Privacy notice

Who is responsible

Data controller: Armen Sarkisian, Komitas 57, 0032 Yerevan, Armenia. Questions about your data: privacy@vitersoft.com.

What we collect

What you type into the check — the postcode and address, how many people and households live there, the rent, the tenancy dates, the landlord's or agent's name and your email address — and the files you choose to upload: your tenancy agreement, bank statements, a screenshot of the council's register, and anything your landlord sends you. When you ask for the papers we also store your full name and address, because they have to appear on them.

We do not store your IP address. Where we need to stop abuse we store a one-way hash of it, which cannot be turned back into an address.

Why we are allowed to hold it

We process your own details to give you the service you asked for (performance of a contract, UK GDPR Article 6(1)(b)). The landlord's or agent's name and address are someone else's personal data; we process them because you cannot apply for a rent repayment order without naming the respondent, which is a legitimate interest of yours and ours (Article 6(1)(f)). We publish no list of landlords and give their details to nobody but you and, if you ask us to, the firm you choose.

How long we keep it

Uploaded files are deleted 30 days after they are uploaded, and the case itself 60 days after it is created. You can delete everything sooner at any time, with the link in every email we send you or the button on your case page — that deletes the files and the record straight away.

If you asked us to tell you when we cover your council, we keep the address you gave, the first half of your postcode and the council's name for 180 days, and nothing else — not your address, not your case. Deleting your case takes that entry off the list as well, and so does asking us.

One thing is kept longer and holds nothing about you: the copy of the council's published register of licensed properties. It is public data, it is the evidence behind the answer we gave you, and deleting your case does not touch it.

Who else sees it

• Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) — serves the website and runs the code. Requests are handled in the EU.
• Supabase — the database and the private file store, hosted in the EU (Frankfurt).
• Sendinblue SAS, trading as Brevo, 9–17 rue Salneuve, 75017 Paris, France — sends the emails with your case link. Brevo puts an invisible image in every letter it sends, so it registers when a letter is opened and from roughly where. We do not ask for that, do not look at it and cannot switch it off per message — measured 19.09.2026, both documented switches were tried. The sign-in link itself is not rewritten and does not go through Brevo.
• PostHog (EU cloud, Germany) — counts how the tool is used. No cookies, no profile, and the events carry no personal data: no name, email, address or postcode ever reaches it.
• OpenRouter — only when you upload a screenshot of a council register and ask us to read it. The image is sent to the model that reads it and nothing else is.
• A partner firm — only if you tick the box asking us to send them your case file, and only the firm named on that screen.

Where data reaches the United States (Cloudflare), the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

Cookies

None. Licence Radar sets no cookies and stores nothing in your browser, which is why there is no cookie banner. Your case is identified only by the link in your email.

Your rights

You can ask for a copy of what we hold, ask us to correct it, or delete it. Deleting is immediate and needs no request: use the link in your email. You can also complain to the Information Commissioner's Office (ico.org.uk).