Privacy Policy

1. Who We Are

SQFT is operated by Grand Estates London Ltd, a company registered in England and Wales.

• Company Name: Grand Estates London Ltd trading as SQFT
• Registered Address: London, United Kingdom
• Data Protection Contact: [email protected]

We are the data controller for the personal data we process through the SQFT platform. This means we determine how and why your personal data is processed.

2. What Data We Collect

We collect different types of information depending on how you use SQFT:

Account Information

• Email address (required for registration)
• Name (if provided)
• Password (stored securely hashed)
• Subscription status and billing information

Property Data

• Properties you save to your pipeline
• Analysis calculations and notes
• Legal pack documents you upload
• Investment outcome data you record

Investor Profile Data

• Investment experience and strategy preferences
• Financial information (for lender matching)
• Identity documents (if provided for KYC)

Usage Data

• Pages visited and features used
• Session duration and interaction patterns
• Device type, browser, and operating system
• IP address and approximate location

Scraped Property Data

SQFT scrapes publicly available property listings from auction house websites. This data is not personal data but is used to provide our analysis services.

3. How We Use Your Data

Purpose	Legal Basis
Providing SQFT platform services	Contract performance
Processing payments and subscriptions	Contract performance
Property analysis and recommendations	Contract performance
Platform security and fraud prevention	Legitimate interest
Analytics and service improvement	Legitimate interest
Marketing communications	Consent
Legal compliance and dispute resolution	Legal obligation

4. Data Sharing and Third Parties

We share your data with the following categories of third parties:

Third Party	Purpose	Location
Supabase Inc.	Database hosting and authentication	USA (EU SCCs)
Cloudflare Inc.	CDN, security, and analytics	USA (EU SCCs)
Stripe Inc.	Payment processing	USA (EU SCCs)
DigitalOcean LLC	Server hosting	UK/EU

International Transfers: Where we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK ICO.

5. Cookies and Tracking

We use cookies and similar technologies to:

• Essential cookies: Required for the platform to function (session management, security). These cannot be disabled.
• Analytics cookies: Help us understand how you use SQFT and improve our services. These require your consent.
• Preference cookies: Remember your settings and choices. These require your consent.

You can manage your cookie preferences at any time through our cookie consent banner or by adjusting your browser settings.

For more details, see our Cookie Policy.

6. Data Retention

We retain your data for as long as necessary to provide our services:

Data Type	Retention Period
Active account data	Duration of account + 30 days after deletion request
Property analysis data	Duration of account
Uploaded documents	Duration of account
Server logs	12 months (pseudonymised after 6 months)
Payment records	7 years (legal requirement)
Backup copies	90 days rolling

For more details, see our Data Retention Policy.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data ("right to be forgotten").
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Restrict Processing: Request we limit how we use your data.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent for processing based on consent at any time.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data correctly:

• Website: ico.org.uk
• Helpline: 0303 123 1113

8. Data Security

We implement appropriate technical and organisational measures to protect your data:

• All data transmitted over HTTPS/TLS encryption
• Passwords hashed using industry-standard algorithms
• Database encryption at rest
• Row Level Security (RLS) ensuring data isolation between users
• Regular security audits and penetration testing
• Access controls limiting employee access to data
• Automated backup with encryption

9. Children's Privacy

SQFT is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting a notice on the SQFT platform
• Sending an email to your registered address
• Updating the "Last updated" date at the top of this policy

We encourage you to review this policy periodically.

11. Contact Us