Privacy

Last updated 7 October 2026

SmartLord is run by Blue Corn Consulting Ltd, a company registered in England and Wales (no. 14406242). This notice explains, in plain English, what personal data we handle, why, and what you can do about it.

Two kinds of data, two roles

For your account — the details of you and the people you invite — we are the data controller. For the tenant and portfolio data you enter, you are the controller and we are your processor: we handle it only to run your workspace, on your instructions, under the processing terms in our Terms. If you are a tenant whose landlord uses SmartLord, your landlord is responsible for your data; please contact them first, and we'll help them answer you.

What we collect about you

• Account — your name, email, company name, a hash of your password, and the date you accepted these terms.
• Workspace content — the properties, companies, units, tenancies, tenants, transactions, certificates, documents and notes you enter or upload.
• Billing — your plan, subscription status and Stripe customer reference. Card details go straight to Stripe and we never see them.
• Security and technical logs — sign-in times, IP addresses and errors, needed to keep the service secure and working.
• Support — what you send us by email.
• Product analytics — only if you say yes: which screens are used and when something breaks, tied to your account id rather than your name or email. IP addresses are anonymised, there is no screen recording, and your tenant and portfolio data is never sent.

Why, and our legal basis

• To provide the service you signed up for (performance of a contract): running your workspace, sending the reminders and digests you switch on, taking payment, and answering support.
• To keep the service secure and improve it (our legitimate interests): security logs, fault diagnosis, and service messages about changes that affect you.
• Product analytics (your consent): you can say no when first asked, and change your mind at any time from the footer of any page or Settings → Account.
• Keeping billing records (legal obligation): tax law requires us to keep invoices and payment records.

We don't sell personal data, and we don't use your portfolio or tenant data to advertise to you or anyone else.

Who we share it with

The providers named on our Security page, each acting only on our instructions: Supabase (database, sign-in and file storage, UK region), Stripe (payments), Vercel (hosting), Resend (email) and PostHog (analytics, EU region, with your consent). We'll also disclose data where the law requires it — for example a court order — and we'll tell you unless we're not allowed to.

Where it goes

Your data is stored in the UK. Some of our providers are US companies, so some data — the pages served to your browser by Vercel, and the reminder and digest emails Resend sends, which can include tenants' names and amounts owed — may be processed outside the UK. Where that happens we rely on the safeguards UK data protection law recognises: the UK International Data Transfer Addendum in the provider's contract with us, or the provider's certification under the UK Extension to the EU-US Data Privacy Framework.

How long we keep it

• Your workspace — for as long as it's active, and for 12 months after it lapses (a trial that wasn't converted, or a cancelled plan), so you can come back. Then we delete it. Ask and we'll delete it sooner.
• Billing records — six years, as tax law requires.
• Security logs — up to 90 days.
• Analytics — pseudonymous; withdrawing consent stops collection and forgets the identifier on that device.

Your rights

You can ask for a copy of the personal data we hold about you, have it corrected or deleted, object to or restrict how we use it, take it elsewhere, and withdraw consent where we rely on it. Much of this is self-service: you can edit your account, export records to CSV at any time, and change your analytics choice from any page. For anything else, email isaac@corn.blue and we'll respond within a month. If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office at ico.org.uk, though we'd welcome the chance to put it right first.

Cookies and browser storage

We use the browser storage that's strictly necessary to keep you signed in and remember your preferences, which needs no consent. Product analytics stores a pseudonymous identifier in your browser and runs only if you've said yes. You can change your analytics choice at any time.

Children

SmartLord is a business tool for adults; it's not intended for anyone under 18.

Changes

We'll update this notice as the product develops and post the date of the latest version at the top. If a change materially affects you we'll email you first. Questions? Email isaac@corn.blue.