Privacy notice

1. Who we are

The Deal Genius service is operated by VenturesSky Ltd, a company registered in England (Company No. 05525840, VAT No. 911173753). Our registered office is D&D Accountancy, Suite 006, 44-60 Richardshaw Lane, Pudsey, LS28 7UR. VenturesSky Ltd is the data controller for the personal data described in this notice. You can reach our privacy contact at privacy@dealgenius.co.uk.

We are registered with the Information Commissioner's Office (ICO) under registration number 00011225121.

2. What personal data we process

We only process the data we need to run your account and the features you use:

• Your email address — provided when you sign up through our authentication provider, Supabase.
• Your name — if your sign-in profile includes one. This is optional.
• Your Supabase user identifier (the sub claim) — a stable ID that links your sign-in to your account.
• Your onboarding answers — the investment strategy, budget band, and locations you selected during the three-question onboarding flow.
• Your saved properties and saved searches — the listings and search configurations you choose to keep.
• Your Stripe customer ID and payment metadata — if you subscribe. Your payment card details never touch our servers; Stripe handles them directly.
• Your email-alert opt-out timestamp — recorded if you unsubscribe from alert emails.

The property data we show you — asking prices, Deal Scores, valuations, area statistics — is public market data and government bulk data. It is not personal data about you.

3. Lawful basis for processing

We rely on two lawful bases under the UK GDPR:

• Legitimate interests (Article 6(1)(f)) — for processing publicly-available property data to produce Deal Scores and market insights.
• Contract performance (Article 6(1)(b)) — for processing the account data we need to deliver the subscription service you signed up for.

We do not rely on consent for any processing. We do not ask for opt-in beyond the account you create when you sign up.

4. Why we use your data (purposes)

We use your personal data only for these purposes:

• Authenticating your sign-in through Supabase.
• Running your saved-property and saved-search features.
• Sending the email alerts you have opted in to.
• Charging your subscription through Stripe.
• Surfacing Deal Score insights tailored to your saved searches.
• Producing aggregated operational metrics so we can monitor the platform's health.

We do not run ad-tech, we do not use third-party tracking, and we never sell your data or build a marketing profile of you.

5. How long we keep your data

• Active account — we keep your data for as long as your account is open.
• Cancelled subscription — we keep the transaction record for 6 years to meet UK tax-law accounting requirements, but we anonymise your personal identifiers (email, name, Supabase user ID) within 30 days of cancellation.
• Deleted account— when you delete your account, we purge your personal data immediately. Only aggregate, non-identifying analytics (for example, “how many accounts were deleted this month”) are retained.
• Email-alert logs — kept for 90 days, then purged.

6. Who we share your data with (recipients + processors)

We use a small number of trusted processors to run the service. Each one only receives the data it needs:

• Supabase — our authentication provider. Processes your email address, password (stored as a salted hash), and Supabase user ID.
• Stripe— our payment processor. Processes your payment metadata, Stripe customer ID, and billing email. Your card details are Stripe's responsibility, not ours.
• SendGrid — our email service provider. Processes your email address to deliver alert emails.
• PropertyData — our property-data provider. We send no personal data to PropertyData; they are a one-way upstream source.
• HM Land Registry — a one-way upstream data source. We share no personal data with them.
• Our hosting provider — processes all stored data at rest (see section 7).

We do not share your data with advertising networks, data brokers, or third-party analytics platforms.

7. Where we store your data (transfers)

Your data is stored in the UK and the EU only. Our primary database is hosted in the United Kingdom. Our disaster-recovery replica is hosted in Germany — an EU member state covered by the UK GDPR adequacy decision, so this is an intra-EEA transfer, not a transfer to a third country.

Supabase stores your authentication data in its London (United Kingdom) region; Stripe and SendGrid process your data in the EU. We do not transfer your personal data to the United States.

8. Your rights and how to exercise them

Under the UK GDPR you have the following rights over your personal data:

• The right to access the data we hold about you.
• The right to rectify inaccurate data.
• The right to erasure (have your data deleted).
• The right to restrict processing.
• The right to data portability.
• The right to object to processing.
• The right not to be subject to a decision based solely on automated processing.
• The right to withdraw consent (where consent applies).

You can exercise your right to erasure yourself at any time: go to your account settings and use the “Delete my account” option. This purges your personal data immediately and cancels any active subscription.

To exercise any of the other rights, email us at privacy@dealgenius.co.uk. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk/concerns.