Privacy Policy

Last updated: 23 July 2026

1. Who we are

RentCtrl (rentctrl.co.uk) is a personal, non-commercial service providing free guidance and information for tenants in England. References to "we", "us", or "our" mean the operator of RentCtrl. To contact us, use the contact page.

Data controller: RentCtrl (site operator). Contact email: [email protected] .

2. What data we collect and why

Analytics

We use Cloudflare Web Analytics and PostHog (EU Cloud) to understand how people use the site, including which pages are viewed and which WhatsApp buttons are selected. PostHog is configured in cookieless mode. We do not set analytics cookies and we do not use session replay. Analytics providers also receive standard technical context such as the page URL, referring page, browser, device and screen information. Lawful basis: legitimate interests in understanding and improving the site.

WhatsApp conversations

If you choose “Free advice”, WhatsApp opens with a suggested message to RentCtrl. WhatsApp and its owner, Meta, process your phone number, messages, attachments, account details, and related technical data under their own terms and privacy policy. We use what you send to understand your situation, reply to you, and provide the help you request. Please do not send information that is not relevant to your rent or tenancy question.

Lawful basis: taking steps at your request to provide the service, and our legitimate interest in answering and managing enquiries. We will not add you to marketing lists because you asked for advice. You may ask us to delete our copy of the conversation.

Our own tool analytics events are also stored in our Cloudflare database to measure tool performance and reliability. We use an in-session ID (stored in sessionStorage) to connect events that happen during the same browser session. We do not use a persistent browser ID in localStorage.

Previous document forms

If you previously generated a document using one of our forms, the data you entered (such as names, addresses, rent amounts, and dates) is sent to our server. We store a reduced analytics record in a Cloudflare database, such as rent amounts, dates, broad location information, and whether optional fields were completed. We avoid storing names, full addresses, phone numbers, and email addresses in analytics records. Your completed PDF is generated in your browser and we do not store it. If you leave before completing a form, we may store progress events such as the step reached, which required fields were present, and whether a later completion happened from the same browser ID. Lawful basis: our legitimate interest in understanding and improving the service. Retention: anonymised or pseudonymised after 12 months; deleted after 24 months.

Previous contact form

Previous versions of RentCtrl offered a website contact form. If you used it, we stored your name, email address, message, session ID, and technical request data in our Cloudflare database and sent an operational notification to Slack so we could respond. We retain those records only while they are needed to manage the enquiry and meet legal obligations. You may ask us to delete our copy where no obligation requires us to keep it.

Previous file uploads

Previous versions of RentCtrl allowed document uploads. If you uploaded a PDF or image:

  • The file is transmitted to the OpenAI API so that key fields (landlord name, property address, dates, and rent figures) can be extracted automatically. OpenAI processes this data under its API terms and does not use API inputs to train its models. See OpenAI's privacy policy .
  • A copy of the uploaded file is stored in Cloudflare R2 object storage for service-improvement and support purposes. It is subject to the same retention schedule as other form data: anonymised or pseudonymised after 12 months, deleted after 24 months.

By uploading a document you consent to it being processed as described above. Lawful basis: your consent, given at the point of upload.

3. Cookies

We do not set any cookies. Cloudflare Web Analytics is cookieless. No cookie consent banner is shown because none is required.

4. International data transfers

OpenAI is based in the United States. When you upload a notice document it is transferred to OpenAI's servers in the US. OpenAI's API service is covered by appropriate data transfer safeguards. OpenAI API inputs are not used to train OpenAI models. Separately, RentCtrl may retain uploaded files in Cloudflare R2 under the retention schedule described in this policy.

5. Third-party services

  • WhatsApp / Meta — provides the messaging service used for free advice. WhatsApp processes messages and account data under its own terms. WhatsApp privacy policy .
  • Cloudflare — hosts this site, provides analytics, and stores form submission data in its D1 database service. Cloudflare's privacy policy .
  • PostHog — provides product analytics for page and form interactions. Our PostHog project is hosted in the EU region. PostHog privacy policy .
  • OpenAI — processes documents you upload for field extraction. Not retained or used for training. OpenAI's privacy policy .
  • Sentry — provides error monitoring and diagnostics. When errors occur, Sentry may capture technical information including IP addresses, browser details, and request context. Sentry's privacy policy .
  • Slack — receives operational notifications for certain previous tool actions. Those tool notifications are redacted and do not include uploaded files, full names, full addresses, phone numbers, or email addresses.

6. Your rights

Under UK GDPR you have the right to:

  • Access — request a copy of personal data we hold about you.
  • Rectification — ask us to correct inaccurate data.
  • Erasure — ask us to delete your data where there is no compelling reason to retain it.
  • Restriction — ask us to restrict how we use your data in certain circumstances.
  • Portability — request your data in a portable format (applies to data you provided under consent or contract).
  • Object — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent, you may withdraw it at any time.
  • Automated decision-making — we do not make automated decisions with legal or significant effects about you.

To exercise any of these rights, contact us. We will respond within one month.

You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office: ico.org.uk / 0303 123 1113.

7. Changes

We may update this policy from time to time. The "last updated" date at the top reflects any changes.