Padlord (padlord.co.uk) is a portfolio tracker for UK landlords, built and operated by BlooSprout Ltd, a UK company and the data controller for the personal data described here. This policy explains what data we hold, why, who processes it, and the rights you have under UK GDPR. The short version: your data is yours, we collect only what the product needs to work, and we never sell it or use it to build advertising profiles.
What we collect
- Account details. Your email address and sign-in credentials, managed by our authentication provider. We never see your password.
- Your portfolio. The properties, tenancies (including tenant names and optional email or phone), rents, mortgages, costs, compliance dates, notes and documents you add. You control all of it and can edit or delete it at any time.
- Assistant conversations. The messages you exchange with the built-in assistant, stored so you can pick up a thread where you left off.
- Technical basics. Standard server logs (such as IP address and browser type) kept by our hosting provider for security and reliability, and anonymous counts of clicks on our own short links (no cookies, no identifiers).
- One optional question. After signing up we ask, once, how you heard about Padlord. Answering is optional and the answer is stored against your account until you delete it.
If you use Padlord without an account (demo/local mode), your portfolio lives in your own browser's local storage and is never sent to us.
What we use it for
To run Padlord: showing your portfolio, calculating yields, cashflow and tax estimates, sending the compliance alerts you switch on, answering your assistant questions, and keeping the service secure. That's the whole list. The lawful bases are performance of a contract (providing the product) and our legitimate interest in keeping it reliable and secure.
Who processes it
We don't run our own data centres; a small set of services process data on our behalf, each for a specific job:
| Service | What it does | When |
|---|---|---|
| Supabase | Our database, authentication and document storage. Holds your account email and the portfolio data and documents you save. | Whenever you use Padlord with an account. |
| Vercel | Hosts the site and app, and provides anonymous, cookieless page-performance metrics (Speed Insights). | Whenever you visit. |
| AI model providers (Anthropic and OpenRouter) | Process the messages you send the assistant, along with the relevant parts of your portfolio needed to answer. | Only when you use the assistant. |
| Langfuse | Tracing that helps us find assistant errors and slow responses, designed to carry the minimum needed. | Only when you use the assistant. |
| Royal Mail AddressNow (Loqate) | Looks up UK addresses as you type so you can pick the right property. | Only when you search for an address. |
| Property data sources | Public and licensed property datasets (for example EPC and price data) queried by address or postcode to enrich a property. | Only when you look up a property. |
| Apify | Searches public listings when you ask the assistant to find local contractors. | Only when you use that feature. |
| Arcade (Google connectors) | Powers the optional Gmail and Google Calendar connectors, using the Google account you explicitly connect. | Only if you connect Google, and you can disconnect any time. |
| PostHog (EU-hosted) | Product analytics that shows us which pages and tools are used so we can improve them. | Only if you accept analytics cookies; rejecting stops it and clears its identifiers. |
The assistant and your data
When you ask the assistant a question, it may read the relevant parts of your portfolio to answer, and that context is sent to the AI model provider for that reply. Two deliberate protections: property access-code values are never shown to the AI (Marlow can see that a code exists, never what it is), and the assistant only ever prepares changes; nothing is written to your portfolio without your explicit confirmation.
Security and retention
Data is encrypted in transit, and database row-level security means your records are readable by your account alone. We keep your data while your account is active. Delete something and it's deleted; ask us to close your account and we'll remove your data.
Your rights
Under UK GDPR you can ask for a copy of your data, have it corrected or deleted, object to or restrict processing, and take your data elsewhere (Padlord has a built-in export for exactly this). You can also complain to the Information Commissioner's Office, though we'd rather you raise it with us first.
Cookies
Covered separately, in plain English, in our cookie policy.
Changes and contact
If this policy changes materially we'll update this page and the date above. Questions or requests? Email vaibhav@bloosprout.co.uk or see the contact page.