Privacy notice

• Your account: name, email address, how you sign in, your preferences and consents, and a WhatsApp number if you add one.
• Your deposit file: the tenancy agreement, inventory, checkout report, certificates, emails you forward to your deposit inbox, your photos with the date they were taken, and what you choose and approve.
• Other people in those documents: your landlord, agent, inventory clerk and joint tenants, with the details the documents hold about them.
• Payments: what you bought and when. Stripe holds your card details; we never see them.
• How you use the site, only if you accept analytics cookies (see Cookies).

Most of this comes from you. Details of other people come from the documents and emails you give us. You don’t have to give us anything, but we need your account details and documents to work on your deposit. MyDepositBack is for adults: we don’t knowingly collect information from anyone under 18.

• To provide the service you signed up for: reading your documents, comparing photos, drafting messages, tracking deadlines and reminding you (contract).
• To work out prices, refunds and any no-win-no-fee charge, and keep payment records (contract, and the law on tax records).
• To keep the service secure and working, and to improve it, including checking our AI against past results (legitimate interests).
• To send occasional news and offers, which you can turn off at sign-up, in Settings or in any of those emails (legitimate interests, under the rules for marketing to customers).
• Analytics and advertising cookies (your consent, which you can withdraw at any time).

The details of other people in your documents are used only to work on your deposit, for example to address a reply to your agent (legitimate interests).

AI reads your documents, photos and forwarded emails and drafts suggestions. To do that, what it reads is sent to AI model providers through OpenRouter. Depending on the provider, they may keep it for a time and may use it to train their models. We choose providers by cost and by how well they do each job, so the provider can change. Models that aren’t Anthropic’s get your information only through hosts in the United States that keep nothing once they’ve answered.

AI suggests; you decide. Nothing with a legal or similarly significant effect on you is decided by AI alone: you choose what to say and you send every message yourself.

We don’t sell your information, and we never contact your landlord or agent. These services process it for us:

• OpenRouter, and the AI providers it routes to: Reading documents, photos and emails, and drafting. Today the models are Anthropic’s (Claude) and DeepSeek’s. DeepSeek’s model runs only on hosts in the United States that keep nothing once they’ve answered and don’t use it to train models; it never goes to DeepSeek itself. We may switch to other models when they do the job as well for less.
• Railway: Hosting the site, the database and the background jobs.
• Cloudflare: Storing your documents and photos (private storage), domain and security.
• Resend: Sign-in links, our emails to you, and receiving emails you forward to your deposit inbox.
• Stripe: Payments and, with your consent, saving your card.
• Meta (WhatsApp): Reminders, only if you turn WhatsApp on.
• Google and Apple: Signing in, only if you choose them.
• Logfire and Sentry: Spotting errors and slow pages. Personal details are hidden in what they record.
• RudderStack, Google Analytics, Mixpanel and PostHog: Analytics, only if you accept analytics cookies. They get a random code and the screens you use, never your name, email, documents, photos or messages.

Some of them are in the United States or elsewhere outside the UK. Where they are, the transfer is covered by UK adequacy regulations or by the UK’s approved contract terms for international transfers.

• Documents your deposit doesn’t need are deleted as soon as we’ve read them; we keep only their type and why.
• Your deposit file, photos and AI results are deleted 12 months after your deposit is paid out. You can delete everything sooner in Settings.
• Payment records are kept for 6 years, as tax law requires.

You can ask for a copy of your information, ask us to correct or delete it, object to or restrict how we use it, ask for it in a portable form, and withdraw any consent. Email [email protected]; we reply within a month.

If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.

If we change this notice, we’ll show the new date here and tell you by email if the change affects you.