Sign inSign inLast updated 19 September 2026
This notice explains how Mydasoft Limited ("Mydasoft", "we", "us") collects and uses personal data, and your rights under the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
For a shorter, plain-English summary of how we handle your data as a landlord, see our Landlord Data Protection Summary. This Privacy Notice remains the full, legally complete version.
Data controller: Mydasoft Limited, a company registered in England and Wales.
Company number: 17343775.
Registered address: 8 Thurne Way, Rudgwick, West Sussex, RH12 3ER.
ICO registration: We are registered with the Information Commissioner's Office. Registration reference: ZC200045.
Contact for data protection matters: contact@mydasoft.com.
Mydasoft is a document storage and renewal-reminder platform for landlords. You upload your property documents — things like your mortgage offer, tenancy agreement, gas safety certificate, EPC and insurance — and we read them and build a record of your property. Storing and organising your documents is free and unlimited. Renewal alerts, which remind you before something is due to expire, are part of a paid subscription. Current plans and prices are set out in our Terms of Service. We surface information to help you stay on top of your obligations as a landlord; we do not provide regulated financial or legal advice.
If you hold an account, we process your name, email address, authentication tokens and IP address to create and secure your account.
Lawful basis: performance of a contract.
When you upload a document, we process what it contains in order to store it and read it into a structured property record. This can include your property address, mortgage details, tenancy details, and — where a document contains them — tenant names and related information. Right to rent evidence, such as passports or biometric residence permits, is handled differently and is not read for its content at all. See "Where your data is held, and international transfers" below for the full explanation.
Lawful basis: performance of a contract, for the free document storage and reading service. For the paid reminder service, performance of a contract you have chosen to enter into.
You can start uploading a document before you finish creating an account. If you don't complete your account within 24 hours, the document and any related information from that session is automatically deleted.
We use your email address to send you alerts ahead of a document's expiry date, at the intervals you choose. Renewal alerts are part of a paid subscription; the plans available are set out in our Terms of Service.
Lawful basis: performance of a contract.
If you subscribe to the paid tier, your payment is handled by a payment provider. We hold a record that a payment was made and its status; we do not hold your full card details ourselves.
Lawful basis: performance of a contract.
We process the names, business contact details and roles of prospective partners, advisers and contractors for business development and to manage our relationships.
Lawful basis: legitimate interests (business-to-business communication with relevant professionals).
If you ask us to remind you when the government landlord register opens in your region, we collect your email address, the region you select, and a record of where you signed up from. We also store the exact wording of the consent you were shown, and an unsubscribe link.
We use this only to send you reminders about the register. We do not use it for any other marketing, and we do not share it with anyone else.
Lawful basis: consent. You can withdraw it at any time using the unsubscribe link in any reminder email, or by emailing contact@mydasoft.com. Withdrawing consent does not affect reminders already sent.
Retention: we keep your email address until 12 months after the registration deadline for your region has passed, after which it is deleted.
When you use our website we process IP address, device and usage data, and any postcode you enter into a search.
If you accept analytics cookies, we record basic information about how the site is used: the pages you visit, when you visited, the page or advert you arrived from, and standard technical details about your browser and device. We use this only to understand which pages are working and where people are getting stuck.
We do not use a third-party analytics product such as Google Analytics. This information is collected through our own website. Because our website is served through Lovable's infrastructure, the position set out under Website hosting below applies to it.
If you reject analytics cookies, none of this is recorded.
Retention: we keep this information for 12 months, after which it is deleted.
We advertise on Facebook and Instagram. If you accept advertising cookies, our website uses the Meta Pixel, provided by Meta Platforms Ireland Limited, to measure whether those adverts lead to visits and sign-ups. The Pixel records that a page was viewed, that the register reminder form was submitted, or that an account was created, together with standard technical information about your browser and device. It sets cookies called _fbp and, if you arrived from one of our adverts, _fbc.
We have switched off Meta's advanced matching features. We never send Meta your name, email address, account identifier, property details, or any document you upload.
Nothing is sent to Meta unless you accept advertising cookies. If you reject them, no request is made to Meta at all, and you can change your choice at any time.
For this activity Mydasoft and Meta act as joint controllers for the collection and transmission of the data, the essence of that arrangement being set out in Meta's Controller Addendum. Meta then processes the data under its own terms. Our Cookie Policy explains the cookies involved.
Lawful basis: legitimate interests for the essential operation of the site; consent for website analytics, advertising measurement, and any other non-essential cookies.
Our product demonstrations use synthetic, simulated data only. We do not use real landlord or property data in demonstrations.
Your property documents and account data are hosted with Supabase, in their London region.
Automated document reading: when you upload a document, the complete file is sent to Anthropic to be read and to extract the relevant dates and details. This transfer is covered by a data processing agreement and the UK's International Data Transfer Addendum. By contract, this content is not used to train any AI model and is deleted from Anthropic's systems within 30 days.
Right to rent evidence uploaded through our dedicated right to rent route is stored and is never sent for automated reading. You enter any follow-up check date yourself.
If an identity document is uploaded through the general or bulk upload route instead, it is sent to Anthropic in the same way as any other document, because that is how we identify what it is. As soon as it is identified as an identity document, processing stops: no content is extracted from it, nothing from it is returned to us, and nothing from it is stored in your property record. The file itself is stored by us, in London, as an uploaded document.
Document processing runs in the United Kingdom. Our document reading function is pinned to the London region, so files are handled in the UK before the reading step described above.
Payments: handled by Stripe. Stripe holds your full payment details; we don't. Stripe processes payment data in the United States and elsewhere; this transfer is covered by a data processing agreement incorporating the Standard Contractual Clauses as amended by the UK International Data Transfer Addendum.
Email delivery: account, notification and alert emails are delivered by Resend, which processes and stores email content, recipient addresses and delivery records in the United States. This transfer is covered by a data processing agreement incorporating the Standard Contractual Clauses as amended by the UK International Data Transfer Addendum.
Website hosting: our website is hosted using Lovable, with Cloudflare providing security and performance in front of the site. Cloudflare's data processing agreement, incorporated automatically into their standard terms, covers transfers under the Standard Contractual Clauses as amended by the UK International Data Transfer Addendum. Lovable is based in the United States. Our website is served through Lovable's infrastructure, so technical information about your visit — including your IP address and standard request details — is processed by Lovable every time a page loads. Your documents, account and property data are held in our own database in London and are not stored by Lovable. Website delivery uses a global edge network which may process technical data such as your IP address outside the United Kingdom. Lovable provides a data processing agreement covering transfers under the Standard Contractual Clauses as amended by the UK International Data Transfer Addendum.
If you accept advertising cookies, the data described under Advertising measurement above is shared with Meta Platforms Ireland Limited, which transfers it to Meta Platforms, Inc. in the United States. That transfer is covered by the Standard Contractual Clauses as amended by the UK International Data Transfer Addendum, incorporated into Meta's controller terms. If you do not accept advertising cookies, no data is sent to Meta.
We keep your account and document data for the life of your account. If a document is replaced with a newer version (for example, a renewed gas safety certificate), we don't delete the old one straight away — we keep it for at least 6 years from whichever is later: the date it was replaced, or the date the relevant tenancy ended. This is so you have evidence of what was in place at a given time if it's ever needed, for example in a dispute with a tenant. If you close your account, your data is deleted after a limited period, subject to short technical backup retention. If you upload a document before completing your account and never finish signing up, that document is deleted after 24 hours. Business contact data is kept for up to 24 months from last contact. Records we must keep by law, such as tax records, are kept for the period the law requires.
You have the right to access, rectify, erase, restrict or object to our processing of your personal data, and the right to data portability, subject to the conditions in data protection law.
Under the Data (Use and Access) Act 2025 you have the right to complain directly to us about how we handle your personal data. Please contact contact@mydasoft.com. We will acknowledge your complaint within 30 days and respond without undue delay.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would welcome the chance to resolve your concerns first.
We may update this notice from time to time. The version number and date at the top show when it was last revised.
Mydasoft Limited — Privacy Notice — Version 2.6 · 19 September 2026