Privacy Policy

• Account and authentication data — email address, password credentials held in hashed form by our authentication provider, or the identifier, email and basic profile returned by Google or Apple if you choose that sign-in method, plus sign-in timestamps and one-time codes sent by email.
• Profile data — display name, your investment criteria (target cash-on-cash return and cash flow), onboarding status and plan tier.
• Property and deal data — the deals you create and save, including addresses, prices, rents, refurbishment figures, comparables, due-diligence answers and free-text notes, and any listing URLs you paste.
• Beta programme data — beta applications and launch-waitlist entries (name, email, which option you chose), the feedback, bug reports and ideas you submit, and operational notes our administrators keep about beta participation.
• Subscription data — plan status, subscription and customer identifiers and billing period dates received from our payment provider. We do not receive or store your card details.
• Communications — emails we send you (confirmation, sign-in codes, beta lifecycle messages) and any correspondence you send us.
• Technical and security data — server and error logs generated when you use the app, which can include IP address, browser user agent and request details.
• Legal acceptance evidence — when you accept our Beta Testing Terms we record your user ID, the document and version, the exact time, the sign-in method used, your browser user agent, and a one-way hashed value derived from your IP address. We store the hash, not the IP address itself. These records cannot be edited or deleted in the ordinary course, because their purpose is to evidence what was agreed.

• Providing ACQR — creating your account, saving and analysing your deals, running the listing analyser, managing plans and limits. Basis: performance of our contract with you.
• Running the closed beta — reviewing applications, granting access, handling feedback and sending beta lifecycle emails. Basis: performance of a contract or steps taken at your request, and our legitimate interest in operating a controlled beta.
• Security, abuse prevention, debugging and service improvement. Basis: our legitimate interests in a secure, working service.
• Evidencing agreement to our terms. Basis: our legitimate interests in establishing and defending legal claims and demonstrating what was agreed.
• Payments, accounting and tax records. Basis: contract and compliance with legal obligations.
• Launch notifications if you asked to be told when ACQR launches. Basis: your consent, which you can withdraw at any time.

We do not treat acknowledgement of this policy as consent: consent is only used where it is genuinely optional, such as launch notifications.

We do not sell personal data. We share it only with providers acting on our instructions, or where the law requires:

• Lovable Cloud (Supabase infrastructure) — authentication, database and application hosting.
• Google and Apple — only where you choose their sign-in option; the provider confirms your identity and returns basic profile details.
• Lovable managed email — delivery of transactional and authentication emails.
• Firecrawl — retrieves the content of listing pages you paste into the analyser.
• Lovable AI Gateway and the underlying AI model provider — extracts deal facts from that listing content. The model currently used is a Google Gemini model; the specific model or provider may change as the feature evolves, and this policy covers whichever model provider is used for that purpose.
• Paddle — payment and subscription processing as merchant of record. Paddle handles your payment details directly under its own privacy notice.

We currently use no advertising, analytics or third-party error-monitoring providers.

When you use the automated listing analyser, the URL you paste and the content retrieved from that page leave ACQR and are processed by our scraping and AI providers so that deal facts can be extracted. Listing pages sometimes contain personal data, such as agent or seller details. Please avoid submitting URLs or text containing personal or sensitive information that is not needed for the analysis, and do not paste confidential third-party material.

ACQR verdicts and estimates are automated, but they are decision-support outputs about a property, produced from figures you supply or accept. They do not make decisions producing legal or similarly significant effects about you or any other individual, and a human — you — remains in control of every investment decision.

Some of our providers process data outside the UK. Where that happens we rely on appropriate safeguards, such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with the provider's own security measures. You can ask us for details of the safeguards used for a particular provider.

• Account, profile and deal data — for as long as your account is active, and for a short period afterwards to allow recovery, then deleted or anonymised.
• Beta applications, waitlist entries and feedback — for as long as needed to run and evaluate the beta programme.
• Billing and tax records — for the period required by law (generally six years).
• Legal acceptance records — retained for as long as needed to evidence the agreement and any related legal claims, which may outlast the account itself.
• Server and security logs — kept for a short operational period.

Access to your data is restricted by database row-level security so that you can only reach your own records, administrative functions are limited to authorised administrator accounts, credentials and secrets are stored server-side only, and traffic is encrypted in transit. No service can be perfectly secure, so please use a strong, unique password and report any concern to hello@acqr-property.com.

Under UK data protection law you have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing (including where we rely on legitimate interests), to data portability, and to withdraw consent where consent applies. Some records — notably legal acceptance evidence and billing records — may be retained despite an erasure request where we need them to establish, exercise or defend legal claims or to meet a legal obligation.

When we action an erasure request we either delete the account or anonymise it. In both cases your saved deals, notes and comparables are deleted, administrator beta notes are removed, subscription identifiers are cleared, any landing-page beta or waitlist entry matching your email is deleted, and feedback you submitted is either deleted or stripped of its content. Deletion also removes your authentication account; anonymisation replaces your name and email address with a non-identifying placeholder where a record must remain. Your legal acceptance records survive erasure for the reason given above, and each erasure is itself recorded in an administrator-only, tamper-resistant log holding the internal user reference, a one-way hash of the email address, who carried it out, the method used, an optional reason and counts of what was removed. That log holds no readable contact details and exists so we can evidence that a request was honoured.

To exercise a right, email hello@acqr-property.com. You can also complain to the Information Commissioner's Office (ico.org.uk), though we would appreciate the chance to help first.

• We only send launch or marketing emails to people who asked for them, and every such email includes a way to opt out. Service and account emails are not marketing.
• ACQR is for adults; it is not intended for anyone under 18.
• Our site links to third-party sites, including property portals. Their privacy practices are their own.
• We may update this policy; the version and date at the top of this page show the current release and we will flag material changes in the app.