Privacy Policy

Last updated: 15 April 2026

1. Who we are

RentCtrl (rentctrl.co.uk) is a personal, non-commercial website providing free tools and information for landlords and tenants in England. References to "we", "us", or "our" mean the operator of RentCtrl. To contact us, use the contact page.

Data controller: RentCtrl (site operator). Contact email: [email protected] .

2. What data we collect and why

Analytics

We use Cloudflare Web Analytics and PostHog (EU Cloud) to understand how people use the site and where forms are started, abandoned, and completed. PostHog is configured in cookieless mode. We do not set analytics cookies and we do not use session replay. Lawful basis: legitimate interests in understanding and improving the site.

Our own tool analytics events are also stored in our Cloudflare database to measure tool performance and reliability. We use an in-session ID (stored in sessionStorage) to connect events that happen during the same browser session. We do not use a persistent browser ID in localStorage.

Document generation forms

When you generate a document using our forms, the data you enter (such as names, addresses, rent amounts, and dates) is sent to our server. We store a reduced analytics record in a Cloudflare database, such as rent amounts, dates, broad location information, and whether optional fields were completed. We avoid storing names, full addresses, phone numbers, and email addresses in analytics records unless they are needed for a contact message. Your completed PDF is generated in your browser and we do not store it. If you leave before completing a form, we may store progress events such as the step reached, which required fields were present, and whether a later completion happened from the same browser ID. Lawful basis: our legitimate interest in understanding how the tools are used and improving them over time. Retention: anonymised or pseudonymised after 12 months; deleted after 24 months.

AI-assisted document reading and file uploads

Two tools — the Notice Checker and the Rents 1 Generator — let you upload a document (PDF or image). When you upload a file:

  • The file is transmitted to the OpenAI API so that key fields (landlord name, property address, dates, and rent figures) can be extracted automatically. OpenAI processes this data under its API terms and does not use API inputs to train its models. See OpenAI's privacy policy .
  • A copy of the uploaded file is stored in Cloudflare R2 object storage for service-improvement and support purposes. It is subject to the same retention schedule as other form data: anonymised or pseudonymised after 12 months, deleted after 24 months.

By uploading a document you consent to it being processed as described above. Lawful basis: your consent, given at the point of upload.

3. Cookies

We do not set any cookies. Cloudflare Web Analytics is cookieless. No cookie consent banner is shown because none is required.

4. International data transfers

OpenAI is based in the United States. When you upload a notice document it is transferred to OpenAI's servers in the US. OpenAI's API service is covered by appropriate data transfer safeguards. OpenAI API inputs are not used to train OpenAI models. Separately, RentCtrl may retain uploaded files in Cloudflare R2 under the retention schedule described in this policy.

5. Third-party services

  • Cloudflare — hosts this site, provides analytics, and stores form submission data in its D1 database service. Cloudflare's privacy policy .
  • PostHog — provides product analytics for page and form interactions. Our PostHog project is hosted in the EU region. PostHog privacy policy .
  • OpenAI — processes documents you upload for field extraction. Not retained or used for training. OpenAI's privacy policy .
  • Sentry — provides error monitoring and diagnostics. When errors occur, Sentry may capture technical information including IP addresses, browser details, and request context. Sentry's privacy policy .
  • Slack — receives operational notifications when someone submits a contact message or completes certain tool actions. Tool notifications are redacted and do not include uploaded files, full names, full addresses, phone numbers, or email addresses. Contact form notifications may include your name, email address, and message so we can respond.

6. Your rights

Under UK GDPR you have the right to:

  • Access — request a copy of personal data we hold about you.
  • Rectification — ask us to correct inaccurate data.
  • Erasure — ask us to delete your data where there is no compelling reason to retain it.
  • Restriction — ask us to restrict how we use your data in certain circumstances.
  • Portability — request your data in a portable format (applies to data you provided under consent or contract).
  • Object — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent, you may withdraw it at any time.
  • Automated decision-making — we do not make automated decisions with legal or significant effects about you.

To exercise any of these rights, contact us. We will respond within one month.

You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office: ico.org.uk / 0303 123 1113.

7. Changes

We may update this policy from time to time. The "last updated" date at the top reflects any changes.