Privacy notice
1. Who we are
1.1 BoughtWell is run by Estallion Investments Limited, registered in England and Wales (company no. 08760284), at 113 Romford Road, London E15 4LY. We are the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. ICO registration no. ZB946851.
1.2 Contact: privacy@boughtwell.co.uk, or write to the address above. We have not appointed a data protection officer because we are not required to (UK GDPR art 37); Gemma White is responsible for data protection.
1.3 This notice covers boughtwell.co.uk, the BoughtWell app, our emails, and the welcome call. It does not cover sites we link to, such as Stripe, LinkedIn or property portals, which have their own notices.
2. What we collect
| Source | What | Notes |
|---|---|---|
| You, when you sign up | Name, email, your answers to "Let's get to know you" (experience, strategy, areas), and optionally your LinkedIn profile or company website | Used to set up your account and personalise deals, not to vet you |
| You, as a member | Valuations and reasons, posts and discussion, Partner up posts, deal room messages and documents, partner reviews, settings, support messages | Posts and discussion show under your display name to other members |
| Welcome call | Your goals, areas and any feedback you give, noted by our team | Only if you book a call |
| Stripe (payments) | Card brand, last four digits, expiry, billing postcode, payment and subscription status, invoices | We never see or store your full card number |
| Stripe Identity (optional) | The result, the date, the document type and Stripe's reference | Only if you choose to verify. We never receive your document images, document number, date of birth or selfie |
| LinkedIn, Google or Apple | Name, email, profile photo and account identifier | Only if you choose to sign in that way |
| Your device | IP address, browser and device type, pages used, approximate location from IP, security and error logs | See our cookie notice |
| Public and property sources | Listings (including agents' descriptions and photos), Land Registry prices, EPCs, planning records, LiDAR and map data | Mostly about properties, not people. Planning records and listings can include names of agents or applicants |
| Other members | A referral code you were given, and what a deal room partner writes about a deal you share |
We do not knowingly collect data about anyone under 18. BoughtWell is for adults only.
3. Why we use it, and our lawful basis
Each use relies on one lawful basis under UK GDPR art 6(1).
| Purpose | Lawful basis |
|---|---|
| Running your account, trial and membership; taking payments; renewal and trial reminders | Contract, art 6(1)(b) |
| Showing your valuations, scores and track record, and the members' valuation (a median that never shows your name) | Contract, art 6(1)(b) |
| Keeping VAT, invoice and accounting records | Legal obligation, art 6(1)(c): Value Added Tax Act 1994 and Companies Act 2006 ss 386 to 388 |
| Checking Partner up introductions before names are shared; spotting fraud, fake accounts and unusual valuation patterns; securing the service | Legitimate interests, art 6(1)(f): keeping members and their money safe and the valuations honest |
| Welcome call notes, so we can help you get set up | Legitimate interests, art 6(1)(f) |
| The Drop and rare find alerts to members | Legitimate interests, art 6(1)(f), and the existing-customer rule in reg 22(3) of the Privacy and Electronic Communications Regulations 2003 (PECR). Stop them any time with one click |
| Marketing emails to people who are not members | Consent, art 6(1)(a), and PECR reg 22(2) |
| Optional ID verification | Explicit consent, art 6(1)(a) and art 9(2)(a). Stripe's selfie match uses biometric data, a special category under art 9(1). Stripe carries out the check; we keep only the outcome |
| Analytics or other non-essential cookies, if we use them | Consent, PECR reg 6 (see our cookie notice) |
| Defending or bringing legal claims | Legitimate interests, art 6(1)(f), and art 9(2)(f) where special category data is involved |
Where we rely on legitimate interests, we have weighed them against your rights; ask us for that assessment. Where we rely on consent, you can withdraw it at any time in Settings or by emailing us, without affecting what happened before.
4. Who we share it with
We never sell your personal data.
Service providers process data on our behalf, under contracts that meet UK GDPR art 28:
| Provider | What for | Where |
|---|---|---|
| Stripe | Payments, invoices and optional ID verification | UK, EU and US |
| Supabase | Database, sign-in and file storage | EU |
| Vercel | Hosting the website and app | US and EU |
| Resend | Sending emails | EU (Ireland) and US |
| Railway | Running our property data engine | [to be confirmed] |
| Microsoft | Booking and holding welcome calls (Bookings and Teams) | UK and EU |
| LinkedIn, Google, Apple | Sign-in, only when you choose it | US |
Other members see:
- your display name on posts and discussion;
- in Partner up, before an introduction is approved, only your initials, record and badges;
- your real name, only inside a deal room the BoughtWell team has approved;
- never your individual valuations. Members see the members' valuation, a median of everyone's figures.
Others, only when needed:
- partner services (conveyancing, survey, mortgage), only when you ask us to connect you;
- our professional advisers (lawyers, accountants, insurers);
- the police, HMRC, regulators or courts, where the law requires it or to prevent fraud;
- a buyer of all or part of our business, who would be bound by this notice.
5. Transfers, how long we keep it, and security
5.1 Outside the UK. Some providers process data in the US or EU. We rely on UK adequacy regulations (EU and EEA countries; the UK Extension to the EU-US Data Privacy Framework for certified US providers) or, otherwise, the ICO's International Data Transfer Agreement or Addendum, under UK GDPR arts 45 and 46.
5.2 How long we keep it:
| Data | Kept for |
|---|---|
| Account, profile and settings | While you are a member, then 2 years |
| A trial you cancelled before paying | 12 months after it ends |
| Payment, invoice and VAT records | 6 years after the end of the financial year (HMRC) |
| Valuations and track record | While you are a member; after that, removed from your name and kept only inside anonymous totals |
| Deal room messages and documents | While the room is open, then 2 years, unless a partner needs them longer for a legal claim |
| Welcome call notes | While you are a member, then 2 years |
| ID verification outcome | Until you remove it in Settings or close your account |
| Security and access logs | 12 months |
| Marketing consent records | As long as we email you, then 2 years |
5.3 Security. Data is encrypted in transit. Database access rules limit each member to their own data. Deal room files are private and open only through short-lived links (about 2 minutes). Every admin action is logged. If a breach is likely to put you at high risk, we will tell you without undue delay (UK GDPR art 34).
6. Your rights
6.1 Under UK GDPR arts 15 to 21 you can ask us to:
- give you a copy of your data (access);
- correct it;
- delete it (erasure);
- restrict how we use it;
- give it to you, or to someone else, in a usable format (portability);
- stop using it, including for any use based on legitimate interests (objection). You can always stop marketing and alerts, with no reason needed.
Email privacy@boughtwell.co.uk. We reply within one month (art 12(3)), free of charge in most cases. We may ask you to confirm who you are.
6.2 Scores and automated checks. The BoughtWell Score and estimate are about properties, not people. Our valuation-pattern checks only flag accounts for a person on our team to review. We make no decision about you based solely on automated processing that has legal or similarly significant effects (art 22). If we ever approve some Partner up introductions automatically, a person will review a sample, and you can ask for any decision to be reviewed by a person.
6.3 Complaints. Please tell us first, and we will try to put it right. You can also complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113.
6.4 Changes. We will email members about any material change to this notice before it takes effect. The date at the top shows the latest version.