Privacy Policy

We process your personal information for the following reasons:

• —To facilitate account creation, authentication, and account management
• —To deliver and facilitate delivery of services to the user
• —To respond to user enquiries and offer support
• —To send you marketing and promotional communications in accordance with your preferences — you can opt out at any time
• —To post testimonials on our Services that may contain personal information
• —To protect our Services, including fraud monitoring and prevention
• —To evaluate and improve our Services, products, marketing, and your experience
• —To identify usage trends and better understand how our Services are being used
• —To comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights

Lawful basis for processing. We only process your personal information where we have a valid legal basis under UK GDPR Article 6. The bases we rely on are:

• —Performance of a contract — where processing is necessary to provide our Services (e.g. account management, delivering analyses)
• —Legitimate interests — where we have a legitimate business interest that is not overridden by your rights (e.g. security, fraud prevention, analytics, service improvement)
• —Consent — for marketing communications (you may withdraw consent at any time)
• —Legal obligation — where processing is required to comply with applicable law

We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf. We have contracts in place with our third parties designed to safeguard your personal information.

The categories of third parties we may share personal information with include:

• —Cloud Computing Services
• —Data Storage Service Providers
• —Data Analytics Services
• —Website Hosting Service Providers
• —Performance Monitoring Tools
• —User Account Registration & Authentication Services
• —Sales & Marketing Tools
• —AI Platforms (including Anthropic)

Business Transfers. We may share or transfer your information in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

International transfers. Some of our third-party service providers are based outside the UK, including in the United States (Anthropic, Vercel, Stripe, Supabase). When we transfer personal data outside the UK, we ensure appropriate safeguards are in place — typically Standard Contractual Clauses (SCCs) approved by the relevant authority, or transfers to countries with an adequacy decision. By using our Services you acknowledge that your data may be processed in these countries.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some tracking technologies help us maintain security, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

We also use Microsoft Clarity — a behavioural analytics tool that records session activity including mouse movements, clicks, and scrolling to help us understand how users interact with the site. Clarity may capture content you view or type. You can opt out via Microsoft's privacy controls at privacy.microsoft.com.

We use Google Analytics to collect aggregated information about how visitors use our Services. This includes pages visited, session duration, and device type. Google's privacy policy is available at policies.google.com/privacy.

Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice.

Yes. As part of our Services, we offer products, features, and tools powered by artificial intelligence, machine learning, or similar technologies (collectively, 'AI Products').

We provide these AI Products through third-party service providers ('AI Service Providers'), including Anthropic. Your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

Our AI Products are designed for the following functions:

• —AI-powered property analysis
• —AI-generated investment research and deal discovery

All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreements with third parties.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law. No purpose in this notice will require us to keep your personal information for longer than the period of time in which users have an account with us.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it, or securely store it and isolate it from any further processing until deletion is possible.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18, or that you are the parent or guardian of a minor and consent to such minor's use of the Services.

If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data. If you become aware of any data we may have collected from children under age 18, please contact us at timothymillward@dealflow-ai.co.uk.

Withdrawing your consent: If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by contacting us. This will not affect the lawfulness of processing before its withdrawal.

Opting out of marketing: You can unsubscribe from our marketing emails at any time by clicking the unsubscribe link in the emails we send, or by contacting us directly.

Account Information: To review, change, or terminate your account, please contact us. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases, though we may retain some information where required by law.

Right to restrict processing: You have the right to request that we restrict the processing of your personal information in certain circumstances — for example, if you contest its accuracy or object to our processing.

Right to data portability: Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal information in a structured, commonly used, machine-readable format.

Right to object: You have the right to object to processing based on our legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for the establishment, exercise, or defence of legal claims.

Automated decision-making: Our Services use AI to generate property investment analysis. These outputs are informational only and do not constitute binding financial decisions. You have the right to request human review of any AI-generated assessment that significantly affects you, and to contest such assessments.

Cookies: Most web browsers accept cookies by default. You can set your browser to remove or reject cookies, though this could affect certain features of our Services. See our Cookie Notice for more information.

Right to complain to the ICO: You have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO), if you believe we have not handled your personal data in accordance with UK GDPR. You can contact the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We would, however, appreciate the chance to address your concerns before you contact the ICO.

If you have questions about your privacy rights, email us at timothymillward@dealflow-ai.co.uk.

Most web browsers and some mobile operating systems include a Do-Not-Track ('DNT') feature. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals. If a standard is adopted that we must follow in the future, we will inform you in a revised version of this Privacy Notice.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated 'Last updated' date at the top of this page. If we make material changes, we may notify you by posting a notice on the Services or by sending you a direct notification. We encourage you to review this Privacy Notice periodically.

If you have questions or comments about this notice, you may contact us at:

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information.

To request to review, update, or delete your personal information, please contact us at timothymillward@dealflow-ai.co.uk.