Privacy Policy

1. Who We Are

RentSignal is a trading name of Clever Bunny Ltd, a company registered in England and Wales (Company No. 10117606). We are the data controller for personal information collected through RentSignal.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at hello@rentsignal.co.uk.

2. What Personal Data We Collect

We collect and process the following personal data:

Account data

• Email address — required to create your account and send login links
• Last sign-in timestamp — recorded each time you authenticate

Authentication data

• Login tokens — short-lived, hashed tokens used to verify your identity via email; automatically expired and invalidated after use
• Session cookies — a secure, server-side session cookie is set when you sign in to maintain your authenticated session

Usage data

• Shortlist contents — property listings you choose to save, including any notes or scenario configurations you apply
• Search activity — the areas and filters you search for, stored temporarily to serve your results
• IP addresses and request logs — recorded by our web server infrastructure for security and operational purposes

3. How We Use Your Data

We do not use your personal data for automated decision-making or profiling, and we do not sell your data to third parties.

4. Data We Do Not Collect

The property data, area signals, and market intelligence displayed in RentSignal (including HPI data, ONS statistics, crime data, flood risk, and EPC information) are sourced from public datasets and do not contain personal information about you. UPRNs (Unique Property Reference Numbers) are public reference identifiers, not personal data.

We do not currently use any third-party analytics or advertising trackers.

5. Third-Party Data Processors

We share personal data with the following categories of third parties only where necessary to operate the service:

• Email delivery (Postmark / Wildbit) — your email address is transmitted to Postmark solely to deliver authentication emails. Postmark is GDPR-compliant and processes data under a Data Processing Agreement.
• Hosting infrastructure — our application and database run on cloud infrastructure within the UK or EU. [Confirm hosting provider and region before publishing.]

External data APIs used by RentSignal (including PropertyData, ONS, Land Registry, Ordnance Survey, and OpenStreetMap/Overpass) receive no personal data from us — all queries are made server-side and contain only geographic or property reference identifiers.

6. Cookies

RentSignal uses one first-party cookie:

• Session cookie — a secure, HTTP-only cookie set when you sign in. This is strictly necessary to maintain your authenticated session and is exempt from prior consent requirements under PECR.

We do not set any analytics, advertising, or third-party cookies.

7. Data Retention

• Login tokens — expire after 30 minutes and are invalidated on first use. Expired and used tokens are purged automatically on a scheduled basis.
• Account data — retained for as long as you have an active account. Deleted on account closure.
• Shortlist data — retained until you delete the shortlist or close your account.
• Server logs — retained for 90 days, then deleted automatically.

8. Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your account and all associated personal data
• Restriction — ask us to pause processing of your data in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests

To exercise any of these rights, email us at hello@rentsignal.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data lawfully.

9. Security

We take reasonable technical and organisational measures to protect your personal data, including encrypted transmission (TLS), HTTP-only session cookies, and hashed authentication tokens. We do not store passwords.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "last updated" date at the top of this page. We will notify registered users of any material changes by email.

11. Contact

Clever Bunny Ltd
Registered in England and Wales · Company No. 10117606
hello@rentsignal.co.uk