Dwelyx← Back to home

Privacy Policy

Last updated: 4 April 2026

1. Who We Are

Dwelyx is a software-as-a-service platform for UK residential landlords, operated as a sole trader trading as Dwelyx ("we", "us", "our"). You can contact us at hello@dwelyx.co.uk.

2. What Data We Collect

We collect the following categories of personal data:

  • Account data: name, email address, password (hashed), billing details processed via Stripe.
  • Property and tenancy data: property addresses, tenant names, tenancy dates, rent amounts, compliance dates you enter into the platform.
  • Documents: files you upload (PDF, images) stored encrypted in Supabase Storage.
  • Financial records: rent payment records and expenses you log for MTD and P&L purposes.
  • Usage data: page views, feature usage, and error logs collected for service improvement.
  • Communications: emails we send you (reminders, receipts, notifications) via Resend.

3. Legal Basis for Processing

We process your data under the following lawful bases (UK GDPR Art. 6):

  • Contract performance — to provide the Dwelyx service you have subscribed to.
  • Legal obligation — to comply with UK tax and financial regulations.
  • Legitimate interests — for fraud prevention, security, and service improvement.
  • Consent — for non-essential cookies and marketing communications (where obtained).

4. How We Use Your Data

  • To provide, maintain, and improve the Dwelyx platform.
  • To send compliance reminders and important account notifications.
  • To process payments via Stripe.
  • To generate MTD-ready tax reports for your use with HMRC.
  • To provide customer support.
  • To detect and prevent fraudulent or abusive activity.

5. Third-Party Processors

We share data only with processors necessary to deliver the service:

  • Supabase (database and file storage) — EU/US region, SOC 2 certified.
  • Stripe (payments) — PCI DSS Level 1 certified. Stripe processes payment card data independently.
  • Resend (transactional email) — used for reminders and account emails.
  • Vercel (hosting) — Next.js deployment platform.

We do not sell your personal data. We do not share data with advertising networks.

6. Tenant Data

You, the landlord, are the data controller for tenant personal data you enter into Dwelyx. Dwelyx acts as your data processor for this data. You are responsible for ensuring you have a lawful basis to enter and store tenant information, and for informing tenants about how their data is used in accordance with your own privacy obligations.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it by law (e.g., financial records for HMRC purposes, typically 6 years). Document files are deleted from storage immediately upon account closure.

8. Your Rights

Under UK GDPR, you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — correct inaccurate data.
  • Erasure — request deletion of your data ("right to be forgotten").
  • Portability — receive your data in a structured, machine-readable format.
  • Restriction — restrict processing in certain circumstances.
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent.

To exercise any of these rights, email us at privacy@dwelyx.co.uk. We will respond within 30 days.

9. Cookies

We use strictly necessary cookies to maintain your authenticated session. We may also use analytics cookies to understand how the platform is used. You can manage cookie preferences via the cookie banner shown on first visit. For more detail, see our cookie policy notice.

10. Security

We implement appropriate technical and organisational measures to protect your data, including encryption at rest and in transit, row-level security on our database, and regular security reviews. No system is completely secure; in the event of a data breach we will notify affected users and the ICO as required by law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or via an in-app notice. Continued use of Dwelyx after changes constitutes acceptance of the updated policy.

12. Contact & Complaints

For privacy queries, contact us at privacy@dwelyx.co.uk.

If you are unhappy with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.