Data processing agreement.

Version 1.2 · 22 October 2026

This agreement is between LeadsAfterDusk Ltd, company number 17488984, registered office 66 Paul Street, London EC2A 4NA, registered in England and Wales ("we", "us", the processor), and the estate or letting agency whose authorised person accepts it ("you", the controller).

How it is agreed. It is accepted in the LeadsAfterDusk dashboard by an owner of your agency's account, who confirms they are authorised to accept it on your behalf. UK GDPR allows this contract to be made in electronic form (Article 28(9)). We keep a record of who accepted which version and when, and you can ask us for a copy of that record, or for a copy of this agreement signed by us, at any time.

It forms part of our Terms of Service. Where the two differ on anything to do with personal data, this agreement wins.

---

1. Definitions

• Data Protection Law means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended (including by the Data (Use and Access) Act 2025), and, only where it applies to the processing, the EU GDPR.
• Controller, processor, personal data, data subject, processing, personal data breach and special category data have the meanings they have in the UK GDPR.
• Enquiry Data means the personal data we process on your behalf, described in Annex 1.
• Connected Mailbox means a branch inbox you connect to the service through Google or Microsoft, and Connected Calendar a calendar you choose for viewing times.
• Look Back means a one-off report, started by someone at your agency, of the property enquiries a Connected Mailbox received in the 60 days before it was started and how quickly your team answered them (clause 5.3).
• Dashboard means your agency's account at leadsafterdusk.com/sign-in.
• Sub-processor means another processor we engage to process Enquiry Data.
• Working day means a day other than a Saturday, Sunday or bank holiday in England.

2. Roles

2.1 You are the controller of Enquiry Data. You decide which mailboxes we answer, what replies may say, whether they are sent, held for approval or not written at all, and how long records are kept. We are your processor and process Enquiry Data only to provide the service to you.

2.2 We are a controller in our own right for our own business records: your staff's sign-in accounts, billing, our correspondence with you, and visitors to our website. Our privacy policy covers those. This agreement does not.

2.3 Your email and calendar provider (Google Workspace, Gmail or Microsoft 365) is your supplier, not ours. Data that stays in your mailbox and calendar, including replies and drafts we place there for you, remains in your systems under your arrangements with that provider.

2.4 We will not decide the purposes of processing Enquiry Data. If we ever did, we would be a controller for that processing under Data Protection Law (UK GDPR Article 28(10)) and liable as one.

3. Your instructions

3.1 We process Enquiry Data only on your documented instructions, including as to transfers outside the UK, unless UK law requires us to do otherwise. If it does, we will tell you before we process, unless the law forbids that.

3.2 Your instructions are:

• this agreement and our Terms of Service;
• the settings you choose in the Dashboard: which branches and mailboxes are connected and which branch each shared mailbox's enquiries belong to; office hours and closed days; automatic reply hours; away mode and holiday mode; how replies are sent (automatic, held for approval, off, or watch-only Shadow mode); whether replies follow the enquirer's language; whether complaints get a holding reply; whether replies offer viewing times, which calendar they come from and your viewing hours; the areas you cover, your services, tone, sign-off, what to always mention and never say, viewing information, listings, common questions and answers; your do-not-contact list; and the status of each enquiry;
• each Look Back someone at your agency starts; and
• any further instruction an owner of your account gives us in writing, including by email.

3.3 We will tell you immediately if, in our opinion, an instruction infringes Data Protection Law, and we may decline to carry it out until you confirm or change it.

4. Your responsibilities as controller

You are responsible for:

4.1 Lawfulness. Having a lawful basis for us to process Enquiry Data for you, usually your legitimate interests in answering people who contact you, or taking steps at their request before a contract. That includes Look Back, which looks at enquiries you received before you started using the service.

4.2 Transparency. Your privacy notice telling enquirers that their enquiries may be handled by a service provider on your behalf, that replies may be written by an automated assistant, and that the time taken to answer them may be measured.

4.3 Your mailbox and your staff. Being entitled to connect each Connected Mailbox and Connected Calendar, and telling the people who use or write to those mailboxes, including your own staff, that messages are read automatically by a service provider and that the time your staff take to answer enquiries is recorded.

4.4 What replies say. The company information and rules you enter, which replies repeat. Do not put special category data or other people's personal data in your settings. You remain responsible for your communications with the public under the law that applies to estate and letting agents, including consumer protection law and your redress scheme's code, and under PECR for any marketing you send.

4.5 Requests and complaints. Answering requests and complaints from the people whose data it is. We help as clause 10 says.

5. What we process and how

5.1 The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are set out in Annex 1.

5.2 Mailbox access. To work, the service needs permission to read messages in each Connected Mailbox and to write and send replies from it. For Google that is the gmail.modify permission (once Google approves them, the narrower gmail.readonly and gmail.compose) and, for calendars, calendar.freebusy; for Microsoft it is Mail.ReadWrite, Mail.Send, Calendars.Read and User.Read. Those permissions cover the whole mailbox, so we limit what we actually do with them. We:

• read messages as they arrive in the inbox once it is connected (after an interruption we look back no more than an hour), plus the thread of an enquiry, to see whether your staff have already replied, and drafts we created, to see whether they were sent;
• check each new message first with fixed rules (automated senders, mailing lists and your own colleagues are skipped) and then, if still needed, with the AI model, to decide whether it is a property enquiry;
• keep nothing from a message that is not an enquiry, except its message identifier and the outcome ("not an enquiry"), which we keep for 30 days so it is never processed twice. There are two exceptions, because a person at your agency needs to see them: a message reporting an urgent problem with a property (for example no heating, a leak or a smell of gas) and a complaint are recorded for your team, with the sender and the message, as if they were enquiries, and flagged;
• do not keep or answer messages written in vulgar or abusive language, unless they are a complaint, which is recorded as above; they stay in your inbox for your team;
• record anyone who asks not to be contacted on your do-not-contact list, even if their message is not an enquiry;
• do not inspect or keep attachments (Google and Microsoft send them to us as part of the whole message, which we hold only in memory while it is checked);
• never delete, move or archive your email; and
• never read older messages, other folders, contacts or files, except for a Look Back you start (clause 5.3).

5.3 Look Back. When someone at your agency starts a Look Back for a Connected Mailbox, we read the messages that arrived in its inbox in the 60 days before (at most 2,000), apply the same rules and AI model as clause 5.2 to find the property enquiries among them, and check each enquiry's thread for your team's first reply. Look Back only reads: it sends nothing, drafts nothing, changes nothing in the mailbox and adds nothing to your live enquiries. For each enquiry it finds we keep only: when it arrived and whether that was outside your office hours, its type, whether and when your team first replied, whether it asked for a viewing or a valuation, how it was classified, and the sender and subject line as they appeared in the email. We do not keep its body or attachments. For every message it read we keep its identifier and the outcome, so a report is never counted twice. The report's totals are counts only, but in a small branch they could relate to identifiable people, so we treat them as Enquiry Data too. Clause 14.1 says how long each of these is kept.

5.4 Calendars. We use only whether times in a Connected Calendar are free or busy, to offer viewing times. For Google calendars that is all we receive. Microsoft's calendar service also returns the titles and locations of busy appointments with that answer; we discard them without storing or using them. We never write to your calendar.

5.5 Viewing holds. When a reply offers specific viewing times, we note in our own database which enquiry they were offered to, for 12 hours, so that the same times are not offered to someone else writing at the same time. A hold is not a booking: nothing is written to your calendar, replies never say a time is booked or reserved, and every viewing is still confirmed by your team.

5.6 Shared mailboxes. Where one mailbox serves several branches, we decide which branch each enquiry belongs to from what it says and from the routing rules you set, and we remember which branch a sender's earlier enquiries went to (their email address and that branch), so their next message goes to the same place.

5.7 Free text and special category data. Enquiries are written by members of the public and can contain anything, including special category data, such as a health condition or a bereavement mentioned while explaining a move. We do not ask for it, do not use it to make decisions about anyone, and process it only as part of replying to the enquiry. You must not instruct us to process special category data deliberately.

5.8 AI processing. Enquiries are classified, and replies written, by Google's Gemini model running on Google Cloud Vertex AI in Google's London region, under our Google Cloud agreement. Look Back uses the same model in the same way. Google does not use Enquiry Data to train its models. We have switched off Google's default in-memory caching of AI inputs (which otherwise keeps them for up to 24 hours). If Google's automated safety systems flag a request as possible misuse, Google may keep that request for up to 30 days, in the same region, solely to check it against its usage policies. The model is told to treat everything in an email as information, never as instructions.

5.9 Replies are not labelled as automated. Unless an enquirer asks, replies do not say they were written by an automated assistant; if asked, the reply says so honestly. If you want every reply to say so, add a sentence to the "Always mention" setting, or ask us.

5.10 No significant automated decisions. The service writes replies and sorts enquiries. It does not make any decision about a person that produces legal or similarly significant effects. For enquiries about valuations, fees and quotes, legal matters, mortgages, chains, leases, tenancy matters, complaints, areas you do not cover, and any topic you ask us to add, the AI does not attempt an answer: its reply tells the enquirer a colleague will be in touch, and the enquiry is flagged for your team.

5.11 No other use. We do not use Enquiry Data for our own purposes: not for advertising, not to build profiles, not to train any AI model, and we never sell it. Where we use Google APIs, our use of the information follows the Google API Services User Data Policy, including its Limited Use requirements.

6. Confidentiality and our people

6.1 Everyone we allow to access Enquiry Data is bound by a duty of confidence that continues after they stop working with us (in writing, for anyone who is not one of our directors), and is given only the access their work requires.

6.2 Our people do not read Enquiry Data except where you have asked or agreed, for example to investigate a problem you report; where it is necessary for security, such as investigating a fault or abuse; or where the law requires it. Today access is limited to named personnel of LeadsAfterDusk. We do not put Enquiry Data into tools or services that are not listed in Annex 3, including AI assistants we use to build the service.

7. Security

7.1 We implement and maintain appropriate technical and organisational measures to protect Enquiry Data, as UK GDPR Article 32 requires. They are described in Annex 2.

7.2 We review them regularly and may change them as the service develops, but never in a way that materially reduces the protection of Enquiry Data.

8. Sub-processors

8.1 You give us general written authorisation to use the sub-processors listed in Annex 3.

8.2 Before we add or replace a sub-processor we will tell you by email at least 30 days in advance, saying who it is, what it will do and where. You may object on reasonable data protection grounds within 14 days of that notice. If you do, we will work with you in good faith on an alternative. If we cannot agree one, you may end the affected part of the service without penalty before the change takes effect, and we will refund any fees you paid for the period after it ends.

8.3 Each sub-processor is bound by written terms that give Enquiry Data at least the protection this agreement does, including sufficient guarantees of appropriate security.

8.4 We remain fully responsible to you for the acts and omissions of our sub-processors as if they were our own.

9. Transfers outside the UK

9.1 Enquiry Data is stored in the United Kingdom, and the service that processes it runs there: the application and the AI model in Google Cloud's London region, and the database in Supabase's London region. Traffic between browsers, Google, Microsoft and our application passes, encrypted, through Cloudflare's network, normally through its London data centres, without being stored there. Access from outside the UK happens only as clause 9.2 describes.

9.2 Our sub-processors are headquartered outside the UK, and their staff may need to access systems from outside the UK to support or secure them; Cloudflare may also route traffic through a data centre outside the UK if its London data centres are unavailable. Any such transfer is covered by a safeguard permitted by Data Protection Law, as listed for each sub-processor in Annex 3. We will not transfer Enquiry Data outside the UK in any other way without your prior written authorisation.

10. Helping you with individuals' requests and complaints

10.1 If someone asks us, rather than you, to access, correct, delete, restrict or port their data, or objects to its use, or complains about it, we will not answer for you. We will pass it to you within 5 working days and tell them we have.

10.2 We will help you answer, taking into account what we process. Within 10 working days of your request we can:

• give you everything held about an email address at your agency, including its Look Back records, the viewing times it was offered and whether the router remembers it, in a structured, machine-readable format;
• correct it;
• delete it, everywhere we hold it; and
• add the address to your do-not-contact list, so that no automatic reply is sent to it again.

10.3 When we delete someone at your request, their address stays on your do-not-contact list unless you ask us to remove it too, so that deleting them cannot lead to them being contacted again. Nothing else about them is kept.

11. Helping you with your other obligations

We will give you reasonable help, taking into account what we process and the information available to us, with:

• security of processing (Article 32);
• notifying personal data breaches to the Information Commissioner and to the people affected (Articles 33 and 34);
• data protection impact assessments, including a description of the processing and our measures (Article 35); and
• consulting the Information Commissioner before processing (Article 36).

We will tell you promptly about any request, complaint or enquiry we receive from the Information Commissioner or another regulator about Enquiry Data, unless the law forbids it.

12. Personal data breaches

12.1 If we become aware of a personal data breach affecting Enquiry Data, we will tell you without undue delay, and in any case within 48 hours, so that you can meet your own 72-hour deadline. We will tell you what we know at the time, and more as we learn it:

• what happened and when;
• the categories of data and, approximately, the number of people and records affected;
• the likely consequences;
• what we have done and propose to do to deal with it and reduce its effects; and
• who you can contact at LeadsAfterDusk about it.

12.2 We will take reasonable steps straight away to contain it, work with you on your response, and keep a record of it. Telling you about a breach is not an admission of fault.

12.3 We will not notify the Information Commissioner, the people affected or anyone else about a breach of Enquiry Data on your behalf unless you ask us to in writing or the law requires it.

13. Records, information and audits

13.1 We keep the records of processing that UK GDPR Article 30(2) requires of a processor, and will give you the parts that concern you on request.

13.2 We will give you the information you reasonably need to show that we meet our obligations under Article 28, including answering a reasonable security questionnaire once a year at no charge.

13.3 If that information is not enough, you, or an independent auditor you appoint who is not our competitor and is bound by confidentiality, may audit our compliance with this agreement once in any 12 months, on 30 days' written notice, during working hours, and without disrupting the service or other customers' data. These limits do not apply where the law or the Information Commissioner requires an audit or inspection, after a personal data breach affecting you, or where you have reasonable evidence that we are materially failing to meet this agreement. Each of us pays its own costs, except that we will pay yours if the audit finds that we have materially failed to meet this agreement.

14. How long we keep Enquiry Data, and deleting it

14.1 While you use the service. We keep Enquiry Data only as long as your instructions require. Deletion is done by a clean-up that runs every day, so each item goes on the first run after its time is up:

• Enquiries, with their messages, viewings and outcomes (including urgent property problems and complaints recorded under clause 5.2), are deleted 24 months after they arrived, unless you tell us in writing to use a different period (between 1 and 120 months).
• Your do-not-contact list is kept while you use the service, so that people who have asked not to be contacted are not contacted again.
• Message identifiers and outcomes for new messages we have processed are deleted 30 days after we first processed them.
• Look Back: each enquiry it found (clause 5.3) is deleted 90 days after the enquiry arrived; the identifier and outcome of each message it read 90 days after it was read; a report's totals 13 months after the report.
• Viewing holds (clause 5.5) end after 12 hours and are deleted 7 days after that.
• Shared-mailbox routing (clause 5.6): a remembered sender is deleted 24 months after their last message.
• Our technical logs contain no message content, and refer to mailboxes, messages and enquiries only by one-way references, never by address or identifier. They are deleted after 30 days.

14.2 Disconnecting a mailbox. An owner of your account can disconnect any Connected Mailbox at any time from the Dashboard. We then stop reading it straight away (a message already being handled at that moment may still be completed), delete our stored access token, stop the provider notifying us about it and, for Google, withdraw the permission at Google as well. If the provider cannot be reached at that moment the Dashboard tells you, so that you can remove LeadsAfterDusk in that account's security settings yourself. For Microsoft, which offers no way for an app to withdraw one mailbox's permission, you can also remove LeadsAfterDusk from your Microsoft account. When you archive a branch we stop reading its mailbox straight away and disconnect it in the same way at the next daily run; if the provider cannot be reached we try again each day for up to 7 days, then delete our access token regardless. Enquiries already recorded stay in the Dashboard until deleted under clause 14.1 or 14.3.

14.3 When the service ends. At your choice, we will give you a copy of your Enquiry Data, in a structured, commonly used, machine-readable format, and then delete it, or simply delete it. Tell us which before the service ends or within 30 days afterwards; if you do not, we delete it. We stop reading every Connected Mailbox and Calendar when the service ends and disconnect them as clause 14.2 describes for an archived branch, and we delete all Enquiry Data within 30 days of the service ending. Any copy in our database provider's backups is overwritten within a further 7 days as those backups expire. We do this automatically; you do not need to ask. We will confirm deletion in writing if you ask.

14.4 We keep Enquiry Data for longer only where UK law requires us to, and then only for as long as it requires and only for that purpose.

15. Liability

15.1 Each of us is responsible for its own compliance with Data Protection Law. Nothing in this agreement limits the rights of the people whose data it is, or either party's liability to them or to the Information Commissioner.

15.2 As between you and us, and subject to clause 15.3, where both of us are liable for the same damage each bears the share that corresponds to its part in causing it (UK GDPR Article 82), and our total liability to you arising from this agreement or from our processing of Enquiry Data, including any claim to recover our share of compensation, is limited to the greater of £5,000 and the fees you paid us in the 12 months before the claim arose. This limit replaces, for those claims, the general limit in our Terms of Service, and the exclusions in those Terms (for example of lost profits) still apply.

15.3 The limit in clause 15.2 does not apply to liability arising from our fraud or deliberate breach of this agreement, or from our processing Enquiry Data for our own purposes rather than on your instructions. Nothing in this agreement limits or excludes liability for death or personal injury caused by negligence, or anything else that cannot be limited or excluded by law.

16. Duration and ending

This agreement applies for as long as we process Enquiry Data for you, and its obligations continue until all Enquiry Data has been deleted under clause 14.

17. Changes to this agreement

We may update this agreement where Data Protection Law, a regulator's guidance, a sub-processor change under clause 8, or a change to the service requires it. We will tell you by email at least 30 days before any change that materially affects you, and an owner of your account will be asked to accept the new version in the Dashboard. If you do not accept it, you may end the service before the change takes effect without penalty. We will not make a change that reduces the protection of Enquiry Data unless the law requires it.

18. General

18.1 Notices to you go to the email address of your account's owner. Notices to us go to hello@leadsafterdusk.com. Email counts as writing.

18.2 Only you and we have rights under this agreement; nobody else may enforce it under the Contracts (Rights of Third Parties) Act 1999. This does not affect anyone's rights under Data Protection Law.

18.3 If any part of this agreement is found unenforceable, the rest continues to apply.

18.4 This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

---

Annex 1 — Details of the processing

Subject matter. Answering and recording the property enquiries that arrive in your Connected Mailboxes, and, when you ask, reporting on the enquiries they received before.

Duration. For as long as you use the service, and until deletion under clause 14.

Nature and purpose. Processing is continuous and automated. For each branch:

1. Reading new messages as they arrive in the Connected Mailbox's inbox.
2. Deciding whether each is a property enquiry: fixed rules first, then the AI model if still needed. For a message that is not an enquiry we keep none of its content, only its identifier and that result for 30 days, except urgent property problems and complaints, which are recorded for your team (clause 5.2).
3. Recording each enquiry: the enquirer's details, the property and their message, and noting whether it arrived outside your office hours (including while holiday mode is on).
4. For a shared mailbox, deciding which branch each enquiry belongs to, and remembering which branch a sender's enquiries go to (clause 5.6).
5. Recording opt-outs: anyone who asks not to be contacted is added to your do-not-contact list and not replied to.
6. Writing a reply in your agency's name from the information and rules you give us, and, within your reply hours (or at any hour while holiday mode is on) and according to your reply setting, sending it from the Connected Mailbox or saving it there as a draft for your staff. Replies are checked before automatic sending and held as drafts if they contain a link, price, phone number or email address that we did not expect. Enquiries on topics a person must handle get a reply saying a colleague will be in touch and are flagged for your team. If writing a reply fails repeatedly, then where replies are sent automatically a short holding reply is sent instead; otherwise nothing is sent. Either way, if the enquiry had already been recorded it is flagged for your team, and the email itself stays in your inbox.
7. Offering free viewing times from a Connected Calendar's free and busy information, and holding offered times for 12 hours so that they are not offered to two people at once (clause 5.5).
8. Checking whether your staff have already replied, so that the service does not reply on top of them, and, in Shadow mode, recording when they first replied (never what they wrote).
9. Showing enquiries, replies, viewings and outcomes to your staff in the Dashboard, and drafting a weekly summary of counts (no personal data) in your own mailbox.
10. Applying limits that stop automatic replies to automated senders and to unusual volumes from one address.
11. When someone at your agency starts one, a Look Back report of the previous 60 days (clause 5.3).

Categories of data subjects.

• Members of the public who send a property enquiry to a Connected Mailbox, or who sent one in the 60 days before a Look Back.
• Tenants and others who report an urgent problem with a property or make a complaint.
• Anyone else who sends a message to a Connected Mailbox's inbox, but only for the moment it takes to decide that the message is not an enquiry (none of its content is kept; see step 2 above).
• People named or described in an enquiry, such as a partner or family member.
• Your staff, as named in replies, as senders in enquiry threads, and through the time they took to reply.

Categories of personal data.

Special category data. None is requested or required. It may appear in free text written by enquirers (clause 5.7).

---

Annex 2 — Technical and organisational measures

Separation between agencies. Every table holding Enquiry Data is protected by database row-level security. A dashboard user's queries run as that user, and the database, not the application, decides what they can see, so one agency cannot read or change another's data even if the application were wrong. Tables only our backend needs (such as Look Back's working records, viewing holds and access tokens) cannot be read by any dashboard user at all. These rules are covered by automated tests.

Least privilege inside your agency. Connecting and disconnecting mailboxes, archiving branches and changing how replies are sent are limited to your account's owners. Staff see only the branches they are assigned to. No dashboard user can change an enquirer's contact details or see a mailbox access token.

Sign-in. Passwords are held only as secure hashes by our authentication provider. Optional two-step sign-in by an emailed code is available to every user (authenticator-app sign-in is used for our own administrators); only a one-way hash of an emailed code is stored, and codes expire within minutes. Sessions must sign in again after 30 days.

Mailbox access. We ask Google and Microsoft only for the permissions the service needs, and check that the account that was connected is the branch mailbox you configured: any other account is refused and nothing is saved. The link used to connect is signed and expires after 10 minutes. Access tokens are held only by our backend, in a table no dashboard user can read, encrypted with AES-256-GCM under a key held separately in Google Secret Manager, and are deleted when you disconnect (clause 14.2).

Encryption. All data is encrypted in transit with TLS (HTTPS only, with HSTS). Data at rest is encrypted by Google Cloud and Supabase with AES-256.

Our own access. Access to production systems is limited to named personnel, each protected by multi-factor authentication. Application credentials are held in Google Secret Manager, never in source code, and are rotated if exposure is suspected. People read Enquiry Data only as clause 6.2 allows.

Application security. Our backend accepts notifications and scheduled tasks only when they are signed by Google or carry the secret agreed with Microsoft for that mailbox, accepts dashboard requests only with a valid session from our own website, answers with strict security headers, and never sends access tokens to a browser. Our website sends a strict content security policy and cannot be framed by other sites. Text from the public is passed to the AI model marked as untrusted information, never as instructions, and automatic replies are checked for links, prices, phone numbers and email addresses before sending.

Logging. Operational logs record what happened, not what was written: they never hold message content, and refer to mailboxes, messages and enquiries only by one-way references, never by address or identifier. They are kept for 30 days.

AI. The AI model runs in Google's London region, is not trained on Enquiry Data, and has Google's input caching switched off (clause 5.8).

Resilience and recovery. The application is stateless and can be redeployed from source at any time, and the database's structure is kept in version control. Failed messages are retried automatically, and a holding reply is sent if replying repeatedly fails, so that an outage is not an enquirer's silence. Viewing holds are enforced by the database itself, so two replies written at the same moment cannot hold the same time.

Abuse and volume limits. Automatic replies are never sent to automated senders, and limits on replies per person, per branch and per agency contain the damage from a mistake or an abusive sender.

Testing and change. Every change is covered by an automated test suite, which is run before each deployment.

Deletion. Deletion and disconnection under clause 14 are carried out automatically by daily scheduled jobs in the database. Individual access and erasure requests are handled with dedicated routines that cover every place an email address is held (clause 10.2).

Incidents. Suspected personal data breaches are assessed straight away, contained, recorded and reported to you as clause 12 says.

---

Annex 3 — Sub-processors

Not sub-processors. Your own email and calendar provider (clause 2.3). The portals that send you enquiries (Rightmove, Zoopla, OnTheMarket), which are your suppliers. Stripe, which takes card payments and never receives Enquiry Data. Google Workspace, which delivers our own emails to your account's users (sign-in codes and account notices) and never receives Enquiry Data.

---

Version history: 1.2, 22 October 2026: the sign-in paragraph now says customer two-step sign-in is by emailed code, to match the product (authenticator-app sign-in is used for our own administrators). 1.1, 21 October 2026: describes Look Back (clauses 5.3 and 14.1), urgent property problems and complaints recorded for your team (5.2), viewing holds (5.5), shared-mailbox routing (5.6), holiday mode and Shadow mode as instructions (3.2), the mailbox permissions actually requested (5.2), Cloudflare as a sub-processor (Annex 3), retention for each kind of record (14.1), and requests that cover every copy (10.2). 1.0, 26 September 2026, first published version, which replaced the unpublished draft 0.1 of 25 September 2026.

See also our terms of service and privacy policy.