Privacy Notice

SouthLet is a UK residential app for keeping a private record of your home: your rooms, appliances, manuals, receipts, warranties and maintenance history.

SouthLet is provided by SOUTHLET LTD, a company registered in England and Wales, company number 10048157, registered office 7 Kendal Close, London, SW9 6EW, United Kingdom.

SouthLet is responsible for deciding how and why your personal information is used for the purposes described in this notice.

ICO registration reference: ZC237661

Data Protection Officer: Sean Guidera

For privacy or data-protection questions, please contact us at support@southlet.com.

• Account details — your email address, password (stored only as a hash by our authentication provider), and your name if you enter one. Needed to give you an account and keep it secure.
• Your home — address, postcode, whether you own or rent, property type, floor area, heating, glazing, energy rating, photos and notes. Used to build your home record. Most fields are optional.
• Rooms — names, types, paint, flooring, lighting, measurements, floor plans and photos.
• Appliances and household items — name, brand, model, serial number, barcode, purchase and installation dates, price, retailer, warranty dates, status, photos and notes.
• Documents and receipts — the files you upload, plus their name, folder, dates and notes.
• Maintenance and history — services, repairs, contractor names you enter, costs, and the timeline entries generated when you change a record.
• Reminders — titles, due dates and notes.
• Voice input — a short audio clip while you hold the microphone, and the transcript produced from it (see “Voice” below).
• AI input and output — the photo or text you send, a limited extract of the relevant home record, and the AI's suggestion. Suggestions you confirm are saved to your record.
• Search terms you type in the app.
• Technical information — IP address, browser/device information and error diagnostics recorded by our hosting and error reporting when the app is used, and entries in our internal security log.

We do not collect special category data on purpose. Please avoid uploading documents containing health, financial or identity information you do not need in your home record.

We use analytics tools to understand how people use SouthLet and to help us improve the service. On the published app this is Lovable Analytics (provided by our hosting platform).

Analytics may collect information about how visitors use the website or app, such as pages viewed and general usage patterns.

We do not use analytics for behavioural advertising, and we do not sell personal information. The app does not join analytics to your home record, files or account content, and we do not send marketing or newsletter emails.

Some technical processing arrangements depend on the service providers used to operate SouthLet. We will provide further details where required by applicable data-protection law.

• Contract — providing your account and your home record, storing your files, and giving you AI, scanning and voice features you ask for.
• Legitimate interests — keeping the service secure, preventing abuse, diagnosing errors, and maintaining an internal security log.
• Legal obligation — where we must keep or disclose information by law.
• Consent — where we ask for it, for example your device's microphone and camera permissions. You can withdraw those permissions in your browser or phone settings at any time.

• AI runs only when you start it: scanning an item or receipt, scanning a room, asking a question about your home, or speaking to the app.
• We send the photo, frames or text you provide, plus a limited extract of the relevant records needed to answer — for example an appliance's name, brand and model.
• AI results are shown to you as suggestions first. Nothing is saved to your home record until you confirm it.
• AI can be wrong. Model numbers, dates, measurements and repair advice should be checked against the manufacturer's documentation, and against a qualified professional where safety is involved.
• We do not intentionally use your home records to train SouthLet's own AI models. Third-party AI providers may process information needed to provide the AI feature. Their handling of that information is governed by the applicable provider arrangements and terms.

• Voice only records while you hold the microphone button, after your browser or phone has granted microphone permission.
• The audio clip is sent to a speech-to-text provider through our AI gateway to produce a transcript. We do not store the raw audio.
• The transcript is used to work out what you meant. It is shown to you for review before anything is saved.
• If you cancel, nothing is written to your home record — no record change, no history entry, no stored transcript.
• If you confirm, we save the change, add a history entry marked as a voice-assisted update, and keep the transcript with that entry so you can see where the information came from.
• If transcription fails, we tell you and nothing is saved. You can try again or type instead.
• You can delete a stored transcript by deleting the history entry or the item it belongs to, or by deleting your account.

• Your files are held in private storage. They are not publicly listable or downloadable by URL.
• When you view a photo or open a document, we generate a short-lived link for you (a few minutes at most) that only works for that file.
• Storage rules are enforced by the database, not by the app screens: files live in a folder tied to your account, and only your account can read, upload, replace or delete them.

We use a small number of service providers to run SouthLet. They process your information on our behalf:

We do not sell your information and we do not use it for advertising. We may share information where we are legally required to.

Some technical processing arrangements depend on the service providers used to operate SouthLet. We will provide further details where required by applicable data-protection law.

SouthLet is built for UK residents. Some of the providers above may process information outside the UK — this is likely for AI and speech-to-text processing in particular. We describe only what we can confirm about how the app is run:

• Hosting, database and authentication: Lovable Cloud (managed infrastructure)
• Database: Supabase PostgreSQL, provided through Lovable Cloud
• File storage: Supabase Storage private buckets, provided through Lovable Cloud
• Regions, backups, disaster recovery and international transfers: Some technical processing arrangements depend on the service providers used to operate SouthLet. We will provide further details where required by applicable data-protection law.

• Your home records and files are kept for as long as your account exists.
• You can delete individual records at any time, and deleting your account deletes your database records and your stored files.
• Raw voice audio is not stored by SouthLet: it is sent for transcription and then discarded.
• Voice transcripts are only stored when you confirm a change or ask us to keep a note.
• Some deleted information may remain temporarily in secure backups or provider-managed logs until those systems are routinely overwritten or deleted under the applicable provider retention processes.

The table below sets out each category: what the app actually does today, and how long the information is kept.

• Access is enforced in the database. Every record is tied to the account that owns it, and every read and write is checked against that ownership — not just hidden in the app.
• Anonymous visitors have no database access at all: the app's tables are readable and writable only by signed-in accounts, and then only for their own rows.
• Files sit in private buckets in a per-account folder, with short-lived links for viewing. The database also restricts which file types can be uploaded.
• Secrets and provider keys stay on the server and are never sent to your browser.
• We keep an internal, append-only security log of authorisation failures and unusual access so we can investigate problems. Ordinary users cannot read, edit or delete it. We never log passwords, tokens or the contents of your records. Entries are automatically deleted 180 days (about six months) after they are recorded, by a scheduled daily clean-up.
• No service can promise perfect security. We have not been independently certified and we make no certification claims.

Signing in

• Email and password sign-in, plus Google and Apple sign-in.
• Password reset by email.
• Password change from Settings, which is recorded in the internal security log.
• Sign-out clears your session and the app's local caches on the device.
• Temporary account lockout after repeated failed sign-in attempts.
• Strong password rules enforced when you create or change your password.
• Per-account limits on scanning and assistant requests, to prevent abuse.
• Browser security headers, including a content security policy, on every page.

Optional two-factor authentication using an authenticator app (TOTP). People can turn it on in Settings; once on, a 6-digit code is required after the password at every sign-in, and protected pages stay blocked until it is entered. It is optional, not enforced account-wide. There are no self-service recovery codes: anyone who loses their authenticator app must contact support to have their identity verified.

Under UK data protection law you have rights to access your information, have it corrected, have it deleted, restrict or object to certain processing, ask for portability, and complain. Some rights depend on the circumstances — for example we may need to keep limited security log information to protect the service.

• Access and portability — Settings has a “Download your home record” export: a machine-readable JSON file of your own records only. What it does and does not contain is listed below.
• Correction — you can edit any record in the app.
• Deletion — Settings has “Delete my account”, which removes your records and your stored files.
• Objection, restriction and any other request — contact us using the details below.

Included:

• Profile
• Homes and EPC assessment data
• Rooms and floor plans
• Appliances and household items
• Spare parts, consumables and shopping list
• Document records (name, folder, dates, notes and storage path)
• Maintenance and timeline history, including confirmed voice transcripts
• Reminders
• Item scans
• Inventory purchases and imports
• Sharing grants you created

Not included, and why:

• The uploaded files themselves — the export lists each file's storage path; download files from the app.
• Voice audio — it is never stored, so there is nothing to export.
• Internal security log entries — these are not owner-readable by design; request them using the privacy contact.
• Backend platform logs held by the hosting provider.

SouthLet is designed for adults who own or rent a home and is not directed at children. We do not knowingly create accounts for under-16s and we do not ask for information about children. Please do not add children's personal information to your home record. If you believe a child has created an account, contact us and we will remove it.

For privacy and data-rights requests, and for general contact, email support@southlet.com.

If you are unhappy with how we handle your information you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, or by calling their helpline. You can complain to the ICO at any time, but we would like the chance to help first.

We will update this page when the app changes, and we will update the “last updated” date. If a change materially affects how your information is used, we will tell you in the app.

See also our Terms of Service and cookies and storage page.