Privacy Policy

HeatStay is a UK property data aggregation service. We are the data controller for personal data collected through this website. For any privacy-related queries, please use our contact page.

When you create an account or sign in, we collect:

• Name and email address — provided by Google OAuth at sign-in.
• Profile image URL — your Google profile picture, if available.
• Account metadata — plan, role, and account status.
• Session tokens — to keep you signed in securely.

We do not collect payment card data directly. Any future payment processing will be handled by a PCI-compliant third party (Stripe).

We use your personal data to:

• Authenticate your identity and maintain your session.
• Manage your subscription plan and access controls.
• Contact you with service-related notices (no marketing without consent).
• Detect and prevent fraud or abuse.

For users in the UK and EEA, our legal basis for processing your data is the performance of a contract (providing the service you signed up for) and, where applicable, our legitimate interests in operating a secure and reliable service.

We do not sell your personal data. We may share data with:

• Google — solely for OAuth authentication.
• Infrastructure providers — hosting and database services, bound by data processing agreements.
• Law enforcement — only where required by law.

We use a single session cookie to keep you signed in. We do not use advertising or third-party tracking cookies. You can clear cookies at any time via your browser settings, which will sign you out.

We retain your account data for as long as your account is active. If you delete your account, your personal data is removed within 30 days, except where we are required to retain it for legal or fraud-prevention purposes.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Object to or restrict certain processing.
• Data portability where technically feasible.

To exercise any of these rights, contact us via the contact page. We will respond within 30 days.

We use industry-standard measures including encrypted connections (HTTPS), hashed session tokens, and access controls to protect your data. No system is completely secure; please notify us immediately if you suspect any unauthorised access.

We may update this policy from time to time. Material changes will be communicated via the email address on your account. Continued use of the service after notice constitutes acceptance.