Privacy Policy

MyRentals360 is a trading name and product of Natanzi Group Ltd ("we", "us", "our"), a company registered in England and Wales. We provide software that helps UK landlords manage properties, tenancies, compliance records, documents and rent information.

Where we decide why and how personal information is processed — for example information about our own account holders — Natanzi Group Ltd is the data controller under UK data protection law. Where our customers upload information about their tenants and other occupants, we generally act as a processor on the customer's behalf. See “Information landlords add about tenants” below.

We have not appointed a Data Protection Officer, as we are not required to do so. Privacy queries are handled by our support team at the address below.

For any privacy question, request or concern, contact us at support@myrentals360.co.uk.

• Account and profile information — name, email address, optional company name and phone number, and your notification preferences.
• Billing and subscription information — your plan, subscription status and billing period, and identifiers issued by our payment provider. Card details are entered directly with our payment provider and are not stored by us.
• Property information — addresses, property attributes, valuations, mortgage and insurance details you enter.
• Tenancy and tenant information — tenant names and contact details, tenancy dates and terms, deposit information and notes, as entered by you.
• Rent and payment records — expected rent, payments recorded, arrears and related finance entries.
• Compliance information — certificate types, reference numbers, issue and expiry dates and related reminders.
• Documents you upload — certificates, agreements, invoices and other files, together with the metadata you add. Depending on the document, its contents may include names, property addresses, tenancy information, rent and deposit information, certificate and compliance information, contractor or engineer information, and other information that appears in the file.
• Technical and security information — information generated when you use the service, such as authentication session data and server and security logs produced by our infrastructure providers (which can include IP address and request information).
• Support communications — messages you send us and our replies.

A. Information about our users. This is information about you as an account holder — your profile, login, subscription and support history. We decide how this is used, so we act as controller for it.

B. Information landlords upload about other people. This is tenant, occupant, guarantor or contractor information that you choose to enter. Where applicable, you (our customer) determine why that information is processed and we provide the software used to process it on your behalf.

This split reflects how the service is normally used. It may not apply in every situation, and the correct characterisation of a particular case depends on the facts. If you need certainty for your own compliance records, take your own professional advice.

If you use MyRentals360 to record information about tenants and other individuals, you are responsible for making sure you have an appropriate lawful basis for doing so, and for providing those individuals with the privacy information they are entitled to receive from you.

• Only enter tenant information you genuinely need for managing the tenancy.
• Keep it accurate and up to date, and remove information you no longer need.
• Respond to your tenants' data protection requests as the person responsible for that information.

A landlord may also choose to use our optional AI-assisted document extraction on a document that contains information relating to tenants or other individuals, such as a tenancy agreement or a certificate naming an engineer. That choice is made by the landlord who uploads the document, not by the individuals named in it. See “AI-assisted document processing” below.

We do not sell tenant personal information, and we do not use tenant information for advertising.

MyRentals360 is software used by landlords to manage property and tenancy information. If your landlord holds information about you in MyRentals360:

• Your landlord is generally responsible for explaining why they hold your information and the lawful basis for doing so.
• We process that information as necessary to provide the software service to your landlord, where we act as processor.
• Please contact your landlord first about information they have entered, including requests to see, correct or delete it.
• You can also contact us about privacy or security concerns and we will help where we can, or pass the request to the relevant customer.

Being recorded in a landlord's portfolio does not mean you have a MyRentals360 account. Accounts are only created by people who sign up themselves.

Your landlord may also choose to use our optional AI-assisted document extraction on a document they hold, such as a tenancy agreement. That is the landlord's choice, and the extracted details are shown to them for review before anything is saved. See “AI-assisted document processing” below.

• To provide the service you have signed up for — creating your account, storing your portfolio, generating reminders and rent schedules. Lawful basis: performance of a contract.
• To take payment and manage subscriptions — processing plan changes, renewals and cancellations. Lawful basis: performance of a contract.
• To keep the service secure and working — authentication, abuse prevention, diagnosing faults and improving reliability. Lawful basis: our legitimate interests in operating a secure, functioning service.
• To communicate with you about your account — service notices and support replies. Lawful basis: performance of a contract and our legitimate interests.
• To meet our legal duties — for example accounting and tax record keeping. Lawful basis: compliance with a legal obligation.
• Consent — we rely on consent only where it is genuinely required. We do not currently send marketing emails. If we introduce them, they will have their own separate opt-in or opt-out.

Where we act as processor for tenant information uploaded by a customer, we process it on that customer's documented instructions.

MyRentals360 offers an optional AI-assisted document extraction feature. It currently supports tenancy agreements and selected compliance certificates (Gas Safety records, EPCs and EICRs). You decide whether to use it: entering the details manually is always available, and no document is sent for AI processing unless you upload one and deliberately choose to have it read.

Purpose. To help landlords enter and manage property, tenancy and compliance information more efficiently by extracting relevant information from documents they choose to upload.

What happens to the document. The document is processed to identify the relevant information. The whole document may be processed even though MyRentals360 asks only for specific fields, so information appearing in the document may technically be processed even where it is not extracted into structured fields. Depending on the document, it may contain personal information about tenants, landlords, agents, contractors, engineers or other people.

Data minimisation. We configure the extraction to request only information relevant to the workflow you selected — for a tenancy, details such as tenant name(s), property, tenancy dates, rent, rent frequency and due date, deposit and deposit scheme; for a certificate, details such as the relevant dates, the provider or contractor, certificate or reference information, and a small number of certificate-specific details.

Review before anything is saved. Extracted details are shown to you for review and editing, and nothing is added to your records until you confirm. Important dates such as certificate expiry and next inspection dates are specifically presented for confirmation. AI extraction can be inaccurate or incomplete, and we do not guarantee the accuracy or legal validity of extracted information. You remain responsible for checking it before saving and relying on it.

No decisions are made about people. This feature does not assess or profile tenants, and it does not make decisions about whether to accept a tenant, tenant suitability, rent levels, ending a tenancy, compliance status without your review, or anyone's legal rights. It extracts information for the landlord to review. Nothing it produces is legal advice or a legal interpretation of your document.

Storage and providers. The original document you uploaded remains subject to our normal document storage and retention rules. Our extraction implementation does not create an additional permanent copy of the document in our application storage solely for AI processing. AI processing involves one or more external AI document-processing providers; see “Who receives information” and “International transfers” below.

We use a small number of external providers to run MyRentals360. Other than our payment provider, we describe them by category and function rather than by name, so you can see what happens to your information without us publishing our technical supply chain. We maintain a current list of the providers we use, and account holders can obtain it by writing to us at support@myrentals360.co.uk. The categories are:

• Cloud hosting, application infrastructure and deployment providers — they run the servers that build and serve the application, so any information you view or submit passes through them in the course of using the service. This category also includes technical error and diagnostic reporting used to identify and fix faults.
• Managed database, authentication and secure document-storage providers — they store your account, property, tenancy, compliance, rent and finance records, your sign-in credentials, and the document files you upload, so that your data persists and only your account can reach it.
• Transactional email delivery providers — they deliver the service emails we send from notify.myrentals360.co.uk, such as sign-in, password reset and account notifications, which means they handle your email address and the content of those messages.
• Payment processing and subscription-billing providers — see the section on payments below.
• Network security, DNS, TLS and content-delivery providers — they route and encrypt traffic to our domains and protect the service against abuse, which involves processing connection information such as your IP address and standard request data.
• Optional AI document-processing providers — where you choose to use AI-assisted document extraction, the document you upload is sent to one or more external AI document-processing providers, which read it and return structured details for you to review. This only happens when you use that feature.

We have not stated provider legal entities, certifications, audit reports or specific contractual transfer terms, because those come from each provider's own documentation rather than from our application.

Subscription payments and billing are handled by Stripe, including checkout, the billing portal and your invoice history. Card details are entered with Stripe and are not stored by us. We receive billing name and email, subscription status and payment records.

Stripe does not only act on our instructions: for parts of the processing — such as operating and securing its payment network, fraud prevention and meeting its own legal and regulatory obligations — it decides how and why information is used. Its handling of that information is covered by its own privacy notice, available at stripe.com/privacy.

Our database, authentication and document storage are hosted in Frankfurt, Germany. That is where your account and portfolio records, and your uploaded documents, are held.

This does not mean all personal information stays inside the UK or EEA. Our other providers — including payment, hosting, email, error reporting and network and content-delivery services — operate internationally, and information such as billing details, email content and connection data may be processed outside the UK. Where personal information is transferred outside the UK, an appropriate safeguard recognised under UK data protection law must be in place.

This includes our optional AI-assisted document processing. Where you use that feature, the document is sent to an external AI processing service, and that processing does not necessarily take place in the same location as our database and document storage. We have not stated the processing region or the specific transfer safeguard for AI processing here, because we rely on the provider's own documentation and contract terms for that detail. Contact us if you need it for your own compliance records.

We have not named the specific transfer mechanism used by each provider here, because that detail comes from provider documentation and contracts. If you need it for your own compliance records, contact us and we will point you to the relevant provider terms.

We take a defence-in-depth approach appropriate to a small SaaS platform. Measures currently in place include:

• Database-level access rules so each account can only read and write its own records.
• Uploaded documents stored in private storage, served only through short-lived signed links to the account that owns them.
• Authentication required for every application route that shows portfolio data.
• Secrets and payment credentials held server-side and never exposed in the browser.
• Encryption in transit (HTTPS/TLS) across all of our domains.

No online service can be guaranteed completely secure. We do not claim to be, and we will tell affected users promptly if a security incident affects their information.

We keep your account and portfolio information for as long as your account is open, and afterwards only for as long as necessary for legitimate business or legal purposes such as accounting records, security, or resolving disputes.

Not every record works the same way inside the application, so it is worth being precise:

• Records you can delete outright — individual documents, recorded rent payments and certain rent charges can be deleted from the application.
• Records that are archived rather than deleted — properties, tenancies, compliance records, finance entries, documents you replace and property notes are archived so that history stays intact. Archived records remain in your account until you delete your account.
• Account deletion — deleting your account removes your account and its records, including archived ones, as described below.
• Records retained separately — payment and invoice records held by our payment provider, and information we must keep for accounting, tax, legal or security reasons, are retained independently of your account.

AI-assisted document extraction. Where you use this optional feature, the original document you uploaded continues to follow the normal document rules above. Our application does not intentionally create an additional permanent copy of the document solely for extraction: the file is read into memory for the request and the extracted fields are only saved if you confirm them. Retention by the external providers involved in AI processing is governed by their own terms; we have not stated a retention period for them here.

We do not currently operate an automated retention or purge schedule, and we have not yet set fixed retention periods for each category of information. Until we do, we keep information only for as long as it is needed for the purpose it was collected for, or for as long as the law requires. Formal retention periods are a follow-up item for us.

You can delete your account yourself from Settings → Privacy & Data. Deletion is confirmed explicitly before it runs and cannot be undone.

When it completes, we remove from the active service:

• Your MyRentals360 sign-in and profile.
• Your properties, tenancies, compliance records, rent and finance records, tasks and notes, including archived ones.
• The document files you uploaded, which are removed from our document storage.

Any active subscription is cancelled as part of the process so you are not billed again. If a step of the process cannot be completed, we tell you it has not completed rather than reporting success.

We keep one minimal internal record of the deletion itself, for audit and security purposes. It holds only an internal account identifier, timestamps, the outcome, and counts of what was cleaned up. It deliberately contains no name, email address, portfolio content or tenant information.

We cannot promise deletion from everything, everywhere. Payment and invoice records held by our payment provider are retained by them independently, and routine infrastructure backups operated by our providers age out on their own schedules rather than being edited on request. We also keep information where the law requires it.

Under UK data protection law you may have the right to:

• Ask for access to the personal information we hold about you.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete information.
• Ask us to restrict how we use information.
• Object to processing based on our legitimate interests.
• Ask for a copy of certain information in a portable format.
• Withdraw consent where we rely on consent.

These rights are not absolute — some apply only in certain circumstances, and we may need to keep information where the law requires it. If you are a tenant and your landlord entered the information, please contact your landlord first.

To exercise a right, email support@myrentals360.co.uk.

From Settings → Privacy & Data you can download a structured JSON file of your own records: profile, subscription details, properties, tenancies, compliance records, rent charges and payments, finance records, tasks, notes, notifications and the details you recorded about each document.

The export includes document details, but not the contents of the files themselves. Uploaded files stay in secure storage and can be downloaded individually from the Documents area, so download anything you need separately before closing your account.

We use the Google tag (Google Ads) on our public website to measure how our advertising performs. In regions that require consent, advertising and analytics storage stay switched off until you accept through the cookie banner; you can reject just as easily, and you can change your choice at any time using the button below. Elsewhere, measurement runs in line with applicable law and any opt-outs that apply.

Change my cookie choice

We do use strictly necessary storage in your browser — the session information needed to keep you signed in securely. In addition, the network security and content-delivery layer in front of our site may set necessary cookies, such as a bot-management cookie, for abuse protection, and processes connection information including your IP address. Fonts and other page assets are served from our own domains, so displaying a page does not require a request to a separate font provider. Our application also reports technical errors to our hosting and diagnostics providers so we can fix faults.

So it would not be accurate to say no third party receives any information: providers involved in delivering, securing and supporting the service necessarily do. If we ever introduce non-essential technologies, we will update this policy and add an appropriate consent mechanism first.

Please contact us first so we can put things right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

See our Terms of Service, and Data Processing Terms.