This Privacy Policy explains what personal data Turf ("we", "us", "our") collects when you use the Turf website and applications (the "Service"), why we collect it, what we do with it, how long we keep it, and the rights you have under UK data-protection law, primarily the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 ("PECR").
Turf is the data controller for personal data processed through the Service.
1. Who we are and how to contact us
Turf operates a UK-focused property research service. For any privacy-related enquiry, including requests to exercise your rights, email hello@yourturf.co.uk. We aim to respond within 30 days as required by UK GDPR.
2. What personal data we collect
We collect personal data in the following categories:
Information you give us
- Account details: name (first name only is required), email address, and authentication data.
- Subscription details: the tier you are on, trial status, renewal date and billing history.
- Profile details (optional): region, buying experience, budget, deposit, biggest worry, target areas, journey stage, profile photo.
- Property research data: listing URLs you submit, notes you write, status you assign (watching, viewing booked, offer made, etc.), folders, and Hugo chat messages.
- Work address: only if you enable commute calculations.
- Support correspondence: messages you send us by email or in-app.
Information we collect automatically
- Usage and analytics: pages visited, features used, buttons clicked, approximate time spent, referrer (limited to what's needed to improve the product and measure conversion).
- Device and technical data: IP address, browser type and version, device type, operating system, screen size, language, time zone.
- Cookies and similar technologies: see Section 8 below.
Information from third parties
- Public property data: we look up HM Land Registry sold prices, EPC certificates, Ordnance Survey data, Environment Agency / NRW / SEPA flood data, Coal Authority, BGS GeoSure, UKHSA radon, ONS demographic data, Police.uk crime data, Department for Education school data, and similar public datasets. These datasets refer to properties, not directly to you, but become associated with your account when you save a property.
- Payment data: Stripe shares limited transaction metadata with us (last 4 digits of the card, country, billing email, success/failure status). We never see your full card number, CVV, or bank credentials.
- Authentication providers: if you sign in via Base44 platform authentication or a third-party identity provider, we receive your verified email and a unique identifier.
What we do not collect
We do not knowingly collect special category data (health, ethnicity, religion, sexual orientation, political opinions, etc.). Please do not include such information in free-text notes. We do not process data of children under 18.
3. Why we use your data and our lawful basis
Under UK GDPR Article 6, we rely on the following lawful bases:
- Contract (Art. 6(1)(b)): creating and operating your account, generating reports you have requested, processing payments and credits, providing customer support.
- Legitimate interests (Art. 6(1)(f)): improving the Service, debugging, fraud prevention, securing our infrastructure, sending product-related service emails (e.g. payment receipts, trial-ending reminders, security notices), and aggregating anonymous usage statistics. We have balanced these interests against your rights and consider them proportionate.
- Consent (Art. 6(1)(a)): for non-essential cookies, optional marketing emails, and any use of your data beyond what these terms describe. You can withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)): retaining transaction records for tax and accounting purposes, complying with lawful requests from regulators or law enforcement.
4. AI and automated processing ("Hugo")
Turf uses large language models ("LLMs") to generate property commentary, summaries, suggested viewing questions and answers to questions you ask Hugo. We send to the model:
- property attributes (address, price, EPC, lease, flood signals, etc.);
- your question or context for that report;
- a minimal amount of profile context (e.g. region, first-time-buyer status) where useful.
We contractually require our model providers not to use your prompts or responses to train their foundation models. Hugo's outputs are decision-support only and do not produce legal effects on you under UK GDPR Article 22; the decisions remain yours, and we provide human review on request.
5. Marketing communications
We send transactional emails (receipts, account confirmations, trial-ending reminders, payment failures, security notices) without separate consent, as they are necessary to perform our contract with you. Marketing emails (product updates, tips, feature launches) are sent only with your consent or, where lawful under the PECR "soft opt-in" for existing customers about similar products, with a clear unsubscribe link in every message.
6. Sharing your data
We share personal data only with the following categories of recipient:
- Infrastructure providers: our hosting and application platform (Base44), database, file storage and email-delivery suppliers, each acting as a processor under written contracts with UK GDPR Article 28 safeguards.
- Payment processor: Stripe Payments Europe, Ltd., which handles all card transactions as an independent controller for fraud-prevention and regulatory purposes.
- AI model providers: the providers powering Hugo's language model and image-analysis features. They process data on our instructions and under contractual no-training restrictions.
- Analytics: privacy-friendly product analytics to understand aggregated usage. We do not sell your data to advertisers or data brokers.
- Affiliate partners: only with your express in-product action (e.g. clicking a "get a quote" link). We may share your name, email and limited property context to enable the referral. The partner becomes an independent controller from that point.
- Professional advisers and regulators: where required to comply with a legal obligation, a court order or a lawful request from the ICO, HMRC, FCA, or law enforcement.
- Share links: when you generate a read-only share link, the recipient sees only the property report; they do not gain access to your account or other data.
In the event of a corporate transaction (merger, acquisition, asset sale) we may transfer your data to the successor entity subject to equivalent privacy protections; we will notify you in advance.
7. International transfers
Our infrastructure is hosted primarily within the UK or European Economic Area. Some processors (e.g. AI model providers, certain analytics) may process data in the United States or other countries. Where this occurs, we rely on UK-approved transfer mechanisms: the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or adequacy regulations made by the Secretary of State (including the UK-US Data Bridge where applicable). We also apply additional safeguards such as encryption in transit and at rest.
8. Cookies and similar technologies
We use a minimal number of cookies and local-storage items:
- Strictly necessary: authentication session, CSRF protection, basic preferences. These cannot be disabled and do not require consent under PECR.
- Functional: remembering your region, last visited property, draft notes (mostly stored in your browser's local/session storage, not as cookies).
- Analytics: aggregated, privacy-respecting analytics to measure feature usage. Where these are not strictly necessary, we ask for your consent in line with PECR and the ICO's 2026 guidance.
You can manage or block cookies through your browser settings. Doing so may affect Service functionality.
9. Retention
We keep personal data only as long as we need it:
- Active accounts: for as long as the account is in use.
- Inactive accounts: deleted or anonymised 24 months after the last login, after a reminder email.
- Closed accounts: account data is deleted within 30 days of closure, except where we are required to keep records.
- Transaction records: retained for 6 years to comply with HMRC tax and accounting law.
- Support correspondence: typically 2 years.
- Backups: rolling backups may persist for up to 90 days after deletion, after which they are overwritten.
10. Security
We protect your data with industry-standard measures: TLS encryption in transit, encryption at rest, role-based access controls, least-privilege engineering access, audit logging, regular dependency updates, and isolated production environments. No system is perfectly secure; in the event of a personal-data breach likely to result in a risk to your rights, we will notify the Information Commissioner's Office within 72 hours and, where required, notify you directly without undue delay.
11. Your rights
Under UK GDPR you have the following rights, free of charge in most cases:
- Access: request a copy of the personal data we hold about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure ("right to be forgotten"): ask us to delete your data, subject to legal retention requirements.
- Restriction: pause processing while we investigate a dispute.
- Portability: receive your data in a structured, machine-readable format or have it transmitted to another controller.
- Objection: object to processing based on legitimate interests, including profiling.
- Withdraw consent: for any processing based on consent.
- Not be subject to solely automated decisions producing legal or similarly significant effects (this does not apply to Hugo's commentary, which is decision-support only).
To exercise any of these rights, email hello@yourturf.co.uk from the email address associated with your account. We may ask you to verify your identity. We will respond within one calendar month.
12. Complaints to the ICO
You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority. We would appreciate the chance to address your concerns first, so please contact us before raising a complaint.
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Website: ico.org.uk. Phone: 0303 123 1113.
13. Changes to this policy
We may update this policy from time to time. The "last updated" date shows the current version. We will notify you of material changes by email or via in-app banner.
14. Contact
For privacy matters and general support: hello@yourturf.co.uk.