Privacy Policy

1. Who We Are

Offer Smart ("OfferSmart", "we", "us", "our") is a UK-based web platform that generates property buyer reports using publicly available datasets and third-party APIs. Our website is at offersmart.co.uk.

We are the data controller for the personal data described in this policy. For any privacy enquiry, or to exercise your rights, contact valuations@offersmart.co.uk.

2. Personal Data We Collect

We collect the following categories of personal data:

Account data — when you create an account (by email and password, or by signing in with Google or Apple) we collect your email address, and your name and profile details where your sign-in provider supplies them. We also store an internal user ID and the date your account was created.
Report data — the property addresses and listing URLs you analyse, the reports generated from them, and (where you are signed in) the reports you save to your dashboard. These are linked to your account.
Purchase data — a record of the reports and subscriptions you have paid for, the amount, the date, and the Stripe customer/session identifiers. We do not receive or store your card details.
Enquiry and referral form data — if you request an introduction to our recommended conveyancer or contact us through a form on the site, we collect the details you submit, which typically include your name, email address, phone number, the property address and any notes you provide.
Email data — your email address, the emails we have sent you, delivery and open/click events from our email provider, and your marketing preferences or unsubscribe status.
Technical and usage data — IP address, browser type and version, device type, pages visited, referring page or search term, and interaction events collected through cookies and analytics tags.

We do not knowingly collect data from anyone under 18, and we do not collect special category data.

3. Why We Use It, and Our Lawful Basis

Providing your account, reports and downloads — performance of a contract with you (Article 6(1)(b) UK GDPR).
Taking payment and preventing paywall abuse — performance of a contract and our legitimate interests in protecting the service (Article 6(1)(b) and 6(1)(f)).
Passing your details to a partner you have asked to be introduced to — performance of a contract / your consent given when you submit the form. We only share what the form tells you we will share, and only with the partner named on that form.
Service emails (report ready, download links, password resets, receipts) — performance of a contract.
Marketing and follow-up emails about Offer Smart — consent, or our legitimate interest in marketing similar services to existing customers. You can unsubscribe from any marketing email using the link in its footer.
Analytics, performance monitoring, security and fraud prevention — legitimate interests, and your consent where cookies require it (Article 6(1)(f) and PECR).
Meeting our legal and accounting obligations — legal obligation (Article 6(1)(c)).

4. Cookies and Analytics

We use essential cookies to keep you signed in and to operate the site, and analytics and advertising tags (including Google Tag Manager, Google Analytics and Meta advertising tools) where you have consented. You can change your choice at any time through the cookie banner. See our Cookie Policy for full details.

5. Processors and Third Parties

We share personal data with the following providers, who process it on our behalf or as independent controllers:

Supabase / Lovable Cloud — hosting, database, authentication and file storage for accounts, saved reports and PDFs.
Stripe — payment processing. Card details are entered on Stripe's systems and are never stored by us. See Stripe's Privacy Policy.
Resend — sending transactional and marketing email.
Google — Tag Manager and Analytics, Google sign-in, and the Places API used for local amenity data.
Apple — Sign in with Apple, where you choose it.
Meta — advertising and conversion measurement, where you have consented to advertising cookies.
AI providers — we use AI models (for example Google Gemini and OpenAI models via our AI gateway) to generate written analysis inside reports. Report inputs are property data; we do not send your account credentials or payment data to these models, and they are not used to train third-party models on our instruction.
Our named partner — ADK Law (conveyancing) receives your contact details only when you submit an enquiry asking to be introduced to them.

Some providers process data outside the UK/EEA. Where that happens, transfers are covered by the UK International Data Transfer Addendum, Standard Contractual Clauses or an adequacy decision.

We do not sell your personal data.

6. Public Data Sources Used in Reports

Reports are compiled using publicly available datasets, including:

HM Land Registry Price Paid Data and the UK House Price Index (Open Government Licence v3.0)
Office for National Statistics (ONS) Census and economic data
UK Police crime statistics
Environment Agency flood risk data
EPC register and UK planning portal data

These datasets relate to properties, not to you, and are not combined with your account data for any purpose other than producing your report.

7. How Long We Keep Data

Account and saved reports — for as long as your account is open, and up to 30 days after you ask us to delete it.
Purchase and transaction records — 6 years, to meet UK accounting and tax obligations.
Enquiry and referral form submissions — up to 24 months from submission.
Email logs and unsubscribe records — unsubscribe records are kept indefinitely so we do not email you again; other email logs are kept up to 24 months.
Analytics and technical logs — up to 14 months.

8. Your Rights

Under UK GDPR you have the right to:

Access the personal data we hold about you
Have inaccurate data corrected
Have your data erased, including deletion of your account
Restrict or object to processing, including direct marketing at any time
Receive your data in a portable format
Withdraw consent where we rely on it, without affecting earlier processing
Complain to the Information Commissioner's Office (ico.org.uk)

To exercise any of these rights, email valuations@offersmart.co.uk. We respond within one month. You can also delete your account yourself from your account settings.

9. Security

Data is stored on encrypted, access-controlled infrastructure. Database access is protected by row-level security so you can only read your own account data and reports, report PDFs are served through signed, time-limited links, and payment card data never touches our systems.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes are posted on this page with a revised date. Material changes affecting how we use your data will be notified by email where we hold your address.

11. Contact

Offer Smart
Email: valuations@offersmart.co.uk