Privacy policy

For data about our customers (landlords, their team members and visitors to this website), Zolvra Solutions Ltd is the data controller. Company number 17321321, registered office The Junction Office 43, Charles Street, Horbury, West Yorkshire, WF4 5FH.

For data about tenants, guarantors, referees and contractors that a landlord enters or invites into Letfolio, the landlord is the data controller and we act as their data processor. We handle that data only on the landlord’s instructions and under the terms of service. If you are a tenant with a question about how your landlord uses your data, contact your landlord first; we will help them respond.

• Account data: name, email address, password hash or Google sign-in identifier, and profile details you add.
• Portfolio data: properties, tenancies, rent and deposit records, expenses, receipts, certificates, maintenance jobs, letters, tasks and documents you upload or generate.
• Tenant and third-party data: names, contact details, tenancy information, referencing answers, payment and issue history that landlords, tenants, referees or contractors provide through the service.
• Billing data: your subscription plan and payment status. Card details are collected and stored by our payment providers, never by us.
• Bank and payment data: if you connect Direct Debit or Open Banking, the account identifiers and transaction data needed to collect rent and reconcile payments.
• Technical data: IP address, browser and device information, and server logs needed to run and secure the service. We do not use advertising or third-party analytics cookies.

• To provide the service you signed up for, including rent tracking, compliance reminders, document storage, tenant communication and tax reporting (performance of a contract).
• To take payment and manage your subscription (performance of a contract, legal obligation to keep accounting records).
• To send service emails such as sign-in codes, invitations, rent notices and reminders you or your landlord have configured (performance of a contract, legitimate interests). We do not send marketing email without your consent.
• To read receipts and answer questions about your portfolio using AI providers, where you choose to use those features (performance of a contract).
• To keep the service secure, prevent abuse and fix problems (legitimate interests).
• To comply with law, including HMRC record-keeping duties and lawful requests from authorities (legal obligation).

We share personal data only with providers that help us run Letfolio, each under a contract that restricts them to processing on our instructions:

• Vercel (application hosting, file storage and email delivery infrastructure)
• Neon (database hosting)
• Clerk (sign-in and account security)
• Resend (transactional email)
• Google (only if you choose to sign in with Google)
• Stripe, Apple and Google Play (subscription payments, depending on where you subscribe)
• RevenueCat (mobile subscription management)
• GoCardless (Direct Debit rent collection and Open Banking bank feeds, only if you connect them)
• Microsoft Azure and Anthropic (reading receipts and answering portfolio questions, only when you use those features; data sent for a request is not used to train their models)
• Xero (accounting sync, only if you connect it)

We also share data where you direct us to, for example when you email a job sheet to a contractor, send a reference request, or share a document with a tenant. We do not sell personal data.

Some providers above store or process data outside the UK, principally in the European Economic Area and the United States. Where that happens we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on an adequacy decision, so your data keeps equivalent protection.

Landlord records are kept for as long as your account exists. Because HMRC requires landlords to retain records for at least five years after the relevant tax return deadline, a lapsed or cancelled subscription becomes read-only rather than being deleted, so you can still export your records.

You can delete your account at any time by emailing us. We then delete or anonymise your data within 30 days, except where we must keep it to meet a legal obligation, to resolve a dispute, or to enforce our agreements. Server logs are kept for up to 90 days.

You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive a copy in a portable format, and to withdraw consent where we rely on it. To exercise any of these, email info@zolvra.co.uk. We respond within one month.

If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

We use only strictly necessary cookies: those that keep you signed in and protect the service against cross-site request forgery. They do not track you across other websites and no consent banner is required for them. We do not use advertising or analytics cookies.

Data is encrypted in transit and at rest. Access inside our company is limited to people who need it to support you. Third-party integration tokens are encrypted with keys we hold separately from the database. No system is perfectly secure, so if we become aware of a breach affecting your data we will tell you and, where required, the ICO without undue delay.

Letfolio is a business service and is not intended for anyone under 18. We do not knowingly collect data from children.

We will post any changes on this page and update the date at the top. If a change materially affects how we use your data we will also email account holders before it takes effect.