Privacy Policy

This policy explains what personal data ConditionVault uses, why, who receives it, how long it is kept and the rights you have. It applies to our customers and their teams, to tenants, landlords and others who receive reports, and to visitors to our website.

1. Who We Are

ConditionVault is run by LYL SERVICES LTD, a company registered in England and Wales (number 16764707), whose registered office is 86-90 Paul Street, London, England, EC2A 4NE. We are registered with the Information Commissioner's Office under reference ZB576273.

For anything about your personal data, email support@conditionvault.app. We have not appointed a Data Protection Officer because the law does not require one for our business; the same address reaches the people responsible for data protection.

2. Our Two Roles

When we decide how data is used, we are the controller. This covers our customers' accounts and sign-in, billing, enquiries and support, security, our website and our own business records.

When we hold data for a customer, we are their processor. Letting agents, landlords, property managers and inventory clerks use ConditionVault to hold property, tenancy and inspection details. For that information the customer is the controller and we act only on their instructions, under Schedule 1 of our Terms of Service. If you are a tenant, landlord or other recipient of a report, the agent, landlord or clerk who sent it is responsible for your data. Please contact them first; we will help them answer you.

3. What We Collect

• Customers and their team members: name, email address, phone number, job title, company details, role and branch, profile photo and professional credentials if added, a saved signature if you choose to keep one, sign-in records and the actions you take in the app.
• Billing contacts: name, email, company and billing address, plan and payment status. Stripe takes card details; we never see full card numbers.
• Tenants, landlords, agents and other report recipients: the name, email address and phone number the customer enters; when you receive, open and review a report; each comment, photo, decision and signature you give, with the time; and the IP address and browser details of the device you used. We store the IP address encrypted, readable only by the organisation's owners and admins, together with a keyed hash used to match records. These records show who received, reviewed and signed which version of a report.
• People connected to a property: details a customer records in a report or tenancy, such as names, contact details, meter readings, keys and access arrangements, and photos that may show belongings or, occasionally, people.
• Website visitors and enquirers: what you send us through a form, a hashed form of your IP address to prevent misuse, and, only if you accept Google Ads cookies, whether your visit led to a sign-up or enquiry.

Most information comes from you or from the customer who uses ConditionVault for your tenancy or property. Google tells us your name and email address if you sign in with Google. Stripe tells us whether a payment succeeded.

4. How We Use It and Why

UK data protection law requires a lawful basis for each use. For data we hold as a processor, the customer chooses the basis and we follow their instructions.

Where we rely on legitimate interests, we have weighed them against your interests and rights. You can object at any time (see section 10). We do not use special category data for our own purposes, and the service is not designed to hold it.

5. ConditionAI

ConditionAI is an optional feature that suggests descriptions of an item's condition from photos, writes a room overview, compares check-in and check-out photos, and reads meters and appliance labels. It only runs when a user asks it to.

It sends the chosen photos, with the item, room and report-type labels, to the AI models Base44 provides, which come from OpenAI and Anthropic. From a report in ConditionVault it does not send names, contact details, addresses, signatures, access codes or private notes. Every suggestion, and everything read from an imported report, must be accepted or changed by a person before it goes into a report. ConditionAI makes no decisions about anyone, automated or otherwise.

Importing a report. A customer can import a report made in other software, or their own, to set up a property's rooms and descriptions. Its text is read in the customer's browser and sent to the same AI models to be sorted into rooms and items, exactly as uploaded, so it may include names, addresses or contact details that appear in it. The customer decides what to upload. The original file is not stored; we keep only the rooms, items and wording the customer checks and saves.

6. Who We Share It With

We use the providers below to run ConditionVault. Processors may use the data only to provide their service to us, under written terms that require them to keep it secure. Stripe, Google, OpenStreetMap and Unsplash decide for themselves how they use the data they receive, under their own privacy policies.

Reports go to the people the customer chooses to send them to. We may also disclose information if the law requires it, to protect people from harm, or to establish or defend legal claims. If our business is sold or reorganised, the buyer would take on this policy. We never sell personal data.

7. International Transfers

Some providers handle data outside the UK. Base44 is part of Wix.com Ltd, based in Israel, which the UK recognises as giving adequate protection. Base44's servers, and Resend, Browserless, OpenAI and Anthropic, are in the United States. For transfers to the United States we rely on the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with any additional measures needed. You can ask us for details of the safeguard for a particular transfer.

8. How Long We Keep It

We keep other records, such as billing, enquiries, data protection requests and security records, only as long as we need them for the purpose they were collected for, including any legal requirement. Deleted records leave backups as those backups expire on their normal cycle.

9. Security

Each organisation's data is kept separate and only its own team can reach it, according to their role. Data is sent over encrypted connections. Report links are private and hard to guess, issued reports are sealed with an integrity check so later changes can be detected, recipients' IP addresses are stored encrypted, and important actions are recorded in an audit trail. If a breach puts your rights at risk, we will tell you and the ICO as the law requires.

10. Your Rights

You have the right to:

• get a copy of your personal data;
• have inaccurate data corrected;
• have data deleted, where there is no good reason to keep it;
• restrict how we use it while a concern is looked into;
• object to uses based on legitimate interests, and to direct marketing at any time;
• receive data you gave us in a format you can reuse, where we rely on consent or contract;
• withdraw consent at any time, without affecting what happened before.

Some rights have limits. For example, a signed report may need to be kept as evidence for the tenancy. We answer within one month, or within three months for complex or numerous requests, in which case we will tell you within the first month. We may ask you to prove who you are. There is usually no charge.

If your request concerns a report, tenancy or property, we will normally pass it to the agent, landlord or clerk responsible and help them answer it.

11. Make a Request

Use the form below, or email support@conditionvault.app.

12. Complaints

Please tell us first so we can put things right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

13. Cookies

Our Cookie Policy lists every cookie and storage item we use and how to control them.

14. Changes to This Policy

We update this policy when our services or providers change. The version and date at the top show the current policy. We will tell customers by email about important changes, including new providers, before they take effect.