Privacy Policy

This Privacy Policy explains how Struxure collects, uses, stores, and shares personal information when you use our website and web application ("Struxure", "we", "us", or "our"). It applies to everyone who uses Struxure, including landlords, property investors, tenants, contractors, and website visitors.

We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable UK electronic communications and cookie rules.

Struxure is a property compliance and management platform. It helps landlords and property investors track deals, manage tenancies, monitor compliance certificates, communicate with contractors, analyse portfolio performance, and use AI tools to assist with routine property-management tasks.

This policy covers:

• Our public website and landing pages.
• The authenticated web application used by landlords, investors, and admins.
• The tenant portal used by tenants.
• The AI features, email integrations, and payment processing built into Struxure.

It does not cover any third-party websites or services we link to (such as Rightmove, Zoopla, Stripe, Google, or Microsoft) — each of those has its own privacy policy.

Struxure acts as the data controller for personal information we collect directly from you to run our business — for example, your account details, billing information, support requests, feedback, and marketing communications.

Where you use Struxure to store information about other people — such as tenants, contractors, investors, or co-owners — you are likely the data controller for that information and Struxure acts as a data processor on your behalf. You are responsible for ensuring you have a lawful basis to add those individuals' details to Struxure and for complying with your own data-protection obligations as a landlord or business.

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us at the email address above.

This policy applies to:

• Account holders — landlords, property investors, and property managers who create a Struxure account.
• Tenants — individuals whose details are entered by a landlord, and who may access the tenant portal.
• Contractors and engineers — contacts whose details are entered by a landlord so compliance communications can be sent to them.
• Investors and co-owners — individuals whose investment details are recorded by an account holder.
• Website visitors — people who visit our landing page and join the waitlist or use the free interactive tools.
• Admin users — Struxure staff who manage the platform.

Information you give us when you create an account:

• Your email address
• Your password (stored as a hash by our authentication provider — we never see the plain-text password)
• Your full name and role (landlord/investor or tenant)

Information you give us through the website (before you have an account):

• Your email address (if you join the waitlist or use the Section 8 Readiness Check or Portfolio Health Check)
• Your answers to the interactive check tools (used to produce a score and a report — these tools do not assess or state your legal compliance position)

Information you enter about your properties and portfolio:

• Property addresses, postcodes, purchase prices, valuations, mortgage details, rent amounts, occupancy status, images, and notes
• Deal pipeline information (asking prices, offers, notes, documents)
• Investment calculator scenarios

Information you enter about tenants:

• Tenant names, email addresses, phone numbers, lease dates, rent amounts, deposit amounts, and notes
• Tenancy onboarding records (deposit protection, Right to Rent, inventory, contract signing)

Information you enter about contractors and contacts:

• Names, company names, email addresses, phone numbers, trade categories, insurance provider details, policy numbers, and expiry dates

Information you enter about investors and co-owners:

• Names, email addresses, phone numbers, investment amounts, ownership percentages, and returns

Information collected through email integrations (when you connect Gmail or Outlook):

• Your connected email address
• Email messages sent to and from your connected inbox (subjects, bodies, attachments) when they relate to compliance conversations
• Attachments downloaded from your inbox (certificates, invoices, photos) and stored in Struxure

Information collected through compliance and maintenance features:

• Compliance certificate types, expiry dates, renewal dates, assigned contacts, and uploaded certificate files
• Maintenance ticket titles, descriptions, images, and assigned contractors
• Lease documents, signing records (including the signer's name and IP address), and tenancy terms

Information collected through AI features:

• Search criteria for the AI Deal Finder (location, price, bedrooms, strategy)
• Room photos uploaded for AI virtual staging
• Receipt and invoice images uploaded for AI expense analysis
• Portfolio data (property addresses, valuations, rent, expenses, tenant counts) sent to the AI for portfolio health analysis

Information collected through financial features:

• Rent payments, rent invoices, rent schedules, expenses, and investor distributions
• Stripe customer ID and subscription status (for billing)

Information collected through support and feedback features:

• Support ticket subjects, descriptions, categories, and message threads
• Star ratings and free-text feedback comments
• Feature request titles, descriptions, and votes

Information collected automatically:

• Your IP address (recorded when you sign a lease digitally)
• Your usage events (which features you use, tracked via our analytics system)
• Browser local storage (for UI preferences such as sidebar state)
• Authentication tokens and session identifiers (managed by our hosting platform)

When you (as a landlord or property manager) add information about tenants, contractors, investors, or other individuals, you are providing their personal information to Struxure. This may include names, email addresses, phone numbers, lease details, and financial information.

You are responsible for:

• Ensuring you have a lawful basis to collect and store that information.
• Informing those individuals that their data is being processed in Struxure.
• Responding to any data-subject access requests they make about information you have entered.

Struxure processes this information on your behalf to provide the features you have requested. We do not use tenant, contractor, or investor personal information for our own marketing or commercial purposes.

We obtain personal information from:

• Information you give us — when you register, complete your profile, add properties, tenants, contacts, or use any form.
• Information from your connected accounts — when you link your Gmail or Outlook account, we retrieve email messages and attachments you choose to sync.
• Information generated by AI — when you use AI features, the AI models generate outputs (drafts, analyses, staged images) that become part of your records.
• Information from public property portals — when you use the AI Deal Finder, we fetch publicly available property listing pages from portals such as Rightmove, Zoopla, OnTheMarket, OpenRent, Gumtree, and auction sites.
• Information collected automatically — usage analytics, IP addresses (for lease signing), and device/browser data managed by our platform.

We use your personal information to:

• Create and manage your account and authenticate your login.
• Provide the property management, compliance, tenancy, and financial features you have requested.
• Send and receive compliance emails on your behalf through your connected Gmail or Outlook account.
• Use AI to draft emails, analyse incoming contractor replies, extract certificate and invoice data, and generate auto-replies.
• Track and remind you about upcoming compliance certificate renewals.
• Process subscription payments through Stripe.
• Provide the tenant portal so tenants can view their rent, maintenance, compliance, and documents.
• Generate AI virtual staging images for property photos.
• Discover and analyse property deals using AI and public property portals.
• Analyse your portfolio health using AI.
• Provide customer support and respond to your enquiries.
• Collect feedback and feature requests.
• Maintain the security and integrity of the platform (audit logs, admin actions).
• Send you service-related emails (such as waitlist confirmations, checklists, and account notifications).

Struxure stores detailed records about your properties, including:

• Property addresses, purchase prices, valuations, and mortgage details.
• Compliance items (gas safety certificates, EPCs, EICRs, fire safety checks, PAT testing, legionella risk assessments, HMO licences) with expiry dates, renewal dates, and assigned contractors.
• Evidence checks for possession readiness (Section 8), including whether documents were served on tenants and proof of service.
• Tenancy onboarding records (deposit payment, deposit protection, Right to Rent, inventory, contract signing).

These records are stored in the Struxure database and are visible only to you and platform admins. They are used to help you track your legal obligations as a landlord. Struxure does not provide legal advice — the compliance tracking is a record-keeping tool, and you remain responsible for ensuring your compliance with applicable housing law.

When you connect your Gmail or Outlook account, Struxure can:

• Read your inbox to sync email threads related to compliance conversations.
• Send emails on your behalf (AI-drafted compliance renewal requests, auto-replies to contractors, tenant notifications, and thank-you emails).
• Download attachments (certificates, invoices, photos) from emails and store them in Struxure.
• Analyse email content using AI to detect booking intent, work completion, certificate receipts, and invoice details.

Gmail access is authorised via Google OAuth with the gmail.send, gmail.readonly, and email scopes. You can disconnect Gmail at any time in Settings, which revokes Struxure's access.

Outlook access is authorised via Microsoft OAuth and is currently used to confirm your connected email address.

AI auto-reply: When a contractor replies to a compliance email, the AI analyses their message. If auto-reply is enabled and the AI's confidence is high (85% or above), it may send a reply automatically. If confidence is below 85%, or if the email mentions payment, invoices, or additional costs, a draft is created for your review instead. You can disable auto-reply in Settings.

SMS: Struxure does not currently send SMS messages.

When you upload files to Struxure (property images, certificate PDFs, lease documents, receipt photos, maintenance photos), they are stored in our platform's file storage. Files you upload are:

• Linked to the relevant property, tenant, or compliance item.
• Accessible only to you and platform admins (unless shared via the tenant portal with the relevant tenant).
• Used by AI features when you request analysis (e.g. certificate date extraction, invoice data extraction, receipt classification, virtual staging).

Files received as email attachments are downloaded from your connected Gmail account and uploaded to Struxure storage so they can be linked to the relevant property and compliance record.

Struxure uses AI (large language models and image generation models) for several features. For each AI feature, the table below explains what information is processed, why, what output is produced, whether a person reviews it, and which provider receives it.

Yes. When you use AI features, the relevant information (as described in the table above) is sent to third-party AI model providers via our platform's AI integration layer. The providers we have identified are:

• Google (Gemini models) — used for the AI Deal Finder with web search capability.
• Anthropic (Claude Sonnet) — used for Portfolio Health AI analysis.
• OpenAI (GPT models) — available as an option for various AI features.
• Base44 automatic model selection — the platform may select the most appropriate model for a given task.

The specific model used depends on the feature. Some features use a fixed model (e.g. Portfolio Health uses Claude Sonnet); others use the platform's automatic model selection.

We do not use your personal information to train our own AI models. Struxure does not build or train proprietary AI models — we use third-party models provided through our platform.

• AI-drafted emails: By default, AI-drafted compliance emails are saved as drafts for your review. You can enable "auto-send" in Settings, which allows the AI to send renewal emails directly to contractors without your approval. Even with auto-send enabled, the AI falls back to a draft if no contact email is available or if Gmail is not connected.
• AI auto-replies to contractors: Auto-replies are sent automatically only when the AI's confidence is 85% or above and the email does not mention payment, invoices, or additional costs. Otherwise, a draft is created for your review.
• AI certificate extraction: The AI extracts dates from certificates and updates your compliance records automatically. Low-confidence results are flagged for your review. You can dismiss any certificate banner.
• AI invoice processing: Invoices are analysed and a payable review record is created with AI flags and assessment. You must review and approve or reject before any payment is made. Struxure does not make payments automatically.
• AI portfolio health: The AI provides recommendations and insights. You decide whether to act on them.
• AI deal analysis: The AI provides estimates and risk flags. You decide whether to pursue any deal.
• AI Room Studio: You choose whether to use or discard the generated image.

Struxure does not make solely automated decisions with legal or similarly significant effects about you. All AI outputs are either:

• Reviewed by you before action is taken (e.g. email drafts, invoice reviews), or
• Administrative in nature (e.g. auto-replying to a contractor to confirm a booking, sending a thank-you email, updating a compliance status), and can be overridden or dismissed by you.

The AI does not:

• Make final decisions about whether a property is legally compliant.
• Make final decisions about whether to evict a tenant or start possession proceedings.
• Make final decisions about whether to pay an invoice.
• Make final decisions about whether to invest in a property.
• Make final decisions about tenancy, lease, or financial matters.

All such decisions remain with you. The AI provides information, drafts, and suggestions to assist you — but you are responsible for the final decision.

Authentication and session management:

Our hosting platform (Base44) uses authentication tokens and session identifiers to keep you logged in.

Local storage:

Struxure stores UI preferences (such as whether the sidebar is collapsed) in your browser's local storage. This does not contain personal information and is not shared with us.

Analytics:

We track usage events (such as which features you use) via our platform's analytics system to help us improve Struxure. These events do not include sensitive personal information.

Third-party cookies:

• When you connect your Gmail or Outlook account, Google or Microsoft may set their own cookies during the OAuth flow. These are governed by those providers' privacy policies.
• We do not use Google Analytics, Google AdSense, or any third-party advertising or tracking cookies on our website.

We share personal information with the following third parties:

We do not sell your personal information to any third party.

Your personal information is stored on the Base44 platform.

When your information is sent to Stripe, Google (Gmail), or Microsoft (Outlook), those providers may process data outside the UK. Each provider has its own international transfer safeguards — please refer to their privacy policies.

We retain your personal information for as long as your account is active. When you delete your account, Struxure permanently deletes all data you own across every entity. The table below summarises retention for each data type:

Account deletion: You can delete your account at any time in Settings. When you do, Struxure permanently deletes all data you own — including properties, tenants, documents, communications, contacts, compliance items, deals, investors, leases, AI data, support tickets, feedback, feature requests, and waitlist entries. Admin audit logs are retained for security accountability. The authentication identity itself is managed by our auth provider and you will be logged out.

We take reasonable steps to protect your personal information, including:

• Authentication: Passwords are hashed by our authentication provider. We never store or see your plain-text password.
• Row-level security: Each account holder can only access their own data (and data they have entered). Admin users can access all data for platform management.
• OAuth for email integrations: Gmail and Outlook access is granted via OAuth — we never store your email password. Access tokens are managed securely by the platform.
• HTTPS encryption: All data transmitted between your browser and Struxure is encrypted.
• Server-side processing: Sensitive operations (billing, AI calls, email sending, data deletion) are performed on the server, not in your browser.
• Input sanitisation: User-generated content (feedback, feature requests) is sanitised server-side to prevent cross-site scripting attacks.
• Rate limiting: Form submissions (such as feedback) are rate-limited to prevent abuse.

No system can be guaranteed to be 100% secure. While we take all reasonable steps to protect your information, we cannot guarantee absolute security.

When you add information about tenants, contractors, investors, or other individuals to Struxure, you are responsible for:

• Ensuring you have a lawful basis to collect and store their personal information.
• Informing them that their information is being processed in Struxure.
• Providing them with a copy of this Privacy Policy (or your own privacy policy if you are the data controller).
• Responding to their requests to access, correct, or delete their personal information.
• Ensuring the information you enter is accurate and up to date.
• Removing information about individuals when it is no longer needed (e.g. when a tenancy ends or a contractor relationship ceases).

If a tenant, contractor, or other individual asks us to access, correct, or delete their information, we will direct them to you (as the data controller for that information) unless the request relates to information we hold as data controller.

Under UK GDPR, you have the following rights:

• Right of access: You can ask for a copy of the personal information we hold about you.
• Right to rectification: You can ask us to correct information that is inaccurate or incomplete.
• Right to erasure: You can ask us to delete your personal information (you can also do this yourself in Settings).
• Right to restriction: You can ask us to restrict the processing of your information in certain circumstances.
• Right to data portability: You can ask for your personal information in a structured, machine-readable format.
• Right to object: You can object to our processing of your information based on legitimate interests.
• Right to withdraw consent: Where we rely on consent (e.g. Gmail/Outlook connection, marketing emails), you can withdraw it at any time.

To exercise any of these rights, please contact us at [CONFIRM: privacy contact email].

Where we rely on consent as the lawful basis:

• Gmail connection: You can disconnect your Gmail account in Settings at any time. This revokes Struxure's access to your inbox.
• Outlook connection: You can disconnect your Outlook account in Settings at any time.
• Marketing emails (waitlist): You can unsubscribe using the link in any marketing email or by contacting us.

Withdrawing consent does not affect the lawfulness of any processing we carried out before you withdrew consent.

• Disconnect Gmail: Go to Settings → Email & AI → click "Disconnect" on the Gmail banner.
• Disconnect Outlook: Go to Settings → Email & AI → click "Disconnect" on the Outlook banner.
• Delete your account: Go to Settings → Account → "Delete Account." This permanently deletes all data you own across the platform and logs you out. This action cannot be undone.
• Request data export or deletion by email: Contact us at [CONFIRM: privacy contact email] if you prefer to make a request in writing.

If you are not satisfied with how we handle your personal information, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We encourage you to contact us first so we can try to resolve your concerns.

Struxure is not intended for use by children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, features, or legal requirements. We will update the "Last updated" date at the top of this page whenever we make changes. If we make significant changes, we will notify you in the app or by email.

• Effective date: 2 September 2026
• Last updated: 2 September 2026

For any questions, requests, or concerns about this Privacy Policy or your personal information, please contact: