Who we are
RentCharter is a public-interest tool that helps UK private renters check whether a proposed rent increase is fair. For the purposes of UK GDPR we are the data controller for any personal information you submit to us. If you want to get in touch about anything in this notice, email hello@rentcharter.org.
If you use RentCharter without an account
The free rent fairness check runs entirely in your browser. The numbers you enter — rent, postcode prefix, property type, notes — are not sent to a server. The result is saved in your browser's local storage so you can move between the result and the evidence pack. You can clear it any time from your browser settings or by starting a new check.
If you create an account
Accounts let you upload your tenancy agreement to auto-fill the check, save past results, and (in future) get paid features for free in council-sponsored areas. With an account we hold:
- Your email address, used to identify your account and contact you about it.
- Your password, stored as a cryptographic hash — we never see the plain text.
- Tenancy agreements you upload, kept as PDF files in private storage, plus a structured summary of the fields we extracted (rent, postcode, property type, condition, etc.).
- Rent checks you run while signed in, including the inputs and the result. These are linked to your account so you can see them in one place.
- A consent timestamp recorded the moment you tick the processing-consent box on the upload step. We keep this so we can show, if asked, that you agreed to the processing.
Legal basis
We rely on different legal bases under UK GDPR depending on what we're doing:
- Contract (Article 6(1)(b)) — for delivering the rent check, account features and email confirmation. You asked us to run the service; we need this data to run it.
- Consent (Article 6(1)(a)) — for processing the specific contents of an uploaded tenancy agreement. We collect this consent by tickbox on the upload step. You can withdraw it at any time by deleting the upload from your account.
- Legitimate interests (Article 6(1)(f)) — for keeping basic operational logs (e.g. authentication events, error logs) needed to run the service securely. These never include your rent figures or postcode.
Who processes your information
We use a small number of carefully chosen processors so we don't have to build our own infrastructure. Each only sees the data they need:
- Supabase (data hosting and authentication) — stores your account, tenancy uploads and rent checks. Hosted in the EU (Frankfurt) by default. Supabase processes the data on our instructions under their data processing agreement.
- Resend (transactional email) — delivers account-confirmation and password-reset emails on our behalf. Resend sees your email address and the contents of the email we generate, but no other account data.
- Vercel (web hosting) — runs the website and sees standard server access logs (IP address, request path, user agent). These are kept for a short period for operational reasons and aren't linked to your account.
We don't sell or share your data with landlords, letting agents, advertisers or data brokers. We also don't use it to train AI models.
How long we keep it
- Uploads & rent checks — kept while you want them. You can delete individual uploads, all submitted data, or your whole account from your account at any time.
- Account record — kept while the account is active. Closing the account deletes it immediately along with the uploads and saved checks.
- Authentication logs — kept by Supabase for up to 90 days for security purposes, then automatically purged.
- Email delivery logs — kept by Resend for their standard short retention window.
Your rights
Under UK GDPR you have the right to:
- Access the personal information we hold about you. Most of it is visible from your account; if you want a more structured export, email us.
- Correct anything that's wrong. Most fields are editable on the upload review step or in your account settings; email us if you need help.
- Delete your data — both individual uploads and the entire account — from the “Your data” section of your account. Deletions are immediate.
- Withdraw consent for the processing of any uploaded tenancy by deleting that upload.
- Port your data to another service — email us and we'll send you a structured export.
- Complain to the ICO if you think we've handled your data badly. Their contact details are at ico.org.uk/make-a-complaint.
Cookies
We use a small number of essential cookies (kept by Supabase) to keep you signed in. These are required for the site to work and don't need consent under UK PECR.
We also use Google Analytics to understand which pages people find useful so we can improve the free tools. These analytics cookies are only set after you click “Accept all” on the cookie banner. Choosing “Essential only” (or ignoring the banner) means Google Analytics is not loaded at all.
Security
Data sits in EU-region Supabase storage protected by Row Level Security policies, so even at the database layer your uploads and checks are only visible to your account. Passwords are stored as cryptographic hashes by Supabase Auth. All network traffic to the site and to Supabase is encrypted in transit (TLS).
We're a small team. If you find a security issue, please email hello@rentcharter.org rather than posting it publicly — we'll respond within a working day.
Analytics
With your consent we use Google Analytics 4 (measurement ID G-W78L3BR6TS) to understand which pages and tools are useful. The script is only loaded after you click “Accept all” on the cookie banner, and we ask Google to anonymise your IP address. We never send your rent figures, postcode, or any free-text you enter into the rent checker into analytics events — only standard page view and navigation data.
Google Analytics is provided by Google LLC and may transfer data outside the UK/EEA. You can opt out at any time by clicking “Essential only” on the cookie banner (clear your site data first if you previously accepted).
If you contact us
When you email us we use your email address only to reply. We don't add you to a marketing list and we don't pass your message to anyone outside RentCharter.
Children
RentCharter isn't aimed at children. If you're under 16 you should ask a parent or guardian before creating an account, and we'll delete any account we discover belongs to a child without that involvement.
Changes to this notice
When this notice changes we'll update the “last updated” date at the top. Material changes (new processors, new uses of your data) will be flagged in-app before they take effect.
Contact
Questions, data-rights requests, or complaints: hello@rentcharter.org.