Privacy Policy

1. Who we are

LetSense ("we", "us", "our") is a UK-based property management platform operated by LetSense Ltd (company no. 17217228, registered in England & Wales). Our contact address is hello@letsense.co.uk.

We are registered as a data controller with the Information Commissioner's Office (ICO) under the UK GDPR and Data Protection Act 2018. Our ICO registration number is C1932184.

2. What personal data we collect

We collect data you provide directly and data generated by your use of the service:

• Account data: name, email address, password (hashed), organisation name.
• Property data: addresses, certificate dates, tenancy details you enter.
• Tenant data: names, email addresses, phone numbers, portal access tokens.
• Financial data: rent amounts, payment records, arrears notes — as entered by you. We do not store bank account or card numbers.
• HMRC data (only if you connect to HMRC): your National Insurance number and the access tokens HMRC gives us. Both are encrypted. See section 5.
• Usage data: pages visited, actions taken, browser type, IP address, timestamps.
• Communications: emails you send us, support messages.

3. How we use your data

• To provide and maintain the LetSense service.
• To send compliance reminders and account notifications.
• To process payments via Stripe (we do not store card data).
• To improve the platform using aggregated, anonymised usage analytics.
• To comply with legal obligations.

Our lawful basis for processing is contract performance (providing the service you signed up for) and legitimate interests (security, fraud prevention, service improvement).

4. Who we share your data with

We share data only with sub-processors necessary to deliver the service:

• Vercel — hosting and serverless compute.
• Neon — database hosting.
• Cloudflare — document and file storage (R2), and bot checks on forms (Turnstile).
• Resend / Nodemailer — transactional email delivery.
• Twilio — text messages to tenants who have agreed to receive them.
• Stripe — payment processing.
• Google — sign-in with Google (if you use it); Gemini AI for receipt and document scanning, maintenance triage and the compliance assistant; Street View images of your properties; Google Analytics and Google Ads (only if you accept cookies on our website).
• Better Stack — error monitoring. Stored in the EU.
• Xero — only if you connect it: rent, expense and contact records.
• Firma.dev — electronic signatures: signer names and email addresses.
• LetsSafe — tenant referencing, if you use it: applicant name, email and phone.
• Ordnance Survey, the EPC register and Companies House — address, energy certificate and company look-ups.
• HMRC — only if you connect to HMRC. See section 5.

Some of these companies store or process data in the United States.

We do not sell your data. We do not share your account data (your properties, tenants, documents or money records) with advertisers or marketers. If you accept cookies on our website, Google Ads learns that your browser visited our site and whether you signed up. See our cookie policy.

5. Making Tax Digital (HMRC)

This section applies only if you connect LetSense to HMRC to send Making Tax Digital updates for Income Tax.

• What we hold. Your National Insurance number and the access tokens HMRC gives us when you sign in to HMRC. Both are encrypted. We never see or store your HMRC sign-in details.
• What we send to HMRC. The income and expenses of your property business, for each period you choose to send. We keep a copy of what we sent and HMRC's reply in your account, so you can see what was submitted.
• Fraud prevention data. HMRC requires software to send fraud prevention data with every call. This includes your IP address, a device ID, your browser, screen and window size, time zone, and your LetSense user ID.
• Tax estimates. When you ask for an estimate, we show HMRC's figures. We do not store them.
• Lawful basis. Contract performance (you ask us to send your updates) and legal obligation (HMRC's fraud prevention rules).
• Disconnecting. When you disconnect, we delete your HMRC tokens and National Insurance number at once. You can also remove LetSense's access in your HMRC online account.

HMRC handles the data it receives under its own privacy notice.

6. Data retention

Active accounts. We retain your data for as long as your account is active. An account is active if you have confirmed your email address and have signed in within the last 12 months.

Unconfirmed email addresses. When you register we email you a link to confirm your address. You cannot sign in until you confirm it. The link is valid for 7 days and a new one can be sent from the sign-in page. If the email does not arrive, check your junk or spam folder. If your address is still not confirmed 30 days after registering, we may delete the account and its data. We email you a warning before this happens.

Why we do this. An unconfirmed address means we cannot reach you. Password resets, compliance reminders and legal notices all fail silently. It also means we may be holding your tenants’ personal data on behalf of someone we cannot contact.

Dormant accounts. If you have confirmed your email address but do not sign in for 12 months, we may delete your account and its data. We will email you a warning first. We will not delete an account on these grounds while it has a paid subscription or an active tenancy.

Deleting your account. If you delete your account, we remove personally identifiable data within 30 days.

Records we must keep. In all cases we retain records we are legally required to keep — for example records of payments you make to us, for 6 years under UK law.

7. Your rights under UK GDPR

You have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your data ("right to be forgotten").
• Restriction — limit how we process your data.
• Portability — receive your data in a machine-readable format.
• Object — object to processing based on legitimate interests.

To exercise any right, email hello@letsense.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the ICO.

8. Cookies

We use essential cookies for authentication and session management. See our Cookie Policy for details.

9. Security

We use HTTPS throughout, bcrypt password hashing, and role-based access controls. Documents are stored in Cloudflare R2 with presigned URLs that expire after 1 hour.

To report a security problem, see Report a security issue.

10. Changes to this policy

We will notify active users by email if we make material changes. The effective date at the top of this page always reflects the latest version.

11. Contact

For any privacy questions, email hello@letsense.co.uk.