Privacy Policy

1. Who We Are

PropDemand is a property intelligence platform for serviced accommodation operators, operated by [YOUR COMPANY NAME], a company registered in England and Wales.

As data controller, we determine the purposes and means of processing your personal data. If you have any questions about this policy or how your data is used, please contact us at privacy@sademand.co.uk.

2. What Data We Collect

We collect only the minimum data necessary to operate the service. This includes:

• Email address — used to identify your account and send service communications.
• Hashed password — your password is stored as a one-way cryptographic hash; it is never readable by us or anyone else.
• Account status and trial dates — whether your account is in trial, active, or cancelled, and the relevant dates.
• Stripe customer ID — a reference token that links your account to your Stripe billing record. Payment processing is handled entirely by Stripe; we never see or store your card details.
• Usage logs — we may log location searches and page views for security monitoring and service improvement. These logs do not contain personal identifiers and are not used for profiling or advertising.

We do not collect your name, address, phone number, or any sensitive personal data as defined under UK GDPR.

3. Why We Collect It & Legal Basis

We process your personal data on the following legal bases under UK GDPR:

• Contract performance (Article 6(1)(b)): We need your email address and account information to create and maintain your account, provide access to the platform, and process your subscription. Without this data we cannot provide the service you signed up for.
• Legitimate interests (Article 6(1)(f)): We process limited usage data to maintain the security of the platform, prevent fraud and abuse, diagnose technical issues, and improve the service. We have balanced these interests against your privacy rights and concluded they do not override your fundamental rights and freedoms.

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4. How Long We Keep It

• Account data is kept for as long as your account is active.
• If you request deletion of your account, your personal data will be deleted or anonymised within 30 days of that request.
• Stripe retains billing records (including your Stripe customer ID and transaction history) in accordance with their own data retention policy, which may be required by financial regulations. Please refer to Stripe's Privacy Policy for details.
• Anonymised or aggregated usage statistics may be retained indefinitely as they cannot be linked back to any individual.

5. Who We Share It With

We share your data only with the following third-party processors, and only to the extent necessary to operate the service:

• Stripe — payment processing. Stripe acts as a data processor on our behalf and is bound by a Data Processing Agreement. Stripe is certified under industry security standards. See stripe.com/privacy.
• Railway — cloud hosting. Our application and database are hosted on Railway's infrastructure. Railway's servers are located in the EU/EEA, ensuring your data remains within an adequate jurisdiction under UK GDPR. See Railway's Privacy Policy.

We do not sell your personal data. We do not share your data with any third parties for marketing, advertising, or analytics purposes. We will only disclose your data to law enforcement or regulatory authorities if required to do so by law.

6. Cookies

We use only essential session cookies to keep you logged in while you use PropDemand. These cookies are strictly necessary for the platform to function and do not require your consent under UK GDPR.

• Session cookie — set when you log in; expires when your session ends or you log out.

We do not use:

• Third-party tracking cookies
• Advertising or retargeting cookies
• Analytics cookies (e.g. Google Analytics)

If we add any non-essential cookies in the future, this policy will be updated and we will obtain your consent before setting them.

7. Your Rights Under UK GDPR

Under UK GDPR you have the following rights regarding your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — you can ask us to delete your personal data. We will do so within 30 days except where we are required to retain data by law.
• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
• Right to data portability — you can request your personal data in a structured, commonly used, machine-readable format.
• Right to object — you can object to processing based on legitimate interests.

To exercise any of these rights, please email us at privacy@sademand.co.uk. We will respond within one calendar month of receiving your request. We may need to verify your identity before processing your request.

8. How to Complain

If you are unhappy with how we have handled your personal data, please contact us first at privacy@sademand.co.uk and we will do our best to resolve the issue.

You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO):

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The "Last updated" date at the top of this page will always show when the policy was last revised.

Continued use of PropDemand after any changes to this policy constitutes your acceptance of the updated terms. If we make material changes that significantly affect how we process your data, we will notify you by email where reasonably practicable.

10. Contact

For any privacy-related queries, data subject requests, or concerns about this policy, please contact us: