Privacy Policy

Last updated 28 October 2026

This policy explains how Broc Intelligence Ltd collects, uses and protects your personal data when you use our website trybroc.io and our product at app.trybroc.io (together, the “Service”). We are committed to handling your data lawfully, fairly and transparently under the UK GDPR and the Data Protection Act 2018.

1. Who we are

The data controller is Broc Intelligence Ltd (company number 17374474), a company incorporated in England and Wales, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are registered with the Information Commission (formerly the Information Commissioner's Office) as a data controller, registration number ZC221449. You can contact us about privacy at support@trybroc.io.

2. The personal data we collect

Information you give us

• Account details — your email address (and authentication tokens) when you sign in. Sign-in is handled through our authentication provider, Supabase.
• Property and buyer inputs — the property addresses you search for and details you enter about your buying position to generate your analysis.
• Your negotiation log — if you use the deal room in a report you have bought, the rounds you record there: what happened (an offer you sent, the agent’s counter or claim, a price cut, a hold, an agreement), the figure, when, and any note you write. We keep it so your report can suggest your next move. It is shown only to you, inside that report, and it never goes on a share link. A note is in your own words and may name other people — the agent, the seller, another bidder — so keep it to what you need. Logging a price cut also updates the asking price your report is scored from.
  
  Our servers also record that a round was logged, under your account identifier: its kind (and, for an agent’s claim, which one), its number, whether it carried a note, whether it corrected your answers and, for an offer or the agent’s reply to one, where its figure sat against your report’s own offer range. That record never contains the figure, the note or the property’s address. Nothing is read from or written to your device to make it, so the analytics choice does not control it; you can object at any time using the contact details in section 9.
• Communications — the content of any messages you send us (e.g. support emails).
• Service Charge Checker uploads — the situation you pick and the PDF documents you give our Service Charge Checker when you ask it to read your service charge accounts, and, only if you then ask us to email you a link to the report, your email address. Section 13 describes that processing in full, including what those documents tend to contain about other people.

Payment information

When you buy a report, your payment is processed by Stripe, in a payment form that Stripe provides and that is embedded in our checkout page. Your card or wallet details are typed into Stripe’s fields, not ours: we do not receive or store your full card number, and Stripe handles your card data as an independent controller/processor under its own terms and privacy policy. We receive limited transaction details (such as the fact and amount of payment and a payment reference) to fulfil your order and meet our accounting obligations.

In the other direction, we send Stripe what its payment form needs in order to charge you and what we need in order to match the payment back to your order: the amount and currency, an identifier for your Broc account, the email address on your account if you have one (so the form does not ask you to type it again), and the reference number and address of the property the report is for — so that the payment Stripe records for us names the home you are buying the report about instead of a generic product, and so that we can identify the purchase if you contact us about it. We do not send Stripe your report, your answers about the property or the seller, your buyer profile, or any analysis we have produced.

Besides your payment details and any promotion code you type, two things reach Stripe from your browser directly rather than from us. If you buy without an account, the form asks you for an email address, which Stripe passes to us so that we can send you your report (see “Buying a report without creating an account” below). And when you press a buy button — on the checkout, or through a worked case’s buy-button link — or a payment you had already started is put back on screen, Stripe’s script collects device and browser information — such as your IP address, your browser and how you interact with its fields — which Stripe uses to prevent and detect card fraud, it may run a bot check provided by hCaptcha on Stripe’s behalf, and it sets the cookies described in our Cookie Policy. Stripe processes that information as an independent controller under its own privacy policy; the information Stripe collects for that purpose is not used by us for analytics or advertising. The script starts loading as you press, a moment before the form appears, so a press that ends without a form — because the request to start your payment fails, or because we find you have already paid for that home — can run it too.

Information collected automatically

• Anonymous service statistics before you choose — on our website, and on the anonymous parts of our product (the address search, the onboarding questions and the report checkout — including when you buy without an account, where we create an unnamed anonymous account for the checkout and you have not signed in), we may measure limited usage before you make an analytics choice solely to produce aggregate service-improvement statistics. We use a constrained PostHog mode (hosted in the EU) to count things such as pages or funnel steps viewed, the site or campaign that referred you, and coarse browser/device information. The analytics identity is kept only in your browser tab’s session storage and is discarded when you close the tab — it is never written to a cookie and cannot follow you across visits — session replay is off, URL query strings and advertising click identifiers are removed before analytics are sent, and the product app filters out buyer/profile submissions and other non-approved custom events. This mode never calls our account-identification function and its temporary random identifier is not carried into the consented/account profile. A small preference record may be written if you object or change your analytics choice so we can honour it. We rely on the PECR statistical- purposes exception for the limited device access involved, and on our legitimate interests under UK GDPR for any personal data processed in providing these aggregate-oriented statistics. If you choose Reject/No thanks or Turn off, this measurement stops too — it is the measurement that runs in your browser. Some counting happens on our own servers instead and does not depend on that choice; the next two bullets describe it, because a choice that stops one and not the other is only meaningful if you can see which is which.
• Advertising cookies, only if you allow them — with your consent, and only with it, we load Google’s advertising tag so Google Ads can show you our ads again on other sites after you leave (remarketing). This is a separate choice from the analytics one: allowing analytics does not allow advertising, and either can be withdrawn without the other. Until you allow it, nothing is requested from Google for advertising — the tag is not downloaded and sets no cookie; leaving the question unanswered has the same effect as declining. The Service Charge Checker’s “Continue with Google” button is not advertising and this choice does not cover it; section 5 says what showing it gives Google.
  
  What is sent. From our website: the page address without its query string (so campaign tags and Google’s gclid click identifier are removed), the page title, and the site you came from. From our product app we deliberately send less — only that a visit happened, and which of four points in the purchase journey you reached (a free estimate was shown, the price page was reached, a checkout was started, a purchase completed). The web address, the page title and the property you are analysing are not sent from the product at all, and none of the four carries the property, the price, your answers or anything you typed.
  
  What is never sent. Your name, your email address, the property or its address, your answers, and the contents of any report. We do not use Google’s enhanced conversions and we do not upload customer lists to Google. Google acts as an independent controller for this advertising data; you can also control ad personalisation directly in Google My Ad Center. Withdraw at any time using the controls on our Cookie Policy, which also switch it off in the product app.
• Counting we do on our own servers — some steps are recorded by our servers as they answer a request, rather than by anything running in your browser. Nothing is read from or written to your device to do it, which is why the analytics choice above does not control it: that choice governs storage and access on your device, and this involves neither. It is not optional in the way the browser measurement is, so we keep it deliberately narrow.
  
  What it records. That an address was searched or a teaser shown, the property identifier, our own estimated value for that property and how it was worked out — and, at the onboarding step that asks you about a listing, the answers you give there: the asking price as advertised by the seller’s agent, the condition you select from the options offered, the how-long-on-the-market band you select, and the number of price reductions you tell us about. Once you have answered the questions about yourself, our servers also count that you did, and whether we then managed to save those answers and take you on to the price — but never what those answers were, because they are about you rather than about the property.
  
  What it never records. Anything that identifies you. No name, email or account reference; no free text (the estate agent you may name in that same form is deliberately refused by the receiving endpoint, not merely left out). The listing answers and the property identifier are facts about a home — a property others can look up too — not about the person looking at it; the step counts say only that a step happened and whether it worked, never who you are or what you answered.
  
  Your browser and your connection. Each of these records carries the description your browser sends with every request it makes (its make and version, and the kind of device it is running on) and the internet address your request arrived from. We send both to our analytics provider for two narrow purposes and keep neither ourselves. The browser description is what separates a real visit from an automated one: without it every one of these records is classified as a robot, and the counts are useless. The internet address is used only to look up the country the visit came from and is then discarded — our provider is configured to anonymise it rather than store it, so no record retains the address itself.
  
  It is not a profile of you. Each record is filed under a fresh random identifier generated for that single event and then discarded. The identifier is never derived from your internet address, your browser or anything else about you, so none of them is joined to a Broc account and no record builds up a history of you over time. Be aware, though, of what the paragraph above means: two records made from the same connection within a short period could in principle be recognised as coming from the same visit, even though nothing on our side links them. We rely on our legitimate interest in understanding how visitors find and use the Service, and you can object at any time using the contact details in section 9.
• Checkout records we keep on our servers — our servers record that we showed you the paid-report checkout, and whether you chose to continue, so we can tell whether the product’s price is working. These records are filed under your account identifier. This includes visitors who never signed in: finishing the property questions creates an account for you (it simply has no email or password attached yet), whether or not you go on to buy, and these records are filed under it in the same way. That account, and the answers you gave, are deleted after 30 days if you never buy anything — unless you asked us to email you a link back to the checkout page (the same form also joins you to Broc’s email list, for occasional buying guides and short questionnaires about your search). Leaving us an address is the one thing that keeps the account: we hold it, and the record of your consent to use it, until you unsubscribe or ask us to erase it (see sections 7 and 9), or for up to twelve months after the last time you used that form — whichever comes first. We keep the account rather than the address alone because deleting it would destroy the record of why we were allowed to write to you while your address stayed on our mailing list; when the address goes, the account and your answers go with it. They are not the anonymous counts in the previous bullet, and they are not the enhanced analytics profile that is labelled only after you consent.
  
  Because the payment form is on our page, these records also say whether a wallet such as Apple Pay was offered to you, whether a payment attempt failed and Stripe’s code for why, how long the form took to appear, and how long it was open — never a card detail, and never the message Stripe showed you.
  
  If a checkout you started is never paid for, we record that too — not when you leave, but when the payment session lapses, which is up to a day later. That record says which plan and price you had reached and whether we hold an email address for you, so that we can judge whether following up on unfinished checkouts would reach anyone at all. It never contains the address itself.
  
  If you arrived from an advertisement, these records also carry the campaign you came from and the click identifier the ad platform itself attached to your visit’s URL. We keep that identifier in two places, and they are different: on our record of a payment, if you start a checkout; and once against your account, from the first advertisement you arrived from, whether or not you ever buy anything. The second exists because people commonly click an advertisement one day and come back another day by typing our address directly — without remembering the first visit we cannot tell that the advertising worked. It is written once and never overwritten, and it is deleted with the account — which means different things for the two kinds of account we may hold for you. If we created one for you automatically when you answered the property questions, and you never buy, it is deleted with that account after 30 days as described above. If you signed up, it lasts as long as your account does, because we do not delete the accounts of people who chose to create one; you can ask us to erase it at any time using section 9. It is a code in a link, not anything you told us; what may be shared with Google Ads, and what is not, is set out in the advertising row of section 4 and in section 5.
  
  Nothing is read from or written to your device to do this, which is why the analytics choice above does not control it: that choice governs storage and access on your device (and the optional labelling of a browser analytics profile), and this uses neither. You can object at any time using the contact details in section 9.
• Buying a report without creating an account — you can pay without signing up. When you do, the payment form asks you for an email address, which Stripe passes to us so we can send you the report, and we use it for three things and no others: to send you a personal link to what you bought, to identify the purchase if you contact us about it, and — if you later choose to turn that address into a sign-in — to become the email on your account. It is not added to any marketing list.
  
  That email contains a link that opens your report without a password, so treat it like one and avoid forwarding it. Opening it sets the broc_report_access cookie described in our Cookie Policy; that cookie is strictly necessary to deliver what you paid for, which is why the analytics choice does not govern it. Adding an email or Google sign-in to the account retires both the link and the cookie.
  
  Our servers also record that the report was delivered, that the link was opened, and whether an account identity was later attached, under your account identifier. These are records of the purchase, not analytics, and the analytics choice does not control them — nothing is read from or written to your device to produce them. You can object at any time using the contact details in section 9.
• Enhanced analytics cookies and session replay (with your consent) — if you consent, PostHog may use cookies/local storage to recognise return visits, link product activity to your Broc account after sign-in, and record session replay. Once you have signed in, your analytics profile is labelled with your account identifier and your email address — and with your name, where your sign-in provider supplied one — so that we can tell whose activity we are looking at when we investigate a problem or answer a support question. That labelling applies only after you consent; it is never added to the anonymous measurement described above, and if you withdraw consent we stop it. Replay masks what you type; in the signed-in product it also masks on-screen text, so the prices and figures, anything you type and your account details stay hidden. A recording does show the fixed wording of the interface — menus, buttons, questions and the answer options offered — and so it shows which option you picked; and it shows the address of the property you are analysing, which the page's own web address already contains. Enhanced analytics run only with your consent: on our website via the analytics choice, and in the product via the one-time post-sign-in prompt or Settings → Privacy & analytics. See our Cookie Policy for details and how to change your choice.
• Marketing-email engagement (with your consent) — if you opt in to marketing emails (for example the “email me Broc's guides and product updates” checkbox, subscribing to our guides, or asking us to email you a link back to the checkout page for a property you were looking at — which also signs you up for occasional buying guides and short questionnaires about your search), our email provider records whether those emails are delivered and opened (via a tracking pixel in the email), and we record whether the personal links inside them are followed, against your account or subscription. That engagement measurement covers the marketing emails you chose to receive (the guides list, product updates after you opt in, and the short questionnaires about your search if you asked for the link back), and every one of them carries an unsubscribe link that stops them — and this tracking — immediately. A signed-in account can also switch those emails off at any time under Settings → Email preferences in the product.
  
  We also record whether our service emails ARRIVED.For the two messages we have to send you — the link to a report you bought without an account, and your order confirmation — our email provider tells us whether the message was delivered, bounced, was refused, or was opened, and we record that against your account. This is not marketing measurement and no unsubscribe link governs it, because these are not messages you can unsubscribe from. We keep it for one narrow reason: if you bought a report without creating an account, that emailed link IS your way back in, and a bounce we never saw is a paying customer locked out with nothing on our side saying so. The same goes for the property updates you ask us for from a receipt or from your strategy: we record whether each one arrived, and the stop link in every one ends them — and this record — at once. The one-off email we send when you create an account is a service message, not marketing: its unsubscribe link opts you out of future marketing mail without deleting your account, and it does not stop transactional mail we have to send you.
  
  Property updates you ask for. From your strategy, or from a link in your receipt, you can ask us to email you when something changes about a property you bought a strategy for or its local market — its asking price, whether it is still for sale, a sale of the home itself or of one nearby, and the area’s prices and demand. You can also ask for them from the page that prices your offer, before you buy anything; we email you a link to confirm first, and nothing is set up until you do. Each email is a list of those facts, checked about once a week and sent only when something has changed; it sells nothing and contains no marketing. Besides the stop link in every one, you can end them under Settings → Email preferences. Stopping them is not a marketing unsubscribe: it changes nothing about any marketing choice you have made, and a marketing unsubscribe does not stop them, because they are a separate request. They stop by themselves twelve months after you asked for them unless you renew.
• Technical and log data — such as IP address, device and browser type, and pages viewed, generated when you use the Service and necessary to operate and secure it.

Property and market data

To produce your analysis, we obtain property, address and area data from public registers and licensed third-party data providers. This data relates to properties and areas rather than to you personally, but may be combined with the address you search.

If we have written to you about Broc

Marina, Broc's founder, writes to journalists, editors and organisations whose work covers buying a home or leasehold, at the work address their organisation or publication lists publicly. An AI assistant drafts the emails and reads the replies, and Marina approves every email before it is sent. This is what we hold about you and why.

• What we hold: your name, your work email address, the organisation you work for, what you have published or said publicly on the subject, and our emails with you.
• Where it comes from: your organisation's or publication's own website or public listing.
• Why, and on what basis: to offer you information about Broc that may be useful to your work. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)). We send one email and at most one follow-up.
• Who sees it: Broc Intelligence Ltd, and three companies that work for us: Google, which hosts our email (Google Workspace); Notion, where we keep our outreach records; and Anthropic, whose AI assistant drafts our emails and reads replies. They may store it outside the UK, under the safeguards in section 6 of our privacy policy. We don't sell it or share it with anyone else.
• Tracking: our emails carry no tracking pixel, so we can't tell whether you opened one.
• How long we keep it: if you don't reply, we delete your details six months after our last email. If you reply, we keep the conversation while we are in touch and delete it six months after our last contact. If you ask us not to write again, we keep your email address on a do-not-contact list, only so that we don't.
• Stopping it: reply “no thanks”, or email support@trybroc.io, and we won't write to you again.
• Your rights: you can ask to see, correct or delete what we hold, to restrict how we use it, or object to our using it, by emailing support@trybroc.io. The right to data portability covers data you gave us under a contract or with your consent, so it does not apply here.
• Complaints: you can complain to us, by email to support@trybroc.io or by post to Broc Intelligence Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We acknowledge a complaint within 30 days and tell you the outcome. You can also complain to the Information Commission, the UK data protection regulator, at ico.org.uk.

3. EPC lookups (our free EPC checker)

Our EPC checker looks up the public register of Energy Performance Certificates for England and Wales, operated by the Ministry of Housing, Communities and Local Government, and shows you what a property’s certificate means. The register’s own guidance is that this data contains personal data, so when we display a certificate we act as a controller for that processing. This section explains it.

• What we look up, and when — only what a visitor asks for, at the moment they ask. A visitor who enters a postcode sees the homes at that postcode that hold a certificate, with each one’s band and the date it was registered: the list the register’s own postcode search shows, so they can pick the home they mean. We fetch the full certificate only for the home they pick, or for the single address they searched for. We do not keep the postcode list, we do not bulk-download the register, and we do not generate pages for addresses nobody has asked about.
• Why — to answer that lookup: to explain what the certificate says about running costs, condition and regulation for someone buying, letting or selling the property.
• Our lawful basis — legitimate interests: our interest in providing the service, and the visitor’s interest in understanding the energy performance of a property they are considering. We have carried out a legitimate interests assessment and keep it on file; email us for a summary.
• How long we keep it — a certificate we fetch is cached for up to 90 days so that repeat lookups do not call the register again, and expires after that. We do not keep a record of which visitor looked up which address, and our analytics never receives the address, postcode, UPRN or certificate number searched.
• If you type an asking price — the checker can offer to put a property’s energy band into pounds against its asking price. That figure is optional, is asked for only after the result, and is worked out in your browser: the price you type is never sent to us or stored. Our analytics records only that the feature was used and a coarse band (for example “£400k–£600k”) — never the figure itself, because an exact asking price and a timestamp together would point back at a specific property.
• If you email the breakdown to yourself — submitting the form sends a summary of that certificate to the address you typed (the send is the thing you asked for) and adds you to Broc’s guides mailing list, the same list the newsletter uses, on the same consent: agreeing to this policy by sending the form. You can unsubscribe from any email. We still do not build marketing lists from lookups themselves.
• What we never do — we do not build marketing lists from lookups, and we never contact a property’s owners or occupants because their certificate was viewed. Any email address we hold is one a visitor gave us themselves.

If a certificate is about your property. The register is the source, and changes to a certificate’s contents or its presence on the register are for the Ministry of Housing, Communities and Local Government, not for us. We can remove our cached copy at any time and stop the property being returned by our checker — email support@trybroc.io with the address or certificate number and we will action it, alongside the rights described in section 9.

Licensing. Certificate data is Crown copyright, published under the Open Government Licence v3.0. Address data is not covered by that licence — it derives from Ordnance Survey AddressBase Premium incorporating Royal Mail PAF data, and we use it for the permitted purpose of understanding building energy efficiency in the property market. Every result carries the register’s copyright and database-right notice, its licensing attribution, the certificate number and a link to the certificate on the register.

4. How and why we use your data (legal bases)

5. Who we share your data with

We do not sell your personal data. We share it only with the recipients below and where the law requires. Most are service providers who process it on our behalf under contract; the exceptions are Google Ads, which receives conversion confirmations and — where you have allowed advertising cookies — remarketing signals, as its own controller in both cases (see the table in section 4), and Google Sign-in, whose button is offered on the Service Charge Checker (see below). These include:

• Stripe — payment processing. Receives the amount, an identifier for your account, your account email address if you have one, and the reference number and address of the property a report is being bought for, as described under “Payment information” in section 2 — and, from your browser directly, the email address you type into its payment form if you buy without an account, together with the device and browser information its card-fraud checks use. Stripe is an independent controller for that fraud processing.
• Google Ads — two separate things, under two separate lawful bases, and it is worth keeping them apart.
  
  Conversion measurement (no consent needed, and it happens on our servers): the click identifier Google itself attached to your visit’s URL and the time an account was created, the onboarding wizard was finished, a checkout was started or a report was purchased, to confirm that an ad click led to that sign-up, wizard, checkout or sale; and, where a purchase is refunded, a matching instruction to take that confirmation back, carrying nothing beyond that same click identifier and the reference of the purchase being cancelled. No name, email, address, payment detail or account data is shared, and this happens only for visits that arrived from a Google ad. We do not use Google’s enhanced conversions: no hashed email address or phone number is ever sent.
  
  Remarketing (only if you allow advertising cookies): Google’s tag runs in your browser so Google can show you our ads again elsewhere. It receives the page address without its query string on our website, and from our product app only that a visit happened plus which of four points in the purchase journey it reached. Never your name, email, the property, its address, your answers or any report content. See the advertising bullet in section 2 and the Cookie Policy for the full list and how to withdraw.
• Google Sign-in — the “Continue with Google” button on the Service Charge Checker’s report, an alternative to typing the address a link to it is emailed to. When the button is shown, your browser loads Google’s sign-in script from Google, so the sign-in window can open the moment you press it. Like any request to Google, that gives Google your IP address, your browser, that the request came from our site, and any Google cookies your browser sends with it; nothing about you or your email is asked of Google until you press the button. If you do, Google tells us the email address on your Google account and whether it is verified. We use only those two and discard the rest of Google’s reply; the address is then treated exactly as a typed one (section 13). Google, as its own controller, sees that you signed in from our site. No account is created with us.
• Supabase — authentication, database and hosting.
• Vercel — website and application hosting/deployment. For the Service Charge Checker (section 13), also the private document store that holds uploaded accounts, the AI Gateway both model calls go through, and the durable workflow that runs the analysis.
• OpenAI and Anthropic — AI model providers, reached only through Vercel’s AI Gateway and only for the Service Charge Checker. They receive an uploaded document as processors on our instructions and return the extracted figures for that request: OpenAI reads every document, and Anthropic reads one only when that first reading fails or comes back unsure. A second, shorter request to OpenAI carries the report’s own figures and the building details you typed — never the document — and returns the short readings the report labels as AI-written. No Google model is used.
• PostHog (EU Cloud) — product analytics, session replay, and technical error and server-log monitoring.
• Resend — email delivery: account, guides and Service Charge Checker emails, and the contact record behind your unsubscribe choice. For the Service Charge Checker a contact record is kept only if you tick the box for our leasehold emails; it then carries four targeting fields once you open the emailed report (which situation you chose, the verdict band, the postcode district you typed and the page you came from) and joins a leads segment — section 13 explains why, and Delete my data clears them (or, if it cannot at that moment, we finish the job as section 13 describes). Without the box, Resend only delivers the email you asked for.
• Email and support providers — to communicate with you.
• Licensed property-data providers — as data sources for your analysis.
• Professional advisers and authorities — e.g. our accountants or lawyers, or regulators and law-enforcement where we are legally required to disclose.

Sharing a report yourself

A property purchase is usually decided with someone else, checked by a broker and executed by a solicitor, so a report can be shared. This is your act, not ours: we never send your report to anyone on your behalf, and nothing is shared unless you create a link.

When you choose to share a report, we create a private web address containing a long random code and show it to you once. Anyone who has that address can open the report without signing in, so treat it like a password — send it only to people you mean to give it to, and be aware that whoever you send it to can pass it on.

What a recipient sees: the property’s address and details, the asking price, our recommended offer and the reasoning behind it, the score and its breakdown, the price history, our analysis of the seller’s position, and the negotiation plan — the report as it stood when you last ran it. What they do not see: your name, your email address, your account, your answers to our questions as you typed them, your payment details, any other property you have analysed, or anything you do in the product afterwards. They cannot change anything, and they cannot sign in.

You stay in control. A report has at most one live link at a time, creating a new one switches the old one off, and you can switch sharing off entirely at any moment — from the report or from Settings, where every live link is listed. Once a link is switched off it stops working immediately and permanently, and it cannot be turned back on. We store only a one-way fingerprint of the code, never the address itself, so nobody at Broc can open or re-send your link. We record that a link was opened, so we can tell you whether it has been; we do not record who opened it.

6. International transfers

Some of our providers and recipients process data outside the UK. Where they do, we rely on an appropriate safeguard recognised under UK data-protection law — such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses — so your data receives an equivalent level of protection. Our product-analytics and session-replay provider, PostHog, hosts our data on EU infrastructure. Google, which receives the conversion and (with your consent) remarketing data described in sections 4 and 5, and the sign-in requests described in section 5, is a US-headquartered recipient and is certified under the UK Extension to the EU–US Data Privacy Framework.

7. How long we keep your data

We keep your personal data only for as long as necessary for the purposes above. Account and analysis data is retained while your account is active and for a reasonable period afterwards; transaction and accounting records are kept for the period required by law (generally six years). EPC records fetched by our checker are cached for up to 90 days (section 3). A share link you create lasts until you switch it off; the record that it existed, and that it was switched off, is kept with your account afterwards so the history of who could read your report stays accurate. A negotiation log lasts as long as the report it is kept in: you can delete any entry yourself, and the whole log is deleted if the report is refunded or your account is erased. A request for property updates runs for twelve months from the day you make or renew it (section 2), and the record of which updates we sent you is kept with your account. Documents uploaded to the Service Charge Checker, the figures extracted from them and the resulting report are deleted about 24 hours after the upload unless you ask us to email you a link to the report; if you do, they are kept for as long as we operate that service, or until you delete them (section 13). The details of people we have written to about Broc are kept as section 2 sets out. When data is no longer needed, we delete or anonymise it.

8. How we protect your data

We use appropriate technical and organisational measures — including encryption in transit, access controls and reputable infrastructure providers — to protect your data against unauthorised access, loss or misuse. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the regulator of any breach where required.

9. Your rights

Under UK data-protection law you have the right to:

• access a copy of your personal data;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time (without affecting prior processing).

To exercise any of these, email support@trybroc.io. We will respond within the statutory timeframe.

You have the right to complain to us about how we handle your data: email support@trybroc.io or write to Broc Intelligence Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We acknowledge a complaint within 30 days and tell you the outcome. You can also complain to the Information Commission, the UK data protection regulator (formerly the Information Commissioner's Office), at ico.org.uk.

10. Cookies and similar technologies

We use cookies, scripts and similar technologies as described in our Cookie Policy. Enhanced analytics cookies and session replay are only enabled with your consent, and advertising cookies are a separate consent again — allowing one does not allow the other, and either can be withdrawn on its own. Before you choose, the limited anonymous statistics described in section 2 may run on the website and on the anonymous parts of the product — including a guest checkout, where you have not signed in — under the PECR statistical- purposes exception: the analytics identity lives only in your browser tab’s session storage and is discarded when the tab closes, no analytics cookie is set, replay is off, product custom events are tightly filtered, URL query strings and advertising click identifiers are removed, the part of a web address that names the specific property is replaced with [redacted] before anything is sent, and the activity is not linked to your account. The marketing controls and the anonymous-statistics notice in the product provide a simple way to object; choosing Reject/No thanks or Turn off stops that measurement too. Nothing at all is requested from Google’s advertising tag until you allow advertising cookies, and the same controls withdraw that permission for both trybroc.io and app.trybroc.io — the product app never asks the advertising question itself, it only honours the answer you gave here. It does not stop the server-side counting described in section 2 (the anonymous counts, and the checkout records filed under your account), which uses no cookie and no device storage — that is why it sits outside this section and has its own objection route.

11. Children

The Service is intended for adults (18+) and is not directed at children. We do not knowingly collect personal data from anyone under 18.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the “last updated” date above; where changes are significant we will take reasonable steps to bring them to your attention.

13. Service Charge Checker: uploaded documents and emails

Our Service Charge Checker has two parts. The instant benchmark check runs entirely in your browser from figures you type and sends none of your figures to us — only the usual, consent-gated analytics band (section 10), and nothing at all unless you continue to the upload, when the building details you typed travel with the pack. The accounts analysis is different: you upload service charge accounts, budgets or demands as PDF files, we read them with an AI model to produce a report, and the report opens on the page — no email address is needed to read it. Under the report you can then ask us to email you a link to it. This section explains that second part.

• What you give us — which of four situations you are in (buying, own or selling, a director of the residents’ company, or curious); optionally the building details you typed into the benchmark check, or into the report’s own building-details form afterwards (region, bedrooms, height and age bands, the amenities you ticked, the annual charge, the ground rent, the years left on the lease, the floor area, your mortgage rate, and the postcode district — never a full postcode); up to eight PDF documents; and, only if you ask us to email you a link to the report, your email address and whether you also want our leasehold emails. Service charge documents routinely contain personal data about other people — an arrears schedule by flat, the names of directors, agents or contractors — and we treat every upload on that assumption.
• What we do with the documents — an AI model extracts the figures (totals, line items by category, reserve-fund movements, the type of accountant’s report, and similar) into a fixed set of fields. Every conclusion in the report — the verdict, the band, each flag, every entitlement and every figure — is then worked out by our own software from those figures against published benchmarks. A second model call is then given only the figures our software produced and the building details you typed, never the documents, and writes short readings of them: how the headline charge was reached, what the largest categories suggest you ask, what each flag means for you, and questions for the seller’s solicitor or the managing agent. Those readings are the only text written by a model that reaches you; the report labels each of them as AI-written, we check that every figure in them is one the report already states and drop any sentence that fails, and the report is delivered without them if that call does not succeed. Free text found inside a document is not carried into the report, the email or those readings. Neither model has tools, and the one that reads the document is instructed to treat the document as data, never as instructions.
• The same document, uploaded again — if you upload a document that is byte-for-byte identical to one uploaded before, by you or by anyone else, we may reuse the reading we already made of it instead of reading it again; a reading of your upload may be reused the same way for someone who later uploads the identical file. Only the reading is copied: nothing that identifies the other upload or the other person is copied or shown to you. Deleting your data removes your copy and your report and does not reach anyone else’s copy of the same file, and deleting theirs does not reach yours.
• The notice at the upload — directly above the button that sends the documents, the checker says that uploading accepts our Terms, that the documents go to a private store where an AI model reads the figures from them, and how long they are kept, with a link to this section. There is no box to tick: keeping and reading the documents is the service you are asking for, and it rests on legitimate interests (below), not on consent. We record which version of that notice you saw.
• Why we keep the documents — while your report can still be reached, we retain the uploaded files in a private document store, together with the extracted figures and the report, for three purposes: to show your report, and again when you open the emailed link; so that we can re-run the extraction as our reading of these documents improves, and a report can be corrected rather than left wrong; and so that we can build a benchmark of what service charges actually cost. The second and third are stated as intentions: today nothing re-extracts or aggregates on its own, and our legitimate interests assessment says so. Any such benchmark will be kept coarse — postcode district, building type, category totals — and will never contain an address, a name or the documents themselves.
• Our lawful basis — legitimate interests: ours in providing and improving the analysis and in building the benchmark, and yours in understanding a charge you are being asked to pay or to take on. We have carried out a legitimate interests assessment and keep it on file; email us for a summary. The report email and the marketing emails are covered separately, below: the first is a message about your own request, and the second rests on your consent.
• How long we keep it — if you do not ask us to email you a link to the report, we delete the documents, the figures extracted from them and the report about 24 hours after you upload them: once the tab is closed nobody can open that report again, so there is nothing left to keep them for. If you do ask, we keep them for as long as we operate the service, or until you delete it, whichever comes first. That is deliberately not a fixed window: the documents are what let us correct your report later, and you hold the delete control throughout. If you start the upload step and never upload anything, we delete what you gave us there — who is reading and any building details you typed — about 24 hours after you started.
• Delete my data — every report carries a Delete my data button in the browser session you uploaded from. Pressing it removes the uploaded documents from the store, the figures extracted from them and the report itself, and, if you gave us an email address, replaces it on the record with a marker that it was erased, and deletes every address the link was sent to, including one you corrected. If the four targeting fields described below cannot be cleared at our email provider at that moment, the record also keeps a pseudonymised fingerprint of your address (a hash of it, never the address itself) until they are, so that we can finish the job; it is deleted once we have confirmed they are cleared. We keep it only to complete your erasure request, which the law requires of us (UK GDPR Art. 6(1)(c)), and we aim to finish within one month. Nothing in an erased record can be re-analysed. The link in the report email deliberately cannot delete anything on its own — a forwarded email must never be able to destroy your data — so a report opened from your inbox shows how to ask us instead (email us at support@trybroc.io from the address you gave), and we erase it the same way. It does not recall an email already sent to you, and it does not remove your contact record with our email provider — the unsubscribe link in any email stops the emails, and the rights in section 9 cover the rest.
• The email you ask for, and the box beside it — the report opens on the page, and no email address is needed to read it. Under it, you can ask us to email you a link to the report: we send that address one email, with a summary of the report and a link that opens it again on any device. You can send it to a corrected address as well, three addresses at most. Once the link sent to an address has been opened, that address is not emailed again; a different address can still be sent until its own link is opened. A corrected address keeps a hash of the address and whether its link was opened, so that address is not emailed again, until you delete the report. Delete my data deletes those rows. That email is a message about your own request, not marketing: it rests on legitimate interests (yours and ours in delivering what you asked for), it carries nothing that sells, and it says it is the only email we will send unless you ask for more. Beside the address is a separate box, unticked until you tick it, for our leasehold negotiation emails; the link goes whether or not you tick it. Ticking it is the basis for those emails: your consent, and we record which version of the box’s wording you saw. Every one of them carries a one-click unsubscribe that stops them immediately. If you tick it, when you open the emailed report we attach to your contact record at our email provider which situation you chose, the verdict band, the postcode district you typed and the page you came from, and add it to a leads segment, so the leasehold emails match your situation; Delete my data clears these four fields, or, if it cannot at that moment, we finish the job as described above. If you do not tick it, we keep no contact record for you at our email provider and record none of those fields. We never contact a freeholder, a managing agent or anyone else named in your documents.
• Addresses given at the old email field — until this version of the policy, the checker asked for the email address before the upload, under a notice that named both the report email and our leasehold negotiation emails. For an address given that way we email the report when it is ready. If no report can be produced — the documents cannot be read, or the analysis does not finish — we send that address one email instead, saying what happened and how to start again or have the documents deleted. That email is a message about the request you made, not marketing: it rests on legitimate interests (yours and ours in your knowing what became of your request and your documents), not on the notice, and it carries nothing from your documents, no link to them and a one-click unsubscribe. The leasehold emails to an address given there before this version took effect rest on the consent recorded then — submitting the form having read that notice, whose version we recorded — with the same one-click unsubscribe and the same four fields as above once the emailed report is opened. An address given on that form after it took effect, from a page opened before the change, receives the report and none of the leasehold emails.
• If you type an asking price — as with the EPC checker, the report can put the charge into pounds against a price you type afterwards. The figure stays in your browser and is never sent to us; our analytics records only a coarse band.
• What our analytics never receives — your email address, an address or full postcode, a company or agent name, the documents, a link to them, or any figure from your accounts. It sees bands and counts only: which situation you chose, how many documents were read, the verdict band, and whether you asked for the link, ticked the box and typed the address or took it from Google. The personal link in the report email is never sent to our analytics either.

Who handles the documents. They are stored, and the analysis is run, on Vercel — its private document store, its AI Gateway and its durable workflows. The extraction call goes through that gateway to OpenAI, or to Anthropic when OpenAI’s reading of a document fails or comes back unsure, as processors on our instructions: they receive the document only to return the extracted figures for that request. The second call, for the readings described above, goes to OpenAI and carries the report’s figures and the building details you typed, never the document. No Google model is used. Resend delivers the report email, or the email we send instead when no report can be produced. All of them appear in section 5.

If a document is about your building. The accounts a leaseholder uploads are theirs to hold and to share with a buyer. If you believe a document naming you has been uploaded and you object, email support@trybroc.io and we will action it, alongside the rights described in section 9.