Privacy Policy
01Information We Collect
- Account Information: Name, email address, organisation details. If you sign in with LinkedIn, LinkedIn shares your name, email address and profile picture with us.
- Usage Data: Log data, device information, and usage analytics
- Customer Data: Data we extract from the systems an operator connects to StaySynced, as determined by the operator’s configuration. We handle this on the operator’s behalf. See section 10A.
- Payment Data: Processed securely by Stripe
02How We Use Your Information
- To provide and maintain the StaySynced service
- To process payments and manage subscriptions
- To communicate with you about your account and service updates
- To improve and secure our services
- To create anonymised, aggregated statistics (see section 4A)
03Legal Basis for Processing
We process your personal data under the following lawful bases under the UK GDPR:
| Purpose | Lawful basis |
|---|---|
| Provide and maintain the StaySynced service | Contract performance |
| Process payments and manage subscriptions | Contract / legal obligation |
| Security, fraud prevention and service improvement | Legitimate interests |
| Retain financial and tax records | Legal obligation |
| Analytics cookies | Consent |
Where we rely on legitimate interests, we balance those interests against your rights and freedoms. Where we rely on consent, you may withdraw it at any time.
04Data Sharing and Sub-Processors
We share data with trusted service providers who process it on our behalf:
- Vercel (application hosting: website, dashboard and API; functions execute in the UK)
- Supabase (hosting, database, authentication)
- Microsoft Azure (compute hosting for data transformation, UK)
- Stripe (payment processing)
- Resend (sending service and account emails)
The current list of providers that process Customer Data for operators is on our Sub-processor list. LinkedIn, if you choose to sign in with it, acts as its own controller under its own privacy policy.
We do not sell your personal data. We may share data where required by law or to protect the rights and safety of Cloudfox Group Limited, our customers, and others.
4AAggregated Data
We create and use statistical data that has been anonymised and combined across customers, for example average occupancy or rent for a city. This data does not identify you, your properties or any individual, and it is not personal data. If we ever combine it with personal data so that an individual can be identified, we treat the combined data as personal data under this policy. Our rules for creating it are in the Anonymisation Standard.
05Cookies and Tracking Technologies
We use cookies and similar tracking technologies on the StaySynced website and platform, including strictly necessary cookies for authentication and payments, and analytics cookies. For full details of the cookies we use and how to control them, see our Cookie Policy.
06International Transfers
The website, dashboard and data-transformation step run on UK-based infrastructure (Vercel functions in London; Microsoft Azure in UK South); Vercel’s deployment builds run in the US but operate on source code, not your personal data. Your account data is hosted within the EEA (Supabase, in Ireland); transfers from the UK to the EEA are covered by UK adequacy regulations. Some providers are US-headquartered (such as Stripe and Resend); where they process or access data outside the UK and EEA, including in the United States and India, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), Standard Contractual Clauses, or the EU-US Data Privacy Framework.
07Data Subject Rights and Complaints
Under the UK GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate personal data
- Erase your personal data (“right to be forgotten”)
- Restrict or object to processing
- Data portability
- Withdraw consent at any time where processing is based on consent
To exercise any of these rights, contact us at dataprotection@cloudfox.it. We will respond within one calendar month.
If you have a complaint about how we have handled your personal data, send it to dataprotection@cloudfox.it. We will acknowledge it within 30 days, look into it, and tell you the outcome.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk. Our ICO registration number is ZA932429.
08Data Security
We implement technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. See our Security overview. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
09Retention
We retain your data only as long as necessary for the purpose for which it was collected, or as required by law. Our retention periods are as follows:
| Data | Retention | Basis |
|---|---|---|
| Account & organisation data | Life of your subscription, then deleted within approximately 90 days | Contract / legitimate interest |
| Customer Data for reporting (operators’ tenant and applicant data) | Periodic snapshots for a rolling period of up to 36 months while the subscription is active, then deleted within 90 days of it ending | Contract (as processor) |
| Attribution records (website visitors) | IP address truncated and user agent removed after 30 days; record deleted after 13 months | Contract (as processor) |
| Event, audit and email logs | Approximately 24 months | Legitimate interest (security, troubleshooting) |
| Billing & invoice records | 6 years | Legal obligation (UK tax) |
| Backups | Rolling, no more than 30 days, then overwritten | Legitimate interest |
| Support correspondence | Approximately 24 months | Legitimate interest |
10Data Controller
The data controller for your account data is:
Cloudfox Group Limited
Company Number: 12154368 · VAT: 349380671 · ICO Registration: ZA932429
71-75 Shelton Street, London, Greater London, WC2H 9JQ, United Kingdom
Data protection lead: Eddie Lee, dataprotection@cloudfox.it
10AWhen we act for an operator
StaySynced extracts data from property operators’ systems about their tenants, applicants, leads and staff, and about visitors to their websites. For that data, the operator is the controller and Cloudfox is the operator’s processor. We process it only on the operator’s instructions, under our Data Processing Addendum.
If you are a tenant, applicant or website visitor and want to use your rights, or make a complaint, contact the operator you dealt with. If you contact us, we will pass your request to the operator without undue delay.
11Children’s Privacy
StaySynced accounts are for business users aged 18 or over, and we do not knowingly create an account for anyone under 18.
Operators may hold information about applicants and tenants under 18 in their own systems. If an operator connects that data to StaySynced, we process it only on the operator’s instructions under the Data Processing Addendum (see section 10A), with the same protections as other personal data. The operator is responsible for its lawful basis and for giving the required privacy information.
12Changes to this Policy
We will email account owners at least 30 days before a material change to this policy takes effect. Any other change is posted to this page with an updated effective date. If you do not want a material change, you may end your subscription before it takes effect, as set out in clause 14 of the Terms of Service.
13Contact
For privacy enquiries, contact dataprotection@cloudfox.it.