Legal

Privacy Policy

Last updated: April 2026

1. Who we are

Portlio ("we", "us", "our") is a software-as-a-service platform for residential landlords in the United Kingdom. Our registered office is at [YOUR REGISTERED ADDRESS]. We are registered with the Information Commissioner's Office (ICO) under registration number [YOUR ICO NUMBER].

This policy explains how we collect, use, store, and protect personal data when you use our platform, and sets out your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Questions about this policy can be sent to [YOUR CONTACT EMAIL].

2. The data we collect and why

2.1 Landlord account holders

When you create an account and use Portlio, we collect:

Identity and contact data — your name, email address, phone number, and address, provided during registration or in your profile settings.
Business data — your limited company name, company number, and related details if you choose to add them.
Property data — addresses, property types, financial details (rent, mortgage, expenses), and documents you upload to the platform.
Usage data — how you navigate and use the platform, including pages visited and features used, collected through server logs and analytics.
Technical data — your IP address, browser type, and device information.

Lawful basis: performance of a contract (to provide the service you have signed up for) and our legitimate interests in improving and securing the platform.

2.2 Tenants

If your landlord has invited you to the Portlio tenant portal, we collect:

Identity and contact data — your name and email address, as provided by your landlord or by you during sign-up.
Tenancy data — details relating to your tenancy, including documents shared with you by your landlord and messages exchanged through the platform.
Usage data — how you use the tenant portal.

Lawful basis: legitimate interests (providing you with access to your tenancy information and documents) and, where required, consent.

Note: your landlord is the data controller for the personal data they hold about you. Portlio acts as a data processor on your landlord's behalf. Please contact your landlord directly regarding their own data practices.

3. How we use your data

We use your personal data to:

Create and manage your account
Provide and improve the Portlio platform and its features
Send you service-related communications (e.g. document expiry reminders, security alerts)
Handle billing and subscription management
Respond to support requests
Comply with our legal obligations
Detect and prevent fraud or misuse of the platform

We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects.

4. Who we share data with

We may share your data with the following categories of third parties, all of whom are bound by data processing agreements:

Supabase Inc. — our database and authentication provider. Data is hosted in the EU/EEA region.
Vercel Inc. — our hosting and deployment provider.
Payment processors — for subscription billing (details to be added when billing is live).
Legal and regulatory bodies — where we are required to disclose data by law or court order.

We will never share your personal data with third parties for their own marketing purposes.

5. International transfers

Some of our third-party service providers are based outside the UK. Where we transfer personal data internationally, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (SCCs) or reliance on an adequacy decision — in accordance with UK GDPR requirements.

6. How long we keep your data

Account data — retained for the duration of your account, plus 6 years after closure (to meet statutory and tax record-keeping requirements).
Property and financial records — retained for 6 years from the date of the relevant transaction, in line with HMRC guidance.
Tenant portal data — retained for 6 years after the tenancy ends, unless your landlord requests earlier deletion.
Usage and technical logs — retained for up to 12 months.

After applicable retention periods, data is securely deleted or anonymised.

7. Your rights

Under UK GDPR, you have the following rights:

Right of access — to request a copy of the personal data we hold about you.
Right to rectification — to ask us to correct inaccurate or incomplete data.
Right to erasure — to ask us to delete your data in certain circumstances.
Right to restrict processing — to ask us to limit how we use your data.
Right to data portability — to receive your data in a structured, machine-readable format.
Right to object — to object to processing based on legitimate interests.
Right to withdraw consent — where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at [YOUR CONTACT EMAIL]. We will respond within one calendar month. You also have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include encrypted data storage, secure HTTPS connections, access controls, and regular security reviews. However, no system is completely secure and we cannot guarantee absolute security.

9. Cookies

We use cookies and similar technologies to keep you logged in and to understand how the platform is used. For full details, please see our Cookie Policy.

10. Children

Portlio is not directed at or intended for use by children under 18. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or by a prominent notice on the platform. The date at the top of this page reflects when the policy was last updated.