Privacy policy

Version 0.3 (pre-launch draft), effective 14 October 2026. Operated by Sentium Ltd, company number 16512683, registered in England and Wales.

This policy explains what personal data HouseReport collects, why, who it is shared with, how long it is kept and the rights you have. It covers housereport.io and its subdomains.

Who is responsible

Sentium Ltd (company number 16512683, Suite Ra01, 195–197 Wood Street, London E17 3NU, United Kingdom) is the data controller for personal data processed through HouseReport. Contact us at support@housereport.io.

What we collect

When you look up an address

Server logs: IP address, browser type, the pages requested and when. We use them for security, abuse prevention and fault finding.
What you type into the search is used to answer it. It is not stored against you, and your IP address is held briefly in memory to limit how many searches a visitor can make in a minute.

When you buy a report

The address you chose, the email address you give at checkout, the amount, whether the payment succeeded or was refunded, and Stripe's references for the payment.
Stripe, our payment provider, collects your card or wallet details. We never see or store your card number.
An access code for the report, kept in a cookie in the browser you paid in and in the link we email you. We store only a one-way fingerprint of it.
A one-way fingerprint of your IP address with the order, to help detect fraud.

If you create an account (optional)

Your email address, whether it is confirmed, and a one-way hash of your password (never the password itself).
If you sign in with Google or Facebook: your name, email address and the provider's identifier for you. We never receive your password for that provider and never post on your behalf.
Where you are signed in (browser and the time of the sign-in) and security events such as failed sign-ins, so you and we can spot misuse.

Emails

We email you to confirm an address, reset a password or deliver a report link, and keep a record of each email sent (to whom, which message, when) with your account or order.

Why we use it, and the legal basis

To provide what you ask for (search results, the report you bought, your account): performance of a contract.
To keep the service secure, prevent fraud and fix faults: our legitimate interests.
To keep payment records for tax and accounting: a legal obligation.

We do not sell personal data, show advertising or build profiles of you.

Microsoft hosts HouseReport in its UK South region (Azure) and sends our emails (Azure Communication Services, UK data location).
Stripe processes payments. For some payment data Stripe acts as an independent controller under its own privacy policy.
Google or Facebook, only if you choose to sign in with them.
Authorities, if the law requires it.

Stripe may process data outside the UK under appropriate safeguards (such as the UK International Data Transfer Addendum).

How long we keep it

Server logs: up to 30 days.
Payment records: six years from the purchase, as UK tax law requires. If you delete your account, your purchases are unlinked from it and their email address is removed.
Account data: until you delete the account.
Records of emails we sent: with the account or order they belong to.

Cookies

HouseReport uses only cookies that are strictly necessary for what you ask it to do, so it does not ask for consent. There are no analytics, advertising or tracking cookies.

hr_session: keeps you signed in, until you sign out or the session expires.
hr_access: opens the reports you bought in this browser, for a year.
hr_oauth and hr_link: protect a Google or Facebook sign-in while it is in progress, for 10 to 15 minutes.

About the property information

Reports are built from official public records about places: sold prices published by HM Land Registry, postcode and census statistics, recorded crime, deprivation, flood risk, broadband, schools and transport data. They hold no names of owners or residents. Each report lists every source it uses.

A home’s energy rating and building details come from the government’s Energy Performance of Buildings Register, which publishes them for each address. Because that information is about a particular home, we treat it as personal data: we use it, on the basis of our legitimate interest in giving buyers and renters useful information about a home, only to show it in that home’s report. We refresh it every month, so a certificate its owner has withdrawn from public view leaves HouseReport too. To ask us to remove one sooner, write to support@housereport.io.

Your rights

You can ask for a copy of your data, its correction or deletion, a restriction on its use, or object to it. Signed-in users can download their data and delete their account from the account page; see data deletion. Write to support@housereport.io for anything else. We reply within one month.

You can complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we handle your data.

Changes

A material change to this policy gets a new version number and date at the top of this page, and we email account holders about it.

Contact

Sentium Ltd, Suite Ra01, 195–197 Wood Street, London E17 3NU, United Kingdom. Email support@housereport.io.