Clear control over uploaded report data.

Fair Deductions Ltd is the controller for account, contact, billing, security, service-administration, support and optional marketing data. For tenancy report content uploaded by a customer organisation, that customer normally decides why the review is carried out and is the controller; Fair Deductions acts as its processor. Stripe also acts as an independent controller for parts of payment, fraud-prevention and regulatory processing under its own notice.

We receive account, contact, organisation, user-type, consent and support details directly from users. Uploaded inventories, check-out reports and optional supporting case photographs may contain addresses, names, signatures, photographs, inspection notes and other information originally collected by the customer or its inventory provider. We also create processing status, evidence links, proposal suggestions, audit, usage, device, security and billing records.

We use account, service, support and ordinary billing records to enter into and perform the customer contract. We keep transaction and tax records to meet legal obligations. We use proportionate security, fraud-prevention, audit and service-improvement records for our legitimate interests in running and protecting the service. Optional marketing relies on consent and can be withdrawn. Where we are a processor, the customer is responsible for identifying its lawful basis for report content and Fair Deductions follows the customer's documented instructions.

When paid access is enabled, Stripe processes card details and payment authentication under its own privacy terms. Fair Deductions receives the customer, purchase, subscription, invoice and payment status needed to provide access, send an order confirmation, meet accounting duties and support the account. We do not receive or store full card numbers.

We use Vercel for hosting, Supabase for authentication, database and storage, OpenAI for report processing, Trigger.dev for background jobs, Resend for transactional email and Sentry for limited error monitoring. Namecheap provides domain and support-mailbox services. Google may also process support correspondence where the mailbox is accessed through a Gmail service. Stripe is used for paid billing. These providers may process data in the UK, EEA, United States and other countries. Where UK data is transferred without adequacy regulations, we rely on applicable contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum and carry out proportionate transfer checks. The current processing details and subprocessor authorisation are in the Data Processing Agreement.

Relevant report pages, extracted text and selected images are sent to configured AI services to support extraction, comparison and pricing guidance. OpenAI states that business/API data is not used to train its models by default. Fair Deductions disables response application-state storage where the API supports that setting. OpenAI may retain API customer content in abuse-monitoring logs for up to 30 days by default unless different approved data controls apply.

Uploaded reports, supporting case photographs and derived reviews are scheduled for deletion 120 days after upload unless the customer deletes them sooner. Deleting a review retains a minimal usage entry containing the customer account, allowance type and reservation date so the same allowance cannot be reused; it contains no report text, file, image, property address or pricing result. Account and consent records remain while the workspace exists. Transaction, invoice and tax records are normally retained for six years or longer where law, a dispute or an authority requires it. Security and support records are retained only for a documented period proportionate to their purpose.

A sole organisation owner can delete the workspace and login from Settings after any chargeable subscription has ended. The application removes active report files, derived case data and the account record, subject to short provider backup or deletion cycles and records we must retain by law. Cancelling a subscription does not itself delete the workspace, and deleting report content does not erase the minimal allowance ledger.

The service organises evidence and prepares an editable opening proposal. It does not make a solely automated legal or similarly significant decision about a tenant. Every proposed item and amount remains subject to the customer's human review, and the source reports remain authoritative.

We disclose personal data only to authorised users, the service providers needed to operate the product, professional advisers, payment providers, or public authorities where lawfully required. We do not sell tenancy-report content or personal data and do not use uploaded reports for advertising.

Depending on the circumstances, individuals may ask for access, correction, deletion, restriction, objection or portability, and may withdraw consent. Contact support@fairdeductions.co.uk. We may need to verify identity and will normally respond without undue delay and within one month once any reasonably requested identity or authority information is received. Where a customer organisation controls the report, we will refer the request to that organisation and assist it as required.

Send a complaint to support@fairdeductions.co.uk and describe what happened, the personal data or account involved and the outcome sought. We will acknowledge it within 30 days, take appropriate steps to investigate without undue delay, keep the complainant informed and provide a written outcome. This process does not prevent an individual from complaining to the Information Commissioner's Office.

Fair Deductions uses essential browser storage and cookies for account sessions, security and application preferences. The site does not currently install a separate advertising tracker. If optional analytics or marketing cookies are added, this notice and the consent controls will be updated first.