Privacy Policy

1. Who we are

This website, openaddress.co.uk ("OpenAddress", "we", "us", "our"), is operated by OpenAddress Ltd, a company registered in Northern Ireland (company number NI741612), with its registered office at OpenAddress Ltd, Ground Floor, Gallery Building, 65-69 Dublin Road, Belfast, BT2 7HG.

OpenAddress Ltd is the data controller responsible for your personal data when you use this website.

We are registered with the Information Commissioner's Office (ICO), registration number ZC179457.

If you have any questions about this policy, or about how we handle your personal data, contact us at [email protected].

2. What OpenAddress does

OpenAddress is an estate agency business. A prospective buyer pays a flat fee, and we print and post a physical letter to a residential address expressing that person's interest in buying the property — whether or not it is for sale. If the homeowner chooses to respond, we provide a private channel through which the two of them can communicate directly.

Our regulatory position is set out in full in our Terms and Conditions. In summary: we have applied to register with HM Revenue and Customs for supervision under the Money Laundering Regulations 2017 as an estate agency business (application XAML00000222796), we are a member of the Property Redress Scheme (membership PRS059824), and we hold professional indemnity insurance.

Certain facts about how we operate directly limit the personal data we need, so they are worth stating here:

• We take no commission. Our fee is charged for delivering a letter and for providing the chat channel, and is never contingent on a sale.
• We do not value or appraise property, we do not market or advertise property for sale on anyone's behalf, and we do not negotiate.
• We do not handle any money relating to a property transaction — no deposits, no client funds, no sale proceeds.
• We are not a party to any sale, and we play no part in agreeing one.

Because of this, we collect only the limited data needed to deliver letters, operate the chat channel, take payment, and meet our legal obligations.

This service is for adults aged 18 or over. It is not directed at children and we do not knowingly collect personal data from anyone under 18.

We operate only in Northern Ireland, England and Wales. Scotland is outside our coverage and is excluded at the point a property is registered.

3. The personal data we collect

We aim to collect as little personal data as possible. What we collect depends on how you use the platform.

If you create an account (buyer or homeowner):

• Your email address. We use a passwordless sign-in system, so we do not store a password you have created.
• Your full name, as it appears on official documents. We never show your name to homeowners — they only ever see your randomly generated display name.
• Your date of birth.
• Confirmation that you are aged 18 or over.
• A randomly generated display name (for example, "SwiftOtter742"), assigned automatically so you are not identified to other users by your real name.
• A record of your credit balance and credit transactions — purchases, refunds and adjustments.

If you send a letter (buyer):

• The address of the property you are writing to, the identifier our address data provider assigns to that building, and any flat or apartment designation you supply.
• The amount you tell us you are willing to offer.
• The personal message you write. We store this in two forms: a redacted version, and the original version exactly as you submitted it. Section 6 explains why, and explains when the original becomes visible to the homeowner.
• Payment information. Card payments are processed by Stripe; we never see or store your full card details. We keep a Stripe transaction reference for accounting and dispute handling.

If you claim and manage a property (homeowner):

• Confirmation that you control the email address used to verify the claim.
• Property settings you choose, such as whether the property is currently receiving letters.

If you use the chat channel:

• The content of messages you send and receive.
• Whether messages have been read, and whether a conversation has been reported, suspended or ended.

Automatically:

• Limited technical information necessary to operate the site and keep it secure.
• A count of how many times a letter's claim link has been opened, and when it was last opened.
• The delivery status our print and postage provider reports for a letter as it moves through the post. Royal Mail does not scan every item, so if nothing further is reported within seven days of a letter being handed over we stop asking and record delivery as assumed. That is a note about the letter, not evidence that anyone received or read it.

We do not ask for or hold special category data (such as health or ethnicity), and we do not ask for identity documents.

Why we ask for your name and date of birth. We ask for these before you buy or send a letter, not when you sign up, so you can search freely without giving us anything beyond an email address. We need them for two reasons. First, to confirm you are 18 or over. Second, because as an estate agency business we are required to check our customers against published sanctions lists, and a name alone produces far too many false matches — your date of birth is what lets us tell you apart from an unrelated person with a similar name. Your date of birth is never shown to anyone else.

4. Why we use your data, and our lawful basis

Under UK data protection law we must have a lawful basis for processing your personal data. Ours are set out below.

Where we rely on legitimate interests, we have carried out a balancing assessment weighing our interests against your rights. You can ask us for a summary of that assessment at any time by emailing [email protected], and you can object to the processing — see section 8.

We do not use your personal data for marketing, and we do not sell your personal data to anyone.

5. Who we share your data with

We use a small number of service providers ("processors") to operate the platform. Each receives only the data it needs for its function, under a contract that requires it to protect that data and act only on our instructions.

• Stripe — payments. Receives the information necessary to process your card payment. We do not receive or store your full card number.
• STANNP — letter printing and postage. Receives the recipient property address and the contents of the letter, including your message and the claim link and QR code, so the letter can be printed and posted. STANNP does not receive the offer amount.
• qr-code-scan.info — QR code redirection, operated by STANNP. The QR code printed on a letter points at this service, which forwards the scan to our own page. It therefore sees that a code has been scanned, and the technical information any web request carries, before you reach us. We would rather the code pointed straight at us; our print provider's template system does not allow it. If you would prefer not to use the code, the same page is reachable by typing the short address printed beside it, and you can also opt out by writing to our registered office.
• Brevo — email delivery. Receives your email address and the content of transactional emails so we can send them to you.
• Google (Gemini API) — automated checking of message content. See section 6.
• dilisense — sanctions and politically-exposed-person screening. Receives your name and date of birth in order to check them against published sanctions lists. dilisense is based in Switzerland.
• Google (Places API) — address lookup. Receives the address text you type, so we can offer suggestions and identify the property you mean.
• Sentry — error monitoring. Receives technical information about faults so we can diagnose them. It is configured not to send personal data.
• Replit — hosting. Operates the servers and database on which the platform runs, and therefore has technical access to the data stored there.
• Cloudflare — network and security layer. Handles traffic to the site and sets a small number of cookies necessary for security.

Transfers outside the UK. Some of these providers process data outside the UK. Google's processing of message content, and of the address text you type when searching for a property, may take place outside the UK or EEA, and our screening provider dilisense is based in Switzerland, which the UK recognises as providing an adequate level of data protection. Where personal data leaves the UK we rely on the safeguards provided under the relevant provider's terms, such as UK International Data Transfer Agreements or the UK Addendum to the EU Standard Contractual Clauses. If you want to know the current position for a specific provider, ask us.

We may also disclose personal data if we are legally required to do so, including making a report to the National Crime Agency where we are obliged to, or to establish, exercise or defend legal claims. Where we are required to make a report of that kind, we may be prohibited by law from telling you.

6. Automated processing of your messages

To keep the platform safe, some message content is checked automatically. Please read this section carefully.

What is checked, and what is not. When you write the personal message that accompanies a letter, and when a homeowner writes their first reply, that text is sent to Google's Gemini API to check for personal contact details and prohibited content. The system may remove certain details — such as a phone number or email address — from the version that is shown, or ask you to rewrite a message that breaches our rules. Messages sent freely inside an unlocked chat are not checked in this way before sending. They may be assessed if someone reports them.

Where this happens. Message content is processed by Google under its paid-tier API terms, and that processing may take place outside the UK or EEA. Where personal data is transferred outside the UK we rely on the safeguards provided under the provider's terms. By using the messaging feature you understand your message content is processed in this way.

Disclosure of your letter message when a chat is unlocked. This is the most important paragraph in this policy if you are a buyer. We keep the original, unredacted version of your letter message. If the homeowner responds and you pay to unlock the chat, that original version — including any contact details you chose to include — becomes visible to the homeowner. Redaction protects your details on the printed letter and before unlock; it is not permanent. Do not put anything in your message that you are not willing for the homeowner to see once the chat is unlocked.

Reported conversations. If a message is reported, an automated assessment using Google's Gemini API helps us decide what action to take, and a conversation may be suspended automatically pending review. You have the right to ask a person to review any automated decision that significantly affects you — email [email protected].

7. How long we keep your data

We keep personal data only as long as we need it. Different records have different periods because different obligations apply to them.

These are maximum periods. We review records against them and delete data that is no longer needed. If you ask us to delete your data sooner, see section 8.

8. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data in certain circumstances;
• object to processing based on legitimate interests, or ask us to restrict it;
• request portability of data you have provided to us;
• withdraw consent, where processing is based on consent; and
• ask a person to review any automated decision that significantly affects you.

Two limits on deletion you should know about.

First, if you have been through our required checks, or you have unlocked a chat, we are required by the Money Laundering Regulations 2017 to keep certain records about you for five years, and we must refuse a deletion request covering them. We will tell you if that applies, delete everything not caught by it, and delete the rest when the period expires.

Second, opt-out records are kept indefinitely and we will not delete them, for the reason given in section 7. They contain only a property identifier and a date, and keeping them is what protects the address.

If you received a letter and want it to stop, you do not need to make a data request. Use the opt-out link on the letter. It takes one step, needs no account and no personal details, and permanently prevents any further letters to that address through OpenAddress.

Closing your account. You can ask us to close your account at any time by emailing [email protected]. We will do so within one month.

When we close an account we delete your email address, your name, your date of birth and your display name, and we permanently clear the original version of any message you wrote. What we keep is the record of any letter we actually posted and any sanctions check we carried out, for the five-year period described in section 7 — but those records are separated from your account, so they no longer identify you by name. We are required to keep them, and we are not permitted to delete them earlier.

Any unused credits are forfeited when an account is closed at your request, and are not refunded. If you want a refund of unused credits, ask for that first: within 14 days of buying them you can cancel and be refunded in full, as set out in our Terms.

To exercise any right, contact [email protected]. We will respond within the time limits set by law, normally one month.

9. If you received a letter from us

If a physical letter arrived through OpenAddress, you did not give us your data — a buyer sent a letter to your property's address.

• We do not hold your name. The letter is addressed generically, for example "The Homeowner".
• We hold the property address and the identifier our address data provider assigns to it, and a count of how many times the claim link was opened.
• We rely on legitimate interests to send that letter. We have carried out a written balancing assessment weighing our interests and the buyer's against your rights, and you can ask us for a summary of it at [email protected].
• You can opt out at any time, with no need to give any personal details, using the opt-out link on the letter. Opting out permanently suppresses your address so no further letters can be sent to it through OpenAddress.
• There are limits on how often any address can be written to, regardless of who is asking. These are set out in our Terms.
• You only give us an email address if you choose to start a conversation. We use it solely to notify you about that conversation — never for marketing — and the buyer never sees it.
• You can object to our processing on legitimate interests grounds at any time: email [email protected].

10. Cookies

We use only a small number of cookies, and none for advertising or tracking across other websites.

• Cookies needed to keep you signed in and to protect forms against misuse.
• Cookies set by Stripe when you make a payment, to process it and prevent fraud.
• Cookies set by Cloudflare, our network and security provider, to keep the site available and secure.

We do not use advertising cookies and we do not build profiles about you.

11. Security

We take reasonable technical and organisational measures to protect your personal data, including encrypted connections to the website and restricted access to personal data. No system can be guaranteed completely secure, but we work to protect your information and — more effectively — to limit how much of it we hold in the first place.

12. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at [email protected] so we have the chance to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

Complaints about our service rather than about your data are handled under our separate complaints procedure, and can be escalated to the Property Redress Scheme. See our complaints page.

13. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top shows when it last changed. If we make significant changes we will take reasonable steps to bring them to your attention.

14. Contact

OpenAddress Ltd, Ground Floor, Gallery Building, 65-69 Dublin Road, Belfast, BT2 7HG.

Email: [email protected]. ICO registration: ZC179457.