Privacy Policy

1. Who We Are

1.1 This Privacy Policy explains how LLCR Technologies Ltd (“LLCR”, “we”, “us”, or “our”) collects, uses, stores, and shares your personal data when you use our Platform and visit our website.

1.2 LLCR Technologies Ltd is the data controller for the personal data described in this Policy. This means we decide why and how your personal data is processed.

1.3 Our details:

1.4 We have not appointed a Data Protection Officer as we are not required to do so under Article 37 of the UK GDPR. If you have any questions about this Policy or our data practices, please contact us at [email protected].

2. What This Policy Covers

2.1 This Policy applies to personal data we collect when you:

(a) visit our marketing website at llcr.uk;

(b) create an account and use our Platform at llcr-app.uk;

(c) subscribe to a paid Plan;

(d) contact us by email or through the Platform;

(e) interact with our AI assistant, Ava; or

(f) upload documents for automated data extraction.

2.2 This Policy does not cover third-party websites or services linked from our Platform. We encourage you to read the privacy policies of those third parties before providing them with your personal data.

3. The Personal Data We Collect

Swipe or scroll horizontally to see all columns.

3.1 We do not ask you for special category data. None of our forms request racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data, and we have no field anywhere in the Platform for recording a tenant’s health, disability, or vulnerability.

3.2 However, several parts of the Platform have free-text boxes, and you may upload documents containing information we did not ask for. The description field when you report a property issue is the most likely example: a note explaining why a hazard is urgent may describe an occupant’s health. Please do not enter special category data unless it is genuinely necessary. Where you do, it is processed in the same way as the rest of that entry, including being sent to our AI provider in the circumstances described at clause 9.

3.3 Right to Rent checks involve immigration-related information. This is not a special category of data under Article 9 of the UK GDPR, but we recognise that it is sensitive and we handle it accordingly. We record that a check was made, when, and by what method. We do not record a person’s immigration status or nationality as a structured field.

3.4 We do not knowingly collect personal data from anyone under the age of 18. The Service is intended for adult landlords and letting professionals only.

4. How and Why We Use Your Personal Data

The UK GDPR requires us to have a lawful basis for each way we use your personal data.

Swipe or scroll horizontally to see all columns.

4.1 Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms and are satisfied that our interests do not override them. If you would like more information about how we have done this for a particular purpose, contact us at [email protected].

4.2 Where we rely on your consent, you may withdraw it at any time by contacting us or changing your settings in the Platform. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

5. Who We Share Your Data With

5.1 We do not sell your personal data to anyone. We never have and we never will.

5.2 We share your personal data with the following processors, who act only on our instructions and under a written contract meeting the requirements of Article 28 of the UK GDPR:

Swipe or scroll horizontally to see all columns.

5.3 We also use the following services, which do not act as our processors:

Swipe or scroll horizontally to see all columns.

5.4 We may also disclose your personal data if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5.5 If LLCR is acquired, merges with another company, or sells substantially all of its assets, your personal data may be transferred to the successor entity. We will notify you of any such transfer and any choices you may have regarding your data.

5.6 The table at clause 5.2 is our current list of processors. If we engage a new processor, we will update this Policy and give at least 30 days’ notice before the new processor begins processing your data, so that you have an opportunity to raise any objection.

6. International Data Transfers

6.1 Your Platform data, including all uploaded documents, is stored in the United Kingdom. Our database and file storage are hosted on Amazon Web Services in London.

6.2 Our encrypted offsite backup is stored in the Netherlands. The United Kingdom has adequacy regulations covering the European Economic Area, so no additional safeguard is required for that transfer.

6.3 Some of our other service providers are based in the United States. When we transfer personal data outside the United Kingdom, we ensure appropriate safeguards are in place as required by Chapter V of the UK GDPR. The safeguards we rely on are:

(a) the UK Extension to the EU-US Data Privacy Framework, for providers certified under it;

(b) the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, where the Data Privacy Framework does not apply; and

(c) UK adequacy regulations, where the destination has been assessed by the UK Government as providing an adequate level of protection. This covers transfers to the European Economic Area.

6.4 The specific safeguard relied on for each provider is set out in the table at clause 5.2.

6.5 You may request a copy of the relevant safeguards by contacting us at [email protected].

7. How Long We Keep Your Data

7.1 Retention periods

We do not keep your personal data for longer than necessary.

Swipe or scroll horizontally to see all columns.

7.2 What happens when data is deleted

When you delete a document from your vault, the file is removed from our live storage immediately.

When you delete a certificate record, the record is marked as deleted and is no longer shown to you or included in your compliance score. The underlying evidence file is retained for as long as your account remains open. This is deliberate: the value of a compliance record lies in being able to demonstrate what was in place and when, and a certificate deleted in error should not destroy the evidence of a period during which you were compliant.

When your account is closed, we delete your data from our live systems after the 30-day grace period described above.

7.3 Backups

We maintain an encrypted offsite backup of Platform data, including uploaded files, with a storage provider separate from our main infrastructure. This exists so that we can restore your compliance evidence if our primary systems fail, are corrupted, or suffer data loss.

Backups work differently from live systems, and we want to be clear about what that means for you:

(a) When data is deleted from our live systems, a copy may remain in the backup for a period afterwards.

(b) Backup data is held beyond use. We do not access, search, analyse, or use it for any purpose other than restoring the Service following a failure. It informs no decision about you or about anyone else.

(c) We have implemented an automated process to remove deleted files from our backups on a defined schedule. That process is presently operating in a reporting-only mode while we complete verification testing. Until it is fully enabled, backup copies are retained indefinitely, held beyond use as described above. We will update this Policy when the deletion schedule takes effect.

(d) If you ask us to erase your data, we will confirm both that it has been erased from our live systems and how it is being handled in backup.

7.4 When a retention period expires, we securely delete or anonymise the data so that it can no longer be linked to you.

8. Tenant Data: Your Responsibilities as a Data Controller

8.1 When you enter personal data about your tenants into the Platform, you are acting as a data controller for that data within the meaning of the UK GDPR. We act as a data processor on your behalf.

8.2 As a data controller, you are responsible for:

(a) having a lawful basis for entering your tenants’ personal data into the Platform;

(b) informing your tenants about how their data is processed, including that you use LLCR as a data processor; and

(c) responding to any data subject requests from your tenants.

8.3 We process tenant data only on your documented instructions, which are given by your use of the Platform, and in accordance with our obligations as a processor under Article 28 of the UK GDPR.

8.4 We will assist you in responding to data subject requests to the extent that the relevant data is within our systems, and we will notify you without undue delay if we receive a request directly from one of your tenants.

8.5 We will notify you without undue delay after becoming aware of any personal data breach affecting data we process on your behalf, and will provide the information you reasonably need to meet your own obligations under Articles 33 and 34 of the UK GDPR.

8.6 We engage the processors listed at clause 5.2 as sub-processors in relation to tenant data. By using the Platform you give general authorisation for us to do so. We will give at least 30 days’ notice before engaging any new sub-processor, as described at clause 5.6.

8.7 On termination of your account, we will delete tenant data in accordance with clause 7. If you require the data to be returned rather than deleted, contact us before closing your account.

8.8 If you require a formal Data Processing Agreement, please contact us at [email protected] and we will provide one.

9. Artificial Intelligence: How Your Data Is Used

We use Anthropic’s Claude models in five places in the Platform. Anthropic acts as our processor. Anthropic does not use your data to train its models. This clause sets out each use and what is sent.

9.1 Ava, the AI assistant

Ava is not sent a fixed summary of your account. It is given tools that let it look up your data while answering, so what reaches Anthropic depends on what you ask.

With every message we send:

(a) your message and recent conversation history;

(b) your first name, your workspace identifier, your role in that workspace, and your subscription tier; and

(c) a summary of your portfolio, comprising property labels, compliance status, certificate expiry dates and aggregate counts.

In addition, Ava can retrieve further information from your account in order to answer you. Depending on your question, this can include property addresses and identifiers, detailed compliance state, the history and timeline of reported issues, and metadata about documents you hold. Anything Ava retrieves in order to answer a question is sent to Anthropic as part of producing the answer.

Ava reads your data. It cannot change it, and it cannot act on your account.

We do not send Anthropic your password or your payment card details.

9.2 Reading uploaded certificates

When you upload a certificate, we first try to read it on our own systems. Most PDFs contain a machine-readable text layer, and where that works the document is processed entirely within our infrastructure and is not sent to Anthropic.

Where a document has no readable text layer, or where you upload a photograph or a scan, we send the complete file to Anthropic so that the compliance details can be extracted.

We want to be clear about what that means. Although we ask only for particular fields, such as the issue date, the certificate number and the assessor name, the model receives the whole document. Anything printed on it may therefore be processed, including the property address and any tenant or occupier names appearing on the certificate. We do not crop or redact documents before sending them.

The request contains the file and our instructions for reading it. We do not add your workspace or user identifiers, your property records, your tenant list, or your landlord profile to it.

9.3 Compliance Defence Packs

When you generate a Compliance Defence Pack, the document itself is produced on our systems. We use Anthropic only to draft the executive summary.

For that purpose we send a structured summary containing:

(a) the property address, type, jurisdiction and HMO status;

(b) certificate types, issue and expiry dates, and whether evidence is held;

(c) the deposit amount, scheme, scheme reference and protection dates;

(d) compliance check outcomes and dates;

(e) counts of documents, notices and activity records; and

(f) audit chain verification results.

We do not send the underlying document files, certificate reference numbers, assessor names, tenant names, your legal name or registered address, filenames, notice contents, or the detail of your activity log.

9.4 Hazard Response Packs

When you generate a Hazard Response Pack for a reported issue, we send Anthropic a structured summary of that issue so that it can draft the narrative. This includes the issue description as you wrote it, the entries on its timeline, and the filenames of any evidence attached.

This is the AI feature most likely to receive free text, and therefore the one most likely to receive information you have typed rather than selected. If you have written something in an issue description or timeline entry that you would not want processed outside our systems, do not generate a Hazard Response Pack for that issue. Please see clause 3.2.

9.5 Section 8 notice wording

If you ask us to improve the wording of the grounds you have written for a Section 8 notice, we send the text you wrote to Anthropic and return a revised version. Nothing else about the property, the tenancy or the tenant is sent with it. This only happens when you actively ask for it.

9.6 What Ava and the other AI features never do

None of the five features above makes any decision about you. They produce text and extract data for you to review. You remain responsible for checking anything they produce before you rely on it, and a Defence Pack, Hazard Response Pack or notice remains your document, not ours.

9.7 Retention of AI conversations

Your conversations with Ava are stored on our systems so that you can return to them. They are kept for as long as your account is open and are deleted with the rest of your data when your account is closed, in accordance with clause 7. You can delete any individual conversation yourself at any time from within the Platform.

9.8 Automated decision-making

Neither Ava nor any other automated process makes decisions about your access to the Service, your subscription, or your legal rights. Compliance scores and status indicators are calculated from your certificate dates and are informational tools. They do not produce legal effects or similarly significant effects within the meaning of Article 22 of the UK GDPR.

10. Cookies and Similar Technologies

10.1 This clause covers cookies and other technologies that store information on your device, including browser local storage and session storage. Our Cookie Policy at llcr.uk/cookies sets out the same information in more detail and explains how to manage your preferences.

10.2 On our marketing website (llcr.uk) we use only strictly necessary cookies.

10.3 On the Platform (llcr-app.uk) we store the following on your device:

Swipe or scroll horizontally to see all columns.

10.4 The referral identifier is the only item above that requires your consent, because it exists for our benefit rather than to deliver something you asked for. If you arrive through a partner referral link we will ask you before storing it. Declining will not affect your access to the Platform, the features available to you, or the price you pay. You can withdraw your consent at any time in your account settings.

10.5 Our product analytics operate without cookies. We do not use advertising cookies, and we do not share data with advertisers.

11. Your Rights Under the UK GDPR

Under the UK GDPR you have the following rights. These rights are not absolute and may be subject to exemptions.

Swipe or scroll horizontally to see all columns.

11.1 To exercise any of these rights, email [email protected]. We will respond within one month. If your request is complex we may extend this by a further two months, and will tell you within the first month if so.

11.2 We will not charge a fee, except where a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.

11.3 We may need to verify your identity before acting on a request.

11.4 If you are a tenant and your landlord or letting agent uses LLCR, they are the controller of your data and we are their processor. Please direct your request to them in the first instance. If you contact us directly, we will forward your request to them without undue delay and will tell you that we have done so.

12. Data Security

12.1 We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:

(a) encryption of data in transit and at rest;

(b) role-based access controls and workspace isolation, so that each customer can access only their own data;

(c) secure password hashing;

(d) database-level access policies enforcing separation between customer workspaces;

(e) a tamper-evident audit trail of activity on your account;

(f) encrypted offsite backups held with a separate provider, retained in immutable storage;

(g) automated error monitoring; and

(h) use of established third-party infrastructure providers who maintain recognised security certifications.

12.2 No system is completely secure, and we cannot guarantee absolute security.

12.3 If we become aware of a personal data breach, we will:

(a) notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals;

(b) notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms; and

(c) where we process data on behalf of a landlord or agency, notify that customer without undue delay so that they can meet their own obligations.

13. Changes to This Policy

13.1 We may update this Policy to reflect changes in our data practices, legal requirements, or the Service.

13.2 If we make material changes, we will notify you by email at least 14 days before they take effect, and will update the “Last updated” date at the top of this Policy.

13.3 We encourage you to review this Policy periodically.

14. How to Contact Us

14.1 If you have questions about this Policy, wish to exercise your rights, or have a concern about how we handle your data:

14.2 If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office: