Privacy Policy

LuxProperty.ai is a trading name of LuxProperty AI Ltd, a company registered in England and Wales. When this policy refers to "we", "us", or "our", it means LuxProperty AI Ltd.

For questions about this policy, contact us at: hello@luxproperty.ai

LuxProperty.ai is designed as a low-data, self-serve platform. We collect the minimum data required to operate the service:

• Postcodes you look up — the postcode you enter is sent to our servers, where your brief is built from official UK data sources. Postcodes you look up are cached for up to 7 days so pages load faster, then deleted: a daily clean-up removes each entry within two days of it expiring. The cache holds the postcode (or its district) and the property data, not who looked it up. Sold-price records for a postcode district are cached the same way, keyed by the district, and deleted by the same clean-up. The sales recorded at a postcode, read for the property tab, are cached by postcode until HM Land Registry's next monthly release (at most about four weeks), and deleted by the same clean-up. Noise readings for an address chosen on the property tab are cached by map grid point rather than postcode, for up to 90 days, and are deleted by the same clean-up.
• Account details — if you create an account: your name, email address, a hashed password (we never store the password itself), your plan, whether your email address is verified and, if you pay, the Stripe references that link your account to your payments. Your email address is also used to send service emails such as address verification, password resets and Full Brief purchase confirmations.
• Feedback messages — if you send us a message through the feedback page, your name, email address and message are emailed to us and kept in our database so we can reply. They are not published and are not added to any mailing list. Each message is deleted 12 months after it was sent, by the same daily clean-up.
• Usage events — to understand how the site is used, we record anonymous usage events: what happened (for example a brief being viewed, an address being chosen on the property tab, a visitor without an account being asked to create one before seeing a home's range, or a Full Brief unlock or checkout being started), which tab of the brief was open, the postcode district (such as "E8") and the time. For each estimated range looked up we also record whether a range was shown, and whether the Land Registry lookup failed, took over five seconds or was answered from our cache. No full postcode, address, IP address or account is recorded with these events.
• Daily limits — to stop automated overuse, we count how many free briefs, property lookups and usage events come from each IP address each day (briefs and lookups on a paid plan or a bought Full Brief are not counted). Each count is kept against a scrambled form of the IP address (a keyed hash, so the address can't be read back from it), never the address itself, with the day and the number. Each count is deleted after two days, by the same daily clean-up.
• Payment data — a Full Brief is a one-off £9.99 payment for one postcode district, not a subscription; the Investor plan, and the Professional plan held by existing subscribers (it is no longer sold), are monthly subscriptions. Payments are processed by Stripe, and we do not store card details; Stripe's privacy policy applies to payment data. For each Full Brief we keep a purchase record against your account: the postcode you bought it for, its district, the amount, the date, when you confirmed that you wanted access straight away, and Stripe's reference for the payment.
• Usage analytics — we use two tools, and neither receives a full postcode: wherever a postcode appears in a page address or an event, it is reduced to its district (such as "E8") before it is sent. Vercel Web Analytics counts page views without setting cookies: for each page view Vercel records the page address, the referring page, an approximate location, and your browser, operating system and device type, and it tells visits apart with a hash of the request that it discards after 24 hours. Google Analytics 4 loads only if you click Accept on the cookie banner; until then no Google Analytics code runs and nothing is sent to it. After you accept, Google receives your IP address, the pages you visit and the events we send it (for example a brief being generated or a checkout being started), and Google Analytics sets cookies that can be linked to your browser or device. We do not use a Google Ads tag, and Google's advertising signals are turned off.

We use the data we collect to:

• Generate property reports in response to your search queries
• Process your payments: a one-off Full Brief purchase, or a monthly subscription
• Send service emails such as address verification and password resets
• Improve the platform based on anonymised usage patterns
• Comply with legal obligations

Our legal basis

• Contract: to provide the service you ask for, including building briefs and estimates, running your account, taking payments and sending service emails.
• Legitimate interests: to run, protect and improve the service, through usage events, daily limits, caching, Vercel Web Analytics and keeping feedback messages so we can reply.
• Consent: Google Analytics, which only runs after you click Accept. You can withdraw consent at any time.
• Legal obligation: keeping purchase records for tax.

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

Briefs and the property tab are built from these public sources, named in the brief beside each figure. They cover England and Wales; where a source covers only one nation, the brief says so.

• HM Land Registry Price Paid Data — sold prices, price trends, street rankings and the sold-prices map; on the property tab, the sales recorded at the address. Crown copyright, Open Government Licence v3.0.
• Postcodes.io — the postcode lookup, and map positions for sold prices.
• MHCLG EPC Register — energy certificates, for the area and for the address.
• Environment Agency — Risk of Flooding from Rivers and Sea and Flood Map for Planning (NaFRA2), flood warning and alert areas, live flood warnings, the Historic Flood Map, and National Coastal Erosion Risk Mapping 2024 (England only).
• Mining Remediation Authority — coalfield consultation and development risk areas.
• MHCLG Planning Data platform (planning.data.gov.uk) — conservation areas, Article 4 directions and other planning designations (England only).
• Historic England, National Heritage List for England and Cadw, Listed Buildings (DataMapWales) — listed buildings, on the property tab.
• Defra strategic noise mapping, Round 4 (England) and Welsh Government, Environmental Noise Mapping 2022 (DataMapWales) — modelled noise, on the property tab.
• OS Open UPRN — the building's position, for readings taken at the address.
• data.police.uk — street-level recorded crime.
• ONS Price Index of Private Rents — rents and letting economics.
• ONS Census 2021, table TS044, via Nomis — the mix of property types.
• MHCLG council tax levels and Welsh Government council tax levels — council tax charges by band.
• Ofcom Connected Nations — broadband coverage by postcode.
• DEFRA / ERG real-time air quality monitoring — air quality, where a monitoring station is in range.
• OpenStreetMap — stations, schools, shops, amenities and parks nearby.
• Ofsted — links to school inspection reports in England.
• Transport for London (TfL) Journey Planner — journey times in London.
• Valuation Office Agency, Building Safety Regulator and HM Land Registry lease copies — linked on GOV.UK from the property tab; nothing is read from them.

These sources describe places and properties. None of them names a property's owner.

If you save a brief to your portfolio, it is stored in our database (Supabase, hosted in the EU, in Paris) against your account: the postcode, the area name, a copy of the brief as it was when you saved it, and the date you saved it. You can delete a saved brief at any time from your portfolio page; deleting it removes it from our database.

Your browser keeps your sign-in session and your cookie-banner choice in local storage on your device. If you use your free brief without an account, we set a cookie holding that brief's postcode so it can be linked to an account if you sign up. If you look up homes' estimated ranges without an account, we set a cookie that counts how many different homes you have looked up that day, up to five. It holds the date and a scrambled tag for each home, made so the address can't be read back from it; it holds no address or postcode. It lasts two days, and its count starts again each day. If you accept analytics cookies, Google Analytics sets its own cookies (see section 2). You can control cookies through your browser settings.

We use the following third-party services:

• Stripe — payment processing. Stripe's privacy policy governs how your payment data is handled.
• Vercel — website hosting. Vercel may log request metadata (IP address, user agent) as part of standard hosting operations.
• Resend — sends our account emails (address verification, password reset, the welcome email and Full Brief purchase confirmations) and delivers feedback messages to us. It receives the recipient's email address and the message. Our emails are sent from Resend's Ireland region (AWS eu-west-1); Resend stores customer data, including message content and delivery logs, in the United States, and its data processing agreement covers transfers from the UK with the UK Addendum to the EU Standard Contractual Clauses.
• HM Land Registry API — data fetched directly from the official Land Registry API in response to your search queries.

Some of the services we use process personal data outside the UK. For each one, this is where, and the safeguard its own terms rely on:

• Vercel (hosting, request logs and Web Analytics) — Vercel Inc. is based in the United States, and our server functions run in its Washington, D.C. region (iad1). Vercel states that it complies with the UK Extension to the EU-U.S. Data Privacy Framework. Vercel privacy notice
• Stripe (payments) — Stripe transfers personal data to Stripe, LLC in the United States. Stripe, LLC states that it complies with the UK Extension to the EU-U.S. Data Privacy Framework, and Stripe's terms also use the EU Standard Contractual Clauses with the UK International Data Transfer Addendum. Stripe data processing agreement
• Google Analytics (only after you click Accept) — Google may process Analytics data in any country where Google or its subprocessors maintain facilities. Google LLC states that it complies with the UK Extension to the EU-U.S. Data Privacy Framework. Google Ads Data Processing Terms
• Resend (email) — Resend stores customer data in the United States (our emails are sent from its Ireland region). Its data processing agreement uses the EU Standard Contractual Clauses as amended by the UK Addendum, and Resend states that it complies with the UK Extension to the EU-U.S. Data Privacy Framework. Resend data processing agreement
• Supabase (our database) — our database is hosted in Supabase's Paris region, in the EU; UK law treats countries in the European Economic Area as adequate. Supabase's data processing agreement allows it to process data wherever it or its sub-processors maintain facilities, and for transfers from the UK it uses the EU Standard Contractual Clauses with the UK Addendum. Supabase data processing agreement

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing of your data
• Ask us to restrict how we use your data
• Get a copy of the data you gave us in a format you can take to another service
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, email us at hello@luxproperty.ai. We will respond within 30 days.

If you're unhappy with how we've handled your data, please tell us first at hello@luxproperty.ai so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at any time: ico.org.uk/make-a-complaint or 0303 123 1113.

Account details are kept while your account is open. If you ask us to delete your account, we delete them, apart from purchase records.

Purchase records are kept for six years after the end of the financial year they relate to, because tax law requires it.

We retain personal data only for as long as necessary to deliver the service or as required by law. Anonymous usage data may be retained indefinitely.

We take reasonable steps to protect your data, including HTTPS encryption for all data in transit and restricted access to any stored personal data. However, no system is completely secure, and we cannot guarantee the absolute security of your information.

We may update this privacy policy from time to time. We will notify users of material changes by updating the "last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.

LuxProperty AI Ltd
Registered in England and Wales
Email: hello@luxproperty.ai