerprint (SHA-256) of the document. These are added to the signing certificate on the signed copy, for the landlord who sent it.
• Property search: what you type in the search box is sent to our AI provider to turn it into a search (area, budget, bedrooms and so on); it isn’t stored. If you choose “Use my location”, your browser asks your permission, and the app rounds your position to about 100 metres before sending it to us. We send that rounded position to postcodes.io to find the nearest postcode, and don’t store it. When you search an area, we also send its position to postcodes.io to find its council area, so we can show that area’s average rents and prices from official statistics (ONS and HM Land Registry); nothing that identifies you is sent. If you ask for a home alert, we keep your email address and the search (the place and your filters) so we can email you when matching homes are listed. We email you a link first and send nothing else until you open it. To limit how many searches and alerts come from one place, we keep a scrambled (salted and hashed) version of your IP address, whether the search used AI, and the time. The address itself isn’t stored.
• Lettings accounts: if you create an account on the lettings site to save homes, your name, email address and, if you add it, your phone number. The homes you save are kept on your device, linked to your account; to show whether they’re still advertised, the app sends us which Keymews listings they are.
• Notifications on your devices: if you turn them on, the address your browser gives us for sending notifications to that device, its encryption keys, and the browser type, so you can see your devices in Settings → Notifications. Notifications are sent through your browser maker’s push service (such as Apple, Google, Mozilla or Microsoft), encrypted so that the service can’t read them.
• Security and activity: sign-in events, an audit log of changes in your organisation, and technical details such as browser type and IP address, used to keep accounts secure.
• Your contact with us: messages you send us and our replies.

The app keeps your sign-in session in your browser’s storage so you stay signed in, and remembers your light or dark choice. So that it opens and inspections keep working without a connection, it also keeps on your device a copy of the app’s files, your last sign-in access (your organisations and roles), copies of inspections you’ve opened, and changes and photos made offline until they’re uploaded. Homes you save in property search are kept on your device. Signing out doesn’t remove these copies; clearing the app’s data (on the web, your browser’s data for the app) does. It uses no advertising or analytics cookies.

4. Why we use it, and our lawful basis

• To provide Keymews under our contract with you: your account, the features of your plan, billing, and service emails such as invitations, reminders and notifications you choose in Settings → Notifications.
• Our legitimate interests: keeping the service secure, preventing misuse and fraud, fixing problems, and improving Keymews. We don’t use your information for advertising and we don’t sell it.
• Legal obligations: keeping financial records for tax and responding to lawful requests.
• Your consent: home alert emails from property search. You can withdraw it at any time with the stop link in any alert email.

5. Who helps us run the service

We use these providers (sub-processors). Each may only use the information to provide its service to us.

• Supabase: database, sign-in and file storage, hosted in London (UK).
• Cloudflare: hosting the app and protecting it from attacks.
• Stripe: plan payments, and online rent payments for landlords who connect a Stripe account. For a landlord’s own Stripe account and the payments into it, Stripe is also a controller under its own privacy policy.
• Resend: sending emails, from the European Union (Ireland).
• Cloudflare (Workers AI): generating Keymews AI answers, listing descriptions and repair suggestions, and reading property searches, using an open-weight model run by Cloudflare. Cloudflare keeps what’s sent only as long as it needs to answer, and doesn’t use it to train AI models (Cloudflare’s data usage terms).
• Groq: reading receipt and gas safety certificate photos, with an open-weight vision model run by Groq, and the same Keymews AI tasks as Cloudflare when Cloudflare can’t answer, for example when it’s busy. Groq doesn’t keep what’s sent once it has answered, and doesn’t use it to train AI models (Groq’s data terms).
• Sentry: error reports, so we can find and fix faults. When something goes wrong in the app or on our servers, a report is sent with what failed and where in our code, the page or screen, and your device, browser and operating system. Reports don’t include your name, email address or IP address, or what you’d typed. Stored in the European Union (Germany) and deleted after at most 90 days.
• MapTiler: the map in property search. When you open the map, your browser loads the map images from MapTiler, which receives your IP address and the area shown, as any website you visit does. Homes are placed only roughly (to about 100 metres), never at their exact address.
• Ideal Postcodes: looking up addresses. What you type in an address search (a postcode or the start of an address) is sent.
• The Energy Performance of Buildings Register (Ministry of Housing, Communities and Local Government): when a landlord or agent looks up a property’s energy certificate, we send the property’s postcode to find the certificates registered there. Nothing about the person looking it up is sent. Flood risk comes from the Environment Agency’s published data, which we keep ourselves, so nothing is sent for it.
• postcodes.io: in property search, finding the nearest postcode to a searched place or a rounded location, and the position of listed homes from their postcodes. Only places, postcodes and rounded positions are sent.
• Browser push services (Apple, Google, Mozilla, Microsoft and others, depending on your browser): delivering notifications to devices where you’ve turned them on. Each notification is encrypted, so the service can’t read it.

Some of these providers may process information outside the UK, for example in the United States. Where they do, the transfer is protected by UK adequacy regulations (including the UK–US data bridge for providers certified under it) or by the UK International Data Transfer Agreement or Addendum. Supabase stores the database and files in London; Resend sends email from Ireland; Sentry stores error reports in Germany; MapTiler is based in Switzerland, which UK law recognises as protecting personal data, and serves maps through a worldwide network; Cloudflare, Groq and Stripe may process information in the United States, and Groq also in other countries where it has data centres.

6. How long we keep it

• Account and organisation information: while the account is open, then deleted within 90 days of the account closing, unless we need to keep it to meet a legal obligation.
• Keymews AI conversations, with any ratings you gave their answers: deleted automatically after 90 days without use, or straight away if you delete them in Settings → AI. Message counts: 13 months.
• Billing and payment records: 6 years, for tax.
• Copies of Right to Rent documents that a landlord uploads: deleted automatically one year after the tenancy ends, or six months after the check if no tenancy followed. The landlord decides how long to keep their other records.
• Property search limits (the scrambled IP address, whether AI was used, and the time): 7 days.
• Home alerts: until you stop the alert, or six months after you start it. Alerts that aren’t confirmed from the email are deleted after 7 days.
• Notification devices: until you turn notifications off on that device, or the push service tells us the device is no longer there.
• Backups: 30 days.

7. Your rights

You can ask to see the information we hold about you, have it corrected or deleted, restrict or object to how we use it, or receive it in a portable form. Landlords can download all of their organisation’s information at any time in Settings → Data. To use your rights, contact us. We’ll reply within one month.

If you’re unhappy with how we’ve handled your information, please tell us. You can also complain to the Information Commissioner’s Office at ico.org.uk.

8. Keeping it secure

Information is encrypted in transit. Access in the app is limited by role: tenants see only their own tenancy, contractors only the jobs given to them, and accountants only what the landlord shares. A landlord can also limit an admin or accountant to selected properties. Two-step sign-in is available on every plan. Encrypted backups are normally taken daily and kept for 30 days.

9. Changes

If we change this notice, we’ll publish the new version here and tell account holders about important changes.