1. Data Controller

Dwelfy ("Dwelfy", "we", "us", or "our") is the data controller responsible for your personal data. If you have questions about this policy, contact us at privacy@dwelfy.co.uk.

2. Data We Collect

We collect the following categories of personal data:

• Identity Data: first name, last name, username, profile photo
• Contact Data: email address, telephone numbers, postal address
• Financial Data: payment card details (processed securely by Stripe; we do not store full card numbers), subscription history, transaction records
• Technical Data: IP address, browser type and version, device information, time zone setting, operating system
• Usage Data: pages visited, features used, property searches performed, saved properties, search filters applied
• Location Data: city or postcode entered in property searches (we do not track precise device location without consent)
• Property Data: properties you list, portfolio data, investment calculations
• Communication Data: messages sent through the platform, support enquiries

3. Legal Basis for Processing (Article 6 GDPR)

We process your personal data on the following legal bases:

• Contract: processing necessary to provide our services when you create an account or subscribe
• Legitimate Interests: improving our platform, preventing fraud, and sending service-related communications
• Consent: marketing emails and optional analytics cookies (you can withdraw consent at any time)
• Legal Obligation: complying with applicable laws such as anti-money laundering regulations

4. How We Use Your Data

We use your personal data to:

• Provide, operate, and maintain our services
• Process payments and manage subscriptions via Stripe
• Send service notifications and account updates
• Provide customer support
• Analyse usage patterns to improve our platform
• Detect, prevent, and address fraud or technical issues
• Send marketing communications (with your consent)

5. Data Sharing

We share your data with the following third parties, only as necessary:

• Stripe (USA, SCCs in place): payment processing (PCI DSS Level 1 compliant)
• Supabase (eu-west-2 / London region): database hosting and authentication. Your account data and property portfolio are stored within the EU.
• Cloudflare: content delivery, edge caching, and security (logged in aggregate; minimal personal data)
• Resend: transactional and marketing email delivery
• PostHog (EU host: eu.i.posthog.com): product analytics. Anonymous pageview data is captured site-wide; identified events are only sent after you sign in. Data is processed within the EU (PostHog EU Cloud).

We do not sell your personal data to any third party.

5a. Public-Sector Data Sources (UK Open Government Licence)

Dwelfy enriches investor-facing pages with data from UK government open datasets. This data describes properties and addresses; it does not identify individual users. Where we display it, the following attributions apply per the Open Government Licence v3.0:

• HM Land Registry Price Paid Data — recently-sold price comparables on property pages. Contains HM Land Registry data © Crown copyright and database right 2026. This data is licensed under the Open Government Licence v3.0.
• Energy Performance of Buildings Register — EPC ratings and total floor area, sourced from the Ministry of Housing, Communities & Local Government, used under the Open Government Licence v3.0.
• Local-authority Article 4 Direction datasets — used to flag permitted-development restrictions on individual postcodes. Each contributing dataset is used under the Open Government Licence v3.0 or equivalent.

These datasets describe properties, not individuals, and are processed under our legitimate-interest basis to provide accurate investment analysis. The underlying public sources remain authoritative; figures shown on Dwelfy are derived and may differ.

6. Data Retention

We retain your data for the following periods:

• Account data: retained while your account is active and for 12 months after deletion
• Payment records: retained for 7 years to comply with UK financial record-keeping requirements
• Usage logs: retained for 12 months, then aggregated and anonymised
• Marketing consent records: retained for the duration of consent plus 12 months

7. International Data Transfers

Your data may be processed outside the UK where our service providers operate. When this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS 1.3), encryption at rest, access controls, and regular security assessments.

9. Your Rights Under UK GDPR

You have the right to:

• Access your personal data (Subject Access Request)
• Rectification of inaccurate or incomplete data
• Erasure of your personal data ("right to be forgotten")
• Restriction of processing in certain circumstances
• Data portability to receive your data in a structured format
• Object to processing based on legitimate interests or direct marketing
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at privacy@dwelfy.co.uk. We will respond within 30 days.

10. Automated Decision-Making

We use automated calculations for property yield estimates and investment metrics. These are provided as informational tools only and do not constitute financial advice or automated decisions with legal or similarly significant effects on you.

11. Cookies

We use cookies for the following purposes:

• Essential (always set): authentication session cookies (Supabase-issued JWTs), cookie-consent state, market-detection cookie (UK / US).
• Payment (set during checkout only): Stripe session cookies required to complete a transaction.
• Analytics (PostHog, EU-hosted): first-party cookies for anonymous pageview measurement and identified event tracking after sign-in. Used to understand product usage and improve the platform.

You can manage cookie preferences through your browser settings. Disabling analytics cookies does not affect access to the service.

12. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

13. Contact Us

For any questions about this privacy policy or your personal data:
Email: privacy@dwelfy.co.uk