Record of processing — last updated 27 August 2026
Privacy & data handling
QuayMark holds real licences, certificates and insurance documents. This notice sets out exactly what we collect, why, how long we keep it, who processes it on our behalf, and how you get it back or have it erased. It describes what the software actually does — not a generic template.
Who is responsible
You are the person whose data this is. QuayMark is the controller for the account and compliance records you create here. For anything you are asked to prove to a licensing authority, letting platform or insurer, you remain the one who decides what to share.
What we collect, and why
| Data | What it includes | Why we hold it |
|---|---|---|
| Account details | Email address, password (stored only as a hash by our auth provider), plan tier, sign-up date. | To create your account, sign you in, and apply your plan's property allowance. |
| Property records | Property name, licensing authority (council), licence type, and whether the property has gas appliances. | To work out which documents you are required to hold and to show your compliance status. |
| Compliance documents | Document type, reference/licence number, expiry date, and the file you upload (PDF, JPG or PNG) — typically your STL licence, fire risk assessment, gas safety certificate, EICR and public liability insurance. | To track validity, warn you before renewal deadlines, and produce your renewal pack. |
| Reminder history | Which reminder emails were sent for which document and when. | So you are not emailed the same warning twice. |
| Billing records | Subscription status, plan, price, renewal date and Stripe customer/subscription identifiers. | To run your subscription and show accurate billing status. Card details are handled by Stripe and never reach QuayMark's servers or database. |
| Agent connections (optional) | If you connect an AI assistant over MCP, the access you granted and which of your records it read. | To let an assistant answer questions about your own portfolio. It can only ever see rows belonging to your signed-in account. |
We do not use tracking or advertising cookies, we do not sell or share your data with third parties for their own purposes, we do not read the contents of your uploaded certificates, and we do not connect to Airbnb, Vrbo or any booking platform.
Legal basis (UK GDPR)
- Contract — running your account, storing your documents, calculating statuses, sending deadline reminders and generating renewal packs.
- Legitimate interests — keeping the service secure and preventing abuse, and keeping basic billing records.
- Legal obligation — retaining payment and tax records for the periods UK law requires.
Where your data is physically stored
The database, file storage and authentication are provided by Supabase, acting as our processor, on infrastructure hosted in Frankfurt, Germany (AWS eu-central-1) — inside the EU. Uploaded files sit in a private bucket, not on the public internet; they are reachable only through short-lived links issued to your signed-in session.
For UK GDPR purposes, transfers from the UK to the EEA are covered by the UK's adequacy regulations for the EEA, so no additional transfer safeguards are required for this hosting. Our other processors are Stripe (payments — card data never touches QuayMark) and our transactional email provider (reminder emails), which may process limited data outside the UK/EEA under standard contractual clauses and the UK International Data Transfer Addendum.
How long we keep it
- While your account is open — properties, documents and uploaded files are kept until you delete them or close your account, because expired certificates are often exactly what a council or insurer asks you to evidence.
- When you delete a document or property — the record and its file are removed straight away.
- When you close your account — properties, documents, uploaded files, reminder history and your profile are deleted, and your login is removed. This is immediate and irreversible.
- Billing records — retained by Stripe, and in summary form by us, for up to 7 years to meet UK accounting and tax requirements.
Who can see your records
Only you. Access is enforced in the database itself with row-level security, not just in the interface: every request is scoped to the signed-in account, so no other host — and no AI assistant connected to another account — can be handed your rows or your files. Uploaded files live in a private bucket under a folder tied to your account, and every download link is generated only after that ownership check and expires within minutes.
Your rights, and how to use them
You can exercise these yourself from Settings → Your data inside the app:
- Export — download a machine-readable JSON file of your account, properties, documents and billing records. Your uploaded files can be downloaded from each property, or we will supply them on request.
- Deletion — permanently erase your account, records and files.
You also have the right to correct inaccurate data (edit it in the app), to object to or restrict certain processing, and to complain to the UK Information Commissioner's Office at ico.org.uk. For anything you cannot do in-app, email the address below and we will respond within one month.
Contact
Data protection queries, export or deletion requests: hello@quaymark.co.uk
QuayMark is record-keeping software, not legal advice. Always confirm licensing requirements with your licensing authority.