Legal Privacy · UK GDPR

Privacy policy

Last updated 2026-05-06 Version 1.0 Effective 2026-05-06

We treat rent-roll data as if it were our own — minimum collection, clear purpose, fast deletion when the work is done. This page explains, in plain English, what we collect, why, how long we keep it, and the rights you have.

1. Who we are

Covenant is a service of Fortius Labs, based in London. References to "we", "us", or "Covenant" in this policy mean Fortius Labs trading as Covenant.

Data protection contact: [email protected]

We have not appointed a statutory Data Protection Officer because our processing does not currently meet the thresholds in Article 37 of the UK GDPR. Our privacy contact above is the right address for any data-protection question, request, or complaint.

2. Summary

If you only read one section, read this one.

What we collect: the contact details you give us, the rent-roll data your agency sends us to audit, and minimal site analytics.
Why: to deliver the audit, the 30-day sprint, and the ongoing Covenant subscription — and to run our business.
How long: rent-roll personal data is returned or deleted within 30 days of a contract ending. Customer relationship data is kept while you are a customer plus seven years (HMRC). Server logs are kept 30 days.
Cookies: none beyond essential session cookies. Our analytics are cookieless.
Sale of data: never. Not now, not ever.
Rights: access, rectification, erasure, restriction, objection, portability — and the right to complain to the ICO.

3. Data we collect

From you directly

When you contact us, request an audit, or sign up for Covenant, we collect:

Name, work email, role, and agency name.
Phone number, if you choose to share it.
Billing details (handled by our payment processor — see sharing).
The contents of your messages and call notes.

From your rent roll

To run an audit or deliver the service we ask you to send us a rent-roll export. That file typically contains:

Property addresses and unit-level details.
Current rent, tenancy start and end dates, and review status.
Landlord names and contact details.
Tenant first names where you choose to provide them (we ask you not to send tenant contact details unless necessary).
Internal notes, fee assumptions, and management status.

Roles under UK GDPR For rent-roll data, your agency is the data controller and Covenant is a data processor under Article 28. We process this data only on your documented instructions, set out in our Data Processing Agreement (DPA). For your own customer-relationship data — the contact details you give us so we can talk to you — we are the controller.

Automatically

Site analytics: we use a self-hosted instance of Plausible. It is cookieless, captures no personal data, and aggregates page views.
Server logs: our hosting provider records IP addresses and request metadata for security and abuse prevention. Logs are kept for 30 days.

4. Lawful basis for processing

We rely on the following lawful bases under Article 6 of the UK GDPR:

Contract: To deliver the 72-hour audit, the 30-day revenue sprint, and the ongoing Covenant subscription you have signed up for.
Legitimate interest: To run cookieless site analytics, secure our infrastructure, and prevent fraud or abuse. We have balanced this against your rights and consider the impact minimal.
Consent: For optional marketing emails. You can withdraw consent at any time using the unsubscribe link in any marketing email or by emailing [email protected].
Legal obligation: To meet our tax, accounting, and other statutory record-keeping duties.

For rent-roll data: the agency's lawful basis applies. We process this data only on the documented instructions set out in the DPA between us. We do not determine the purpose or means of processing rent-roll personal data; you do.

5. Purpose of processing

We use personal data to:

Deliver the 72-hour rent roll audit, the 30-day revenue sprint, and the monthly Covenant subscription.
Produce action lists, evidence packs, scoreboards, and outcome reports for your agency.
Communicate with you about the service, support questions, and (with consent) product updates.
Bill you and keep accurate financial records.
Operate, secure, and improve the website and the service.
Meet our legal obligations.

We do not sell personal data. We share it only with carefully selected sub-processors who help us run the service. Our current sub-processors are:

Hosting provider: [TBD — Hetzner]
Transactional email: [TBD — Postmark / Resend]
Customer relationship and outreach tooling: [TBD]
Payment processor: [TBD — Stripe]
Analytics: self-hosted Plausible (no third-party processor for analytics).

We will publish material changes to this list before they take effect, so you have a chance to object. Where required by law or court order — and only then — we may also share data with regulators, law enforcement, or our professional advisers (lawyers, accountants, auditors) under confidentiality.

7. International transfers

Our primary infrastructure is in the UK and the EEA. Where a sub-processor stores or processes personal data outside the UK or EEA, we rely on either an adequacy decision recognised by the UK government or the UK International Data Transfer Agreement (IDTA) / EU Standard Contractual Clauses with the UK Addendum, plus appropriate supplementary measures. We will name any such transfers in the sub-processor list above.

8. How long we keep data

Customer relationship data (your contact details, agency details, communications): kept while you are a customer and for seven years after the relationship ends, to meet HMRC record-keeping rules.
Rent-roll personal data: returned to you or securely deleted within 30 days of the contract ending, unless you ask us to delete it sooner. This obligation is mirrored in our DPA.
Marketing data: kept until you withdraw consent or unsubscribe.
Server logs: 30 days.
Backups: encrypted backups may persist for up to 35 days before being overwritten.

9. Your rights

Under UK GDPR, you have the right to:

Ask for a copy of the personal data we hold about you (access).
Have inaccurate data corrected (rectification).
Have your data deleted in certain circumstances (erasure).
Ask us to pause processing while a query is resolved (restriction).
Object to processing based on legitimate interest, including direct marketing.
Receive your data in a portable format (portability) where applicable.
Object to any solely automated decision that produces a legal or similarly significant effect — though we do not currently make any such decisions about you.

To exercise any of these rights, email [email protected]. We aim to respond within one calendar month. If you are a tenant, landlord, or other person whose data appears in a rent roll an agency has shared with us, please contact your letting agency first — they are the controller of that data and best placed to handle the request. We will of course assist them.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would prefer the chance to put things right first, but the ICO route is always open to you.

10. Security

We take security seriously. Our controls include:

TLS 1.2+ encryption in transit for all traffic to and from the service.
Encryption at rest for stored personal data on managed databases and object storage.
Role-based access controls, with access to rent-roll data limited to staff who need it to deliver the service.
Strong authentication for staff systems and short-lived credentials for production access.
Regular review of accounts, dependencies, and third-party access.
An incident response process that includes notifying you and the ICO where required, within the statutory 72-hour window.

We are not currently certified to ISO 27001 or SOC 2; we will say so plainly here once we are.

11. Cookies

We use only essential cookies — a session cookie to keep you signed in if you have an account, and a CSRF token to protect forms. We do not use analytics cookies (our Plausible instance is cookieless), and we do not use advertising or tracking cookies of any kind.

Because we only set strictly necessary cookies, we do not display a cookie consent banner. If that ever changes we will update this page and ask for consent first.

12. Children's data

Covenant is a B2B service for letting agencies. It is not directed at children under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child's data has reached us, please contact [email protected] and we will delete it.

13. Changes to this policy

We will post any revisions to this policy on this page and update the "Last updated" date at the top. For material changes — for example, a new category of data, a new purpose, or a new sub-processor that affects existing customers — we will email customers at least 30 days before the change takes effect.

14. Contact

For any data-protection question, request, or concern:

Email: [email protected]
Post: Fortius Labs, London
Regulator: Information Commissioner's Office, ico.org.uk

End of privacy policy · Version 1.0 · 2026-05-06