Privacy Policy

Last updated: 2 July 2026

1. Who is responsible for your data

Datestone is operated at datestone.io. You can reach us via the contact form at datestone.io/contact, and a person reads it. Contact: the contact form at datestone.io/contact. ICO registration: in progress.

2. What we collect

Account information. Your email address and sign-in details, handled by our authentication provider, Clerk. We don't see or store your password.

Property and tenancy information you enter. Addresses, property characteristics, tenancy dates and amounts, and the compliance answers you give. We deliberately don't ask for tenant names or contact details, and we ask you not to enter more personal information about other people than the service needs.

Documents you upload. Certificates and evidence you choose to store, kept to provide your evidence vault and compliance packs.

Free checker answers. If you use the public checker without an account, your answers are processed to show your result and are not stored unless you choose to save them by giving your email — nothing is saved without your say-so.

Technical information. Cookieless, privacy-respecting analytics and the server logs needed to run and secure the service.

Payments. Handled by Stripe. We never see or store your card number.

3. Why we use it, and our lawful bases

To provide the service you signed up for — reminders, obligation tracking, document storage, compliance packs (performance of our contract). To tell you about changes to the rules the service tracks where they affect your properties — these are service messages, not marketing (contract and legitimate interests). Marketing emails only if you opt in, each with an unsubscribe link (consent). To secure the service, prevent abuse and fix problems (legitimate interests). To improve the accuracy of the rules and licensing-coverage records the service tracks, using aggregated, area-level signals derived from how the service is used — never your identity, your address or your documents (legitimate interests). To meet our own legal obligations, such as tax and accounting records (legal obligation).

We do not sell personal data, and we never use your personal data to train AI models. We keep two kinds of AI strictly separate. The AI that monitors regulations reads only public government and council web pages — never your data — and may run on a third-party model provider for that public-source reading. The AI that reads a document you upload (for example, to read the dates on a certificate) is run only by Anthropic, our document-AI provider, solely to help you file it; your documents and personal data are never sent to the public-source model.

4. Who processes data for us

We use a small number of service providers under contract: Clerk (authentication), Neon (database hosting), Vercel (hosting and analytics), Stripe (payments), Resend (email delivery) and Anthropic (AI reading of documents you upload). Some of these providers process data in the United States; where they do, transfers are protected by the UK Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement, alongside each provider's own safeguards. We will disclose information where the law requires it.

5. How long we keep things

Account, property and tenancy data: while your account is active, then deleted within 30 days of closure. Uploaded documents: until you delete them, or 30 days after account closure. Checker answers you didn't save: not stored. Billing records: six years, as required for tax and accounting.

6. Your rights

You have the usual rights under UK data protection law: to access your data, correct it, delete it, restrict or object to our processing, and receive a portable copy. To exercise any of them, use the contact form at datestone.io/contact, and we'll respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to sort it out first.

7. Cookies

Essential cookies only — the ones needed to sign you in and keep the service secure. Our analytics are cookieless. No advertising cookies, no cross-site tracking.

8. Children

The service is for people aged 18 and over and is not directed at children.

9. Changes to this policy

We'll update this page when our practices change and, for material changes, tell you by email before they take effect.