Privacy policy

Who we are

Doorzo("we", "us") operates a property listing platform for renting and selling in the UK. This policy explains what personal data we collect, why, and what rights you have over it, in line with the UK GDPR and the Data Protection Act 2018.

What we collect, and why

Account details

Email, phone, and role (landlord, tenant, partner). Necessary to provide the service (contract).

Identity verification

If you choose to verify your identity, we use Stripe Identity (document + liveness check) — we never see or store the document image ourselves; Stripe returns only a pass/fail result. Legal basis: consent, and our legitimate interest in preventing rental fraud.

Income verification

If you build a Renter Passport, income verification is via Open Banking (TrueLayer) — we read your bank transactions only to calculate an income band, and never store the transactions themselves, only the result.

Credit reference

A soft credit check via a credit reference agency, which does not affect your credit score.

Right to Rent

Checked via the Home Office's official share-code service, or reviewed manually if unavailable.

Property ownership

Cross-checked against HM Land Registry records to award a "Verified Owner" badge.

Payments

Processed by Stripe. We never see or store your card details.

Messages and enquiries

Stored so both parties to a conversation can see its history, and so we can act on safety reports.

Who we share it with

Only the processors named above (Stripe, TrueLayer, our credit reference agency, HM Land Registry, the Home Office), our hosting provider (Supabase), and our email provider (Resend) — each only receives what they need to do their specific job. We never sell personal data.

How long we keep it

We keep account and verification data for as long as your account is active, and for a reasonable period afterwards to meet our legal and fraud-prevention obligations. Verification audit records (who verified what, when, and how) are kept indefinitely in an append-only log, since removing them would undermine the trust badges they support — but the underlying documents/tokens are not retained beyond what each provider requires.

Your rights

Under UK GDPR, you can ask us to:

• give you a copy of your personal data (access)
• correct inaccurate data (rectification)
• delete your data, where we have no overriding reason to keep it (erasure)
• limit how we use it (restriction)
• give you your data in a portable format (portability)
• stop processing it for a particular purpose (objection)

Email privacy@doorzo.uk to exercise any of these — we aim to respond within one month. You can also complain to the Information Commissioner's Office (ICO) if you're unhappy with how we've handled your data.

Cookies

See our cookie policy for what we use and why.

Children

This service is not intended for anyone under 18.

Changes to this policy

We'll update this page if what we collect or why changes, and update the date at the top when we do.