Privacy Notice
Mydasoft Limited · Version 2.4 · 22 August 2026
This notice explains how Mydasoft Limited ("Mydasoft", "we", "us") collects and uses personal data, and your rights under the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
For a shorter, plain-English summary of how we handle your data as a landlord, see our Landlord Data Protection Summary. This Privacy Notice remains the full, legally complete version.
Who we are
Data controller: Mydasoft Limited, a company registered in England and Wales.
Company number: 17343775.
Registered address: 8 Thurne Way, Rudgwick, West Sussex, RH12 3ER.
ICO registration: We are registered with the Information Commissioner's Office. Registration reference: ZC200045.
Contact for data protection matters: contact@mydasoft.com.
What we do
Mydasoft is a document storage and renewal-reminder platform for landlords. You upload your property documents — things like your mortgage offer, tenancy agreement, gas safety certificate, EPC and insurance — and we read them and build a record of your property. Storing and organising your documents is free. If you want us to remind you before something is due to expire, that's free for a single property, and a paid subscription if you want alerts across your whole portfolio. We surface information to help you stay on top of your obligations as a landlord; we do not provide regulated financial or legal advice.
The personal data we collect and why
Account and authentication data
If you hold an account, we process your name, email address, authentication tokens and IP address to create and secure your account.
Lawful basis: performance of a contract.
Your property documents
When you upload a document, we process what it contains in order to store it and read it into a structured property record. This can include your property address, mortgage details, tenancy details, and — where a document contains them — tenant names and related information. Right to rent evidence, such as passports or biometric residence permits, is handled differently and is not read for its content at all. See "Where your data is held, and international transfers" below for the full explanation.
Lawful basis: performance of a contract, for the free document storage and reading service. For the paid reminder service, performance of a contract you have chosen to enter into.
You can start uploading a document before you finish creating an account. If you don't complete your account within 24 hours, the document and any related information from that session is automatically deleted.
Renewal reminders (free for one property, paid for a portfolio)
If you subscribe to reminders, we use your email address to send you alerts ahead of a document's expiry date, at the intervals you choose.
Lawful basis: performance of a contract.
Payment data
If you subscribe to the paid tier, your payment is handled by a payment provider. We hold a record that a payment was made and its status; we do not hold your full card details ourselves.
Lawful basis: performance of a contract.
Business contact data
We process the names, business contact details and roles of prospective partners, advisers and contractors for business development and to manage our relationships.
Lawful basis: legitimate interests (business-to-business communication with relevant professionals).
Website and usage data
When you use our website we process IP address, device and usage data, and any postcode you enter into a search.
Lawful basis: legitimate interests for essential operation of the site; consent for any non-essential cookies.
Demonstration data
Our product demonstrations use synthetic, simulated data only. We do not use real landlord or property data in demonstrations.
Where your data is held, and international transfers
Your property documents and account data are hosted with Supabase, in their London region.
Automated document reading: when you upload a document, the complete file is sent to Anthropic to be read and to extract the relevant dates and details. This transfer is covered by a data processing agreement and the UK's International Data Transfer Addendum. By contract, this content is not used to train any AI model and is deleted from Anthropic's systems within 30 days.
Right to rent evidence is not sent for automated reading. Identity documents uploaded through our right to rent route, such as passports or biometric residence permits, are stored but never read by our AI system. You enter any follow-up check date yourself. If an identity document is uploaded by mistake through the general upload route, it is classified but no content is extracted from it, and nothing from the document is returned or stored.
Document processing runs in the United Kingdom. Our document reading function is pinned to the London region, so files are handled in the UK before the reading step described above.
Payments: handled by Stripe. Stripe holds your full payment details; we don't. Stripe processes payment data in the United States and elsewhere; this transfer is covered by a data processing agreement incorporating the Standard Contractual Clauses as amended by the UK International Data Transfer Addendum.
Email delivery: account, notification and alert emails are delivered by Resend, which processes and stores email content, recipient addresses and delivery records in the United States. This transfer is covered by a data processing agreement incorporating the Standard Contractual Clauses as amended by the UK International Data Transfer Addendum.
Website hosting: our website is hosted using Lovable, with Cloudflare providing security and performance in front of the site. Cloudflare's data processing agreement, incorporated automatically into their standard terms, covers transfers under the Standard Contractual Clauses as amended by the UK International Data Transfer Addendum. Lovable hosts only the website itself. Your documents, account and property data are held in our own database in London and are not stored by Lovable. Website delivery uses a global edge network which may process technical data such as your IP address outside the United Kingdom. Lovable provides a data processing agreement covering transfers under the Standard Contractual Clauses as amended by the UK International Data Transfer Addendum.
How long we keep it
We keep your account and document data for the life of your account. If a document is replaced with a newer version (for example, a renewed gas safety certificate), we don't delete the old one straight away — we keep it for at least 6 years from whichever is later: the date it was replaced, or the date the relevant tenancy ended. This is so you have evidence of what was in place at a given time if it's ever needed, for example in a dispute with a tenant. If you close your account, your data is deleted after a limited period, subject to short technical backup retention. If you upload a document before completing your account and never finish signing up, that document is deleted after 24 hours. Business contact data is kept for up to 24 months from last contact. Records we must keep by law, such as tax records, are kept for the period the law requires.
Your rights
You have the right to access, rectify, erase, restrict or object to our processing of your personal data, and the right to data portability, subject to the conditions in data protection law.
Your right to complain to us
Under the Data (Use and Access) Act 2025 you have the right to complain directly to us about how we handle your personal data. Please contact contact@mydasoft.com. We will acknowledge your complaint within 30 days and respond without undue delay.
Your right to complain to the ICO
You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would welcome the chance to resolve your concerns first.
Changes to this notice
We may update this notice from time to time. The version number and date at the top show when it was last revised.
Mydasoft Limited — Privacy Notice — Version 2.4 · 22 August 2026