Privacy Policy

Last updated: 25 July 2026

This notice explains how Quardlyn LTD uses personal information across Quardlyn.co.uk, our mobile apps, user and agent accounts, property enquiries, valuations, support, CRM/API integrations, payments and monitoring.

1. Controller and contact

Quardlyn LTD (company number 16824752), Office 5749, 182–184 High Street North, East Ham, London E6 2JA, United Kingdom, is the controller for the processing described here. Privacy requests: info@quardlyn.co.uk or our App Support form.

2. Information we collect

• Account and identity: name, email, telephone, hashed password, account type, verification and organisation details.
• Property activity: searches, saved properties, alerts, map areas, enquiries, valuation requests and preferences.
• Agent and listing data: branch, staff, property, feed, CRM, lead and listing-management records.
• Support: messages, attachments, device/app details and secure ticket history.
• Payments: plan, customer, mandate, subscription, invoice, payment status and limited payment-method metadata received from Stripe. We do not store full card or bank details.
• Developer and integration data: developer account, API keys in protected form, OAuth grants, scopes, webhook, certification, audit and synchronisation records.
• Device and technical data: IP address, browser, device/OS, app version, identifiers, encrypted or hashed push token, logs, cookie choices, session and security events.
• Content: listings, images, reviews, testimonials and other material submitted to the Services.

3. Why we use information and lawful bases

• Contract: create and operate accounts; deliver searches, alerts, support, paid plans, feeds, CRM/API access and requested services.
• Legitimate interests: operate and improve the portal; route genuine enquiries; measure performance; prevent fraud and abuse; secure systems; maintain audit records; moderate reviews; and understand service use. We balance these interests against individual rights.
• Consent: non-essential cookies, optional marketing and device notifications where consent or permission is required. Consent may be withdrawn at any time.
• Legal obligation: accounting, tax, payment, consumer, company, regulatory, law-enforcement and data-protection duties.
• Legal claims and vital interests: establish or defend rights and respond to urgent threats where applicable.

Your right to object: you may object at any time to direct marketing and may object to processing based on legitimate interests by contacting us.

4. Enquiries and agent relationships

When you enquire about a property, request a valuation or contact an agent, we send the details you provide to the selected agent, branch, developer, landlord or authorised recipient so they can respond. That recipient normally becomes an independent controller for its subsequent communications and should provide its own privacy information.

5. Providers and sharing

We share information only where necessary with authorised staff and suppliers, including OVHcloud (hosting and infrastructure), Zoho (business email), Google (Maps, Analytics where permitted, and Firebase Cloud Messaging), and Stripe (card payments, Direct Debit, subscriptions and recovery). We may also share with authorised CRM/feed providers, professional advisers, insurers, auditors, regulators, courts, law enforcement, fraud-prevention bodies and a buyer or successor during a corporate transaction.

We do not sell personal information. We do not permit an agent to use an enquiry for unrelated marketing without an appropriate lawful basis.

6. Mobile apps and notifications

The apps may process device type, operating system, app version, notification preferences and a Firebase installation/push identifier. Notification permission can be changed in the app or device settings. Location is used only when a location feature is requested and permission is available; precise location is not required for ordinary browsing.

7. International transfers

Some providers may process information outside the UK. Where restricted transfers occur, we rely on UK adequacy regulations (including an applicable UK extension to a recognised framework) or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with risk assessment and security measures where required. Contact us for information about applicable safeguards.

8. Retention

We keep information only as long as reasonably necessary for the purpose collected, legal obligations, security and disputes. Criteria include account status, contractual and statutory limitation periods, tax/accounting duties, consent, integration status and the sensitivity of the record.

• Active account and listing records are retained while needed to provide the service; deletion or anonymisation follows closure subject to legal and dispute holds.
• Guest support links normally expire after 30 days; ticket records may be retained longer to resolve the request, demonstrate compliance and prevent abuse.
• Human monitoring activity is normally retained for 90 days, bot/security activity and session summaries for 180 days, subject to configured limits and incident holds.
• Feed run and operational records are normally cleaned after configured periods beginning at 30–90 days; selected audit, certification, billing and legal records may be retained longer.
• Payment and invoice records are retained as required for accounting, tax, chargebacks and legal claims; Stripe applies its own retention duties.
• Firebase installation identifiers remain until deletion is requested through the relevant service and provider backup cycles complete.

9. Security

We use access controls, encryption or hashing where appropriate, audit logging, validation, rate limiting, backups, monitoring and supplier safeguards. No internet service can guarantee absolute security. Please report concerns to security@quardlyn.co.uk.

10. Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to processing, and withdraw consent. We may need to verify identity. You may complain to the UK Information Commissioner’s Office at ico.org.uk.

11. Children

Accounts, payments, agent services and personal-data submissions are intended for adults aged 18 or over. We do not knowingly create accounts for children. Contact us if a child has submitted information so we can investigate and delete it where appropriate.

12. Changes

We may update this notice when services, providers or law change. Material changes will be highlighted or notified where appropriate.