Privacy Policy
This policy explains what personal data we collect, why, and what rights you have. It covers our marketing website, the Property AI application, and our customer relationship system. If you are a tenant or landlord whose data appears in an inventory report, section 3 is the part that concerns you.
1. Who we are
Besmove Ltd trades as The Property AI. We provide software that lets letting agents, property managers, inventory clerks and landlords capture property condition evidence and generate inventory, check-in, check-out and inspection reports using artificial intelligence.
This policy applies to thepropertyai.co.uk (our website), app.thepropertyai.co.uk (the application) and crm.thepropertyai.co.uk (our internal customer system).
2. Our two roles
Data protection law distinguishes between a controller, who decides why and how personal data is used, and a processor, who acts on the controller's instructions. We are both, depending on the data.
| Data | Our role | Who is the controller |
|---|---|---|
| Property photographs, inventory and inspection reports, tenancy records, and the details of tenants, landlords, guarantors and contractors that our customers upload | Processor | Our customer — the agent, property manager or landlord who uses the Service |
| Account details of the people who sign up and use our software, billing records, support correspondence, website visitors, and marketing prospects | Controller | Besmove Ltd |
Where we are a processor, our customer decides what happens to the data. They choose what to collect, why, and how long to keep it, and they are responsible for having a lawful basis and for obtaining any consent needed from the people concerned. Our Terms of Service set out those obligations. We do not use that data for our own purposes.
3. If you are a tenant or landlord
If your details or photographs of a property you live in or own appear in a report created with The Property AI, we are handling that data on behalf of the agent, property manager or landlord who created it. They are the controller.
That means requests to see, correct or delete your data should go to them first, not to us. If you contact us directly, we will pass your request to the relevant customer and tell you we have done so. We cannot delete or alter a customer's records on your instruction alone, because they may need them for a tenancy deposit dispute or to meet their own legal obligations.
If you do not know who holds your data, contact us at [email protected] and we will help you identify the right organisation.
4. What we collect
4.1 As a controller
- Account data — name, work email, phone number, employer, job role, password (stored hashed).
- Billing data — billing address, subscription plan, invoices and payment history. Card details are handled by Stripe and never reach our servers.
- Usage data — pages viewed, features used, device and browser type, approximate location derived from IP address, and error logs.
- Communications — emails, support messages, demo bookings, and call recordings or transcripts where we tell you a call is being recorded.
- Prospect data — business contact details of people at agencies we believe may be interested in the product, obtained from public sources or provided to us directly.
4.2 As a processor
Whatever our customer chooses to put into the Service. Typically that means property photographs and video, room-by-room condition notes, meter readings, tenancy dates and addresses, and the names and contact details of tenants, landlords, guarantors and contractors.
5. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the Service and supporting our customers | Performance of a contract |
| Taking payment and keeping accounting records | Contract, and legal obligation |
| Securing the Service, preventing fraud and abuse | Legitimate interests — keeping the platform and its users safe |
| Improving the Service and diagnosing faults | Legitimate interests — understanding how the product is used |
| Sending service messages such as billing and security notices | Contract |
| Marketing to business contacts about our products | Legitimate interests, or consent where the law requires it. You can opt out at any time. |
| Website analytics | Consent — see section 11 |
| Meeting legal and regulatory obligations | Legal obligation |
Where we rely on legitimate interests, we have considered the effect on you and you have the right to object — see section 12.
6. AI processing of photographs
When a customer uploads property photographs, those images are sent to Google (Gemini API) for automated analysis, which produces draft condition descriptions and suggested findings.
Photographs of a property's interior can incidentally capture personal belongings, documents or, occasionally, people. Our customers are responsible for what they photograph and for telling the people concerned. Reports are drafts that must be reviewed by a person before being relied on — automated analysis can misidentify items and miss defects, and we do not make automated decisions that produce legal or similarly significant effects about anyone.
We do not use customer data to train third-party AI models. We may use aggregated, anonymised statistics, which cannot identify any person or organisation, to improve the Service.
7. Sub-processors
We use the following providers to deliver the Service. Each is bound by a contract requiring appropriate protection for personal data.
| Provider | Purpose | Primary location |
|---|---|---|
| Amazon Web Services | Server hosting and file storage for reports and photographs | UK (London, eu-west-2) |
| Supabase | Application database, authentication and storage | EU / UK |
| DigitalOcean | Hosting for the application | EU / UK |
| Cloudflare | Content delivery, DNS and security filtering | Global edge network |
| Google (Gemini API) | AI analysis of property photographs | EU / US |
| Google Maps Platform | Address lookup and validation | EU / US |
| Google Analytics | Website analytics | EU / US |
| Stripe | Subscription payments and card processing | EU / US |
| Twilio | SMS, WhatsApp and voice notifications | EU / US |
| ElevenLabs | AI voice for booking and enquiry calls | EU / US |
| Resend | Transactional email from the application | EU / US |
| Elastic Email | Outbound business email and campaigns | EU / US |
| Zoho | Inbound email for our business mailboxes | EU |
| xAI | AI assistance within our internal customer system | US |
We will give customers notice of material changes to this list so they can raise any reasonable data protection objection.
8. International transfers
Some providers listed above process data outside the UK. Where that happens, we rely on an appropriate safeguard — UK adequacy regulations where they apply, or the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, together with additional technical measures such as encryption in transit and at rest.
9. How long we keep data
| Data | Retention |
|---|---|
| Customer Data, after a subscription ends | Available for export for 30 days, then deleted or anonymised within a further 90 days |
| Routine backups | Deleted on their normal rotation cycle |
| Account and billing records | 6 years after the end of the relationship, to meet accounting and tax obligations |
| Support correspondence | 3 years |
| Website analytics | 14 months |
| Marketing prospect data | Until you opt out, or 2 years without engagement, whichever is sooner |
Where we are a processor, our customer may instruct a shorter or longer period within the limits above.
10. Security
We protect personal data with measures appropriate to the risk, including encryption in transit and at rest, role-based access control, tenant isolation so one customer cannot see another's data, hashed passwords, restricted administrative access, logging, and regular patching of our systems.
No system is perfectly secure. If a personal data breach affects data we hold, we will notify affected customers without undue delay and, where required, report it to the Information Commissioner's Office.
11. Cookies and analytics
We use cookies that are strictly necessary for the site and application to function, including keeping you signed in. These do not require consent.
We also use Google Analytics 4 (measurement ID G-6NJZPB6KQE) to understand how the website is used, such as which pages are visited and how visitors arrive. Analytics cookies are not necessary for the site to work, so we do not set them until you accept them.
When you first visit, a banner asks whether to allow optional analytics cookies. Until you choose, analytics and advertising storage are switched off using Google Consent Mode, and no analytics cookies are written. Rejecting is as easy as accepting — both are a single click.
You can change your mind at any time using the Cookie settings link in the footer of any page. You can also install Google's opt-out browser add-on, or block and delete cookies for this site in your browser settings.
Blocking strictly necessary cookies may stop parts of the Service working.
12. Your rights
Under the UK GDPR you have the right to:
- be told how your data is used, which this policy does;
- access a copy of your personal data;
- have inaccurate data corrected;
- have data erased, in certain circumstances;
- restrict how we use your data, in certain circumstances;
- receive your data in a portable format, and have it sent to another provider;
- object to processing based on legitimate interests, including profiling; and
- object to direct marketing at any time, with no exceptions.
To exercise any of these, email [email protected]. We will respond within one month. We may ask you to verify your identity first.
If your data was uploaded by an agent or landlord, please read section 3 — your request should go to them, as they are the controller.
13. Children
The Service is not directed at children and we do not knowingly collect data from anyone under 16 as a controller. Where a customer's tenancy records include a minor, that data is handled under the customer's instructions and their lawful basis.
14. Changes to this policy
We may update this policy to reflect changes to the Service, our providers, or the law. We will publish the updated version here and change the "last updated" date. Where a change materially affects how we use your personal data, we will tell you by email or in-app before it takes effect.
15. Contact and complaints
For any privacy question or to exercise your rights:
Besmove Ltd
128 City Road, London EC1V 2NX, United Kingdom
Company number 08361274
[email protected]
If you are unhappy with how we have handled your data, you can complain to the UK supervisory authority:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113 · ico.org.uk/make-a-complaint
We would appreciate the chance to address your concern first.