© 2026 Wectory

Where we are the processor. The partner decides how and why the data is used, and we act on the partner's instructions. This applies to the personal data of the partner's landlords and tenants that the partner supplies to, or generates through, the platform. For that data the partner is the controller, and the partner's own privacy notice governs. We process it under a written data processing agreement with the partner, and we handle it only to provide the platform.

If you are a landlord or tenant and you want to know how your data is used, your first point of contact is the letting agent or property manager you deal with. We will help them respond.

3. The personal data we handle

Partner staff (we are controller). Name, work email, phone number, and, if you sign in with Google, the basic profile information Google returns (name, email, profile image). We also keep records of your activity on the platform for security and audit.

Website visitors and enquirers (we are controller). Your message and contact details if you use a contact or "request access" form; limited technical information needed to keep the site secure (for example the IP address and browser type seen by our security and rate-limiting layer); and aggregate, non-identifying usage statistics (see Section 8).

Landlords (partner is controller; we are processor). Name, email, phone number, company details and address; the tenancy and property details entered for a Rent Advance or Rent Collection; and, where the landlord signs a factoring agreement, the electronic signature record, which captures the signer's name, email, IP address, browser user-agent and a timestamp as evidence that the agreement was signed.

Tenants (partner is controller; we are processor). Name, email, phone number and address; the terms of the tenancy; and the Direct Debit mandate the tenant sets up (see Section 4).

Direct Debit records via GoCardless. Direct Debit is provided through the GoCardless Partner Integration. When a landlord or tenant sets up a mandate, they enter their bank account number and sort code only on GoCardless's own secure page. Those full bank details never pass through Wectory and we do not store them. What we do hold is the information GoCardless returns to us through its API, which can include the payer's name and address and the last four digits of the bank account together with the account holder's name. We never receive or store the full account number.

4. How Direct Debit and payments work

Wectory never holds, routes, transmits or receives the rent, the advance, or any other principal. Money moves by Direct Debit directly into the partner's own collection account through the GoCardless Partner Integration. GoCardless Ltd is authorised by the Financial Conduct Authority (FRN 597190) and is a separate controller of the payment data it processes; its own privacy notice applies to that processing. The Direct Debit Guarantee, shown by GoCardless when a mandate is set up, protects payers in the usual way.

We charge our partner a fee on each successful Direct Debit, stated in our published Fee Schedule and deducted to us by GoCardless at settlement. That published price also covers GoCardless's own charge for the Direct Debit, and each supplier adds its own VAT to its own share. Nothing is charged to you, and we do not need, and do not take, your card or full bank details.

5. Why we use your data, and our lawful basis

Where we are the controller, we rely on the following lawful bases under the UK GDPR:

• To provide and secure the platform to partner staff - performance of our contract with the partner, and our legitimate interest in running a secure service. This covers creating and managing accounts, authentication, support, and audit logging.
• To respond to enquiries and manage access requests - our legitimate interest in dealing with people who contact us, and taking steps to enter into a contract.
• To keep the website and forms secure - our legitimate interest in preventing fraud, abuse and automated attacks (this is why our security and rate-limiting layer processes IP and request data).
• To understand and improve the website - our legitimate interest in measuring, in aggregate, how the site is used (see Section 8).
• To meet our legal and regulatory obligations - compliance with law, including tax, accounting and anti-money-laundering duties that apply to us.

Where we act as processor for landlord and tenant data, the lawful basis is set by the partner as controller. The partner will normally rely on performance of the tenancy or factoring arrangement and on its own legitimate interests.

6. Automated processing of uploaded documents

To save partners re-keying, the platform can read a tenancy agreement that a partner uploads (a PDF or a photo) and extract the relevant details - landlord, tenant, property and rent. To do this, the uploaded document is sent to a third-party AI model through the Vercel AI Gateway (see Section 7) purely to extract those fields. The model provider does not use the document to train its models and processes it only to carry out the extraction, though it may retain it for a short period for security and abuse monitoring under its own policies. The upload is deleted from our systems shortly after extraction, and a daily sweep removes any leftover files; the extracted details are then kept as ordinary tenancy data. This processing prepares data for a person to review and act on. It is not automated decision-making that produces a legal or similarly significant effect on anyone.

7. Who we share data with

We do not sell personal data. We share it only with the service providers that help us run the platform, each under a contract that requires them to protect the data and use it only on our instructions, and with authorities where the law requires it. Where we process landlord and tenant data as a partner's processor, these providers act as our sub-processors under the data processing agreement with the partner.

GoCardless is a separate controller of the payment data it processes (see Section 4). Companies House is the public companies register, which we query for company look-ups.

We keep an up-to-date list of these providers and will provide the current version on request to in@wectory.com.

8. Cookies and analytics

We keep on-device storage to the minimum and we do not use advertising or third-party marketing trackers.

Strictly necessary. When a partner user signs in, we set authentication cookies. These are essential to keep you signed in securely and cannot be switched off.

Functional. The signed-in dashboard stores your interface preferences (for example layout or theme choices) in your browser's local storage, so the platform remembers them. These are set because you use the feature.

Usage analytics. We measure how the website is used through Vercel Web Analytics and Speed Insights. These are cookieless: they do not set or read anything on your device and do not track you across other sites. Visits are counted using a short-lived, rotating server-side value derived from IP address and browser type, which is not stored as a record of you. We use this only for statistics about how our own service is used, so we can improve it. Under the current cookie rules you can object to this analytics processing at any time by emailing in@wectory.com, and we will stop it for you.

Because we store nothing on your device beyond what is strictly necessary or functional, no cookie consent banner is required. If we ever add a non-essential tracker - for example an advertising pixel or a cookie-setting chat widget - we will introduce a consent banner and a separate cookie policy first.

9. Sending data outside the UK

We are a UK business, and our main platform database, hosted by Supabase, is located in the United Kingdom (London). Some of our providers process data outside the UK - in particular the AI model providers used for document extraction (Section 6), which operate in the United States. Where personal data is transferred outside the UK, we rely on a transfer mechanism recognised under UK data protection law - either the UK "data bridge" for certified recipients, or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses - together with any additional safeguards needed to protect the data. You can ask us which mechanism applies to a given provider.

10. How long we keep it

We keep personal data only as long as we need it:

• Partner-staff accounts - for as long as the account is active, and for a limited period afterwards for security, audit and legal reasons.
• Enquiries and access requests - for as long as needed to deal with the enquiry and to pursue or record any resulting relationship.
• Landlord and tenant data, and factoring-signature and Direct Debit records - for the period set by the partner as controller, and by the record-keeping and limitation periods that apply to the underlying agreements. As processor, we delete or return this data on the partner's instruction or at the end of our contract with the partner, unless the law requires us to keep it.
• Uploaded documents - deleted shortly after extraction, as described in Section 6.

11. Your rights

Where we are the controller of your data, you have the right to: be informed about how we use it; access it; have it corrected; have it erased; restrict or object to our use of it; data portability; and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, email in@wectory.com. We will respond within the time limits set by law, after a reasonable and proportionate search. There is normally no charge. We may need to confirm your identity first.

If you are a landlord or tenant, these rights are exercised against the partner as controller. Contact your letting agent or property manager, or email us at in@wectory.com and we will pass the request to the right partner and support them in responding.

12. How to complain

If you are unhappy with how we have handled your personal data, please tell us first at in@wectory.com so we can put it right. You have the right to complain directly to us, and we will investigate and keep you informed of the outcome. Our complaints procedure explains how this works.

You also have the right to complain to the ICO at any time. The ICO can be reached at https://ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would appreciate the chance to resolve your concern before you approach the ICO.

13. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top shows when it was last changed. If we make a significant change, we will take reasonable steps to bring it to your attention.