Valuation Studio · 11 September 2026

Privacy in Valuation Studio.

This notice covers Studio accounts, support and the property tools. The business shown on a customer page also provides its own privacy notice.

Who is responsible

The Upgrade Authority Ltd, company number 13983241, is responsible for Studio account administration, service security and our own communications. Our address is Henleaze House Business Centre, 13 Harbury Road, Henleaze, Bristol, England, BS9 4PN. Contact hello@theupgradeauthority.co.uk about privacy or your rights.

The property business named on a branded page decides why it collects visitor details and how it follows up. It is the controller of those enquiries. We store and process them for that business. Contact the business through the details and privacy notice shown on its page about its use of your enquiry. We will help route a request if the responsible business is unclear.

What Studio handles

For account holders, we handle the verified email address, business and website details, branding, access status, accepted terms and the dates of registration, setup and use. A shared authentication provider may already hold a login used for another Upgraded product. Each product’s access and customer information are separate; closing Studio does not automatically close the other products.

For visitors, the tool may handle a postcode, optional address, property type, bedroom count, generated reports, questions and conversation replies. If you choose to share them, it also handles your name, email, optional phone number, property plans and your contact and marketing choices. The website may supply a campaign, referring page or source so the property business can understand where an enquiry came from. Reports may include published records of property transactions.

Hosting and security systems handle request times, IP addresses, browser and device information and diagnostic information. The app uses protected cookies for sign in and a browser session identifier to restore an open visitor conversation. A support session uses an additional protected cookie and records the staff member, account, reason, time and actions. Studio does not add advertising pixels or analytics cookies to a customer widget.

Enquiry emails

If you enable enquiry emails, we send them to your confirmed account address. They contain a link to the enquiry rather than the visitor’s contact details or conversation. We keep your preference and delivery records so you can check whether an alert was accepted, delivered or unsuccessful. You can turn these emails off in your studio. Delivery status does not show whether you read the enquiry.

Subscriptions and billing

If your business buys a subscription, Stripe processes its payment and tax details. We keep the customer and subscription references, payment and invoice status, accepted offer, report usage and cancellation records needed to provide the service, handle billing and meet our legal obligations. We do not receive full payment card numbers. Accounting records are normally kept for six years after the relevant financial year, or longer where law or an unresolved claim requires it.

Why it is used

We use account and business details to provide the requested service and administer the agreement. Where an employee uses a business account, we rely on our legitimate interest in serving that business and managing access. Security, abuse prevention, diagnostics and support rely on our legitimate interests in operating a reliable service. We keep evidence of agreement and relevant records to meet legal obligations or establish, exercise or defend claims.

Visitor data is processed on the property business’s instructions to provide the report and handle the enquiry. That business must explain its own lawful basis. The separate marketing choice is optional and starts unchecked. You can use the demonstration without providing contact details. A property business may require contact details for its own report; the form explains when that applies.

The assistant and service providers

The AI assistant can process the conversation and property facts to understand a request and choose the next step. OpenAI provides this processing. Do not include sensitive personal details in chat. The app requests that API responses are not stored as retrievable responses. This does not mean that all provider security or abuse records are disabled. The assistant does not decide eligibility for housing, credit or a mortgage and does not make decisions with legal or similarly significant effects.

Vercel provides application hosting and delivery. Supabase provides authentication and database infrastructure. Resend delivers sign in emails and enquiry alerts. OpenAI provides assistant processing. Stripe handles subscription payments and billing when a paid service is purchased. Postcodes.io receives a postcode for location lookup, and official property data services receive the relevant search geography when a report is requested. We do not send contact form fields to those property data services. Suppliers may process information outside the UK. You can request the current supplier and transfer details and the applicable contractual safeguards from us. We do not sell personal information.

Retention and deletion

Account information is kept while the Studio account is active and afterwards only as needed for an outstanding request, security investigation, legal obligation or claim. Visitor enquiries, reports and conversations remain in the business’s workspace until the business deletes them or instructs us to close and delete the workspace. The business must decide how long its enquiries are needed and review them accordingly. A visitor session expiring after 30 days does not delete the enquiry.

Temporary enquiry email content is cleared when the email provider accepts it, when delivery is closed or when the associated enquiry or consent is removed. Delivery records retain identifiers, timestamps and outcomes. A record derived from an email address may be retained to prevent further delivery following a bounce or complaint. Authorised account holders can delete enquiries and export their contact records. They can ask us to return or delete the remaining workspace data. Support access expires after 30 minutes, while the audit record remains for accountability and investigation. Deleted live records may remain in restricted provider backups until those backups expire under the provider’s retention arrangements. They are not used to restore an active customer record except as part of a controlled recovery where deletion instructions are reapplied.

Your choices and rights

Depending on the processing, you may ask for access, correction, deletion, restriction or portability of your information. You may object to processing based on legitimate interests, including the account and security uses described above. You may withdraw marketing consent at any time by contacting the business that sends the marketing; withdrawal does not change the lawfulness of earlier processing. We may need proportionate information to verify a request and protect another person’s data.

Contact us or the property business identified on the page to exercise your rights. You also have the right to complain to the Information Commissioner’s Office. We will update this notice when the service or its processing materially changes.

Pricing · Pilot terms · Subscription terms · Privacy · Data processing agreement

Questions can be sent to hello@theupgradeauthority.co.uk.