Portal privacy notice
The portal holds the documents and facts about your home that a buyer will ask for. Only you can see them unless you choose to share them. This notice explains what we collect, why, where it is kept, who helps us run the service, how long we keep it, and your rights.
Who is responsible for your data
The data controller is the operator of Upfront Sales Packs ("we", "us"). You can contact us through the contact form.
If an estate agency invites you to the portal, we are still the controller of your pack. The agency is separately responsible for the information it receives and uses for its own purposes, such as its legal checks.
What we collect and why
| Data | Why we use it | Lawful basis (UK GDPR) | How long we keep it |
|---|---|---|---|
| Your email address and, if you give it or your sign-in provider supplies it, your name; which sign-in methods you use (email code, Google, Microsoft, Apple or Facebook) and a record of when they were added or removed | To create and secure your account, sign you in, and warn you when a sign-in method changes | Contract (Article 6(1)(b)); legitimate interests (Article 6(1)(f)) in keeping accounts secure | Until you delete your account, or 24 months after your last sign-in once your packs are deleted |
| The property address, postcode and whether it is freehold or leasehold; the checklist's progress; notes you add; services you ask us about | To build your pack and show what is done and what is left | Contract | 12 months after you tell us the sale completed, or 24 months after the last activity if it did not, unless you choose to keep it; you can delete it sooner |
| Documents you upload (for example the title register, lease, management pack, searches, certificates, guarantees, bills, a survey, your answers to the property questions), with the file name, size and type | To store your evidence so it can be shared when you decide | Contract | As for the pack above |
| When you share your pack: the name, email address and role of each person you choose, how long you allow, and a log of when they viewed the pack and which items and files they opened | To give access only to the people you choose, for the time you choose, and to show you who used it | Contract (you); legitimate interests (recipients are told access is logged) | Share records 12 months after the pack is deleted; the access log 12 months |
| If you pay for a service: what you ordered, the price, the payment reference and status. Card details are handled by our payment provider and never reach us | To deliver the service and keep tax records | Contract; legal obligation (Article 6(1)(c)) for tax records | Six years after the end of the tax year |
| Security and operations records: the time and network address of sign-ins and requests, email delivery status | To detect misuse, investigate problems and keep the service running | Legitimate interests in security | Up to 12 months in our systems; shorter in our providers' logs |
| If you choose a suggested supplier and send them your request: your name, contact details, the property address and the service you want, passed to that supplier only; and a record of the referral | To send your request to the supplier you chose, and to record the referral, which is how the supplier's flat fee to us is calculated | Contract (your request); legitimate interests in billing the supplier | Referral records six years after the end of the tax year (billing); your request details are not kept by us beyond the record |
| Messages you send to support, complaints and data rights requests | To help you, put things right and show we handled requests properly | Legitimate interests; legal obligation for rights requests | Support 24 months; complaints 6 years; rights requests 2 years |
Please do not upload identity documents (passport, driving licence) or anything about your health. We do not need them, and we delete them if we find them. When an identity check is introduced, it will be done by a specialist provider; we will keep the result, never the images.
Documents sometimes name other people, such as a managing agent or a neighbour. Upload only what the sale needs, and cover over anything a buyer does not need to see.
Where your data is kept
- Supabase, Inc. runs our database, file storage and sign-in service, as our processor. Your pack and documents are stored in its London (United Kingdom) region.
- Resend, Inc. sends our sign-in codes and account emails from servers in Ireland, as our processor.
- Netlify, Inc. serves the portal's pages. The pages themselves contain no personal data; Netlify's request logs are held under its own policy, in the United States under the UK Extension to the EU-US Data Privacy Framework.
- If you sign in with Google, Microsoft, Apple or Facebook, that company confirms your name and email address to us. We send it nothing about your pack. Each is responsible for its own handling of your account under its own privacy notice.
- If you pay for a service, Stripe processes the payment as our processor and, for fraud prevention, as a controller under its own notice.
- A supplier you choose receives your request only when you send it, and is then responsible for your data under its own notice.
We do not sell your data, use it for advertising, or use it to train artificial intelligence models. We would otherwise disclose it only if the law required it.
Who can see your pack
Nobody but you, until you share it. When you share, you choose each person and how long they have access: a day, a week, a month, three months, until your sale completes, or until you turn it off. You can turn access off at any time and see when each person viewed your pack. Files open through links that expire after five minutes. A public summary, if you choose to publish one, contains facts about the property and no personal data.
Cookies and storage on your device
The portal stores your sign-in session in your browser's local storage so you stay signed in. That is strictly necessary for the service, so no consent banner is shown. We use no advertising or tracking. If we add statistics about how the portal is used, they will be collected without identifying you and with a simple way to opt out, and this notice will say so first.
Your rights
You can ask for a copy of your data, have it corrected or deleted, object to or restrict our use of it, withdraw any consent, and receive the data you gave us in a portable form. You can delete your documents yourself at any time. For anything else, contact us through the contact form; we will reply within one month.
If you are unhappy with how we have handled your data, you have the right to complain to us and we will acknowledge your complaint within 30 days, keep you informed and tell you the outcome. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Keeping your data secure
Everything travels over encrypted connections. Each person's data is separated in the database so that an account can only reach its own packs, and we test those rules. Documents sit in private storage that is never public. Our security decisions are reviewed every month.
Who the portal is for
The portal is for adults selling or buying property. You must be 18 or over to open an account.
Changes to this notice
If we start to collect anything new, add a provider, or change how we use data, we will update this notice before doing so and change the date at the top. Significant changes will also be shown in the portal.