SERVICE CHARGE RESCUE — PRIVACY NOTICE
Version: scr-privacy-2026-10-22-final-candidate
Who looks after your information
Ranson Property Limited, company number 09907126, operates Service Charge Rescue and decides how case information is used. Privacy contact: help@servicecharge.help. Registered office: Unit 2.02 High Weald Huse, Glovers End, Bexhill, East Sussex, England, TN39 5ES. Postal contact: Level 39, One Canada Square, Canary Wharf, London E14 5AB.
What we collect
We collect the documents you upload, your questions and comments, property and contact details, account figures, relevant correspondence, document readings, assessment results and your agreement and approval history. Supabase Auth processes your email address, sign-in identifiers and authentication/security records for email-code access. Sign-in identifiers link each case to its owner. Payment-provider confirmations are recorded when payment setup is enabled. The portal does not ask you to type card numbers into a case form.
Information needed to assess or handle your case
You choose whether to request an assessment or appoint us. We need your contact and property details and enough relevant documents to assess your request and perform any agreed service. If you do not provide essential information, we may be unable to assess the case or continue the work; we will explain what is missing. We do not require unrelated personal information. Optional launch marketing remains separate.
Why we use it
We use this information to assess the case you ask us about, answer your questions, identify missing details and prepare proposed work. If appointed, we use it for authorised correspondence, case updates and the agreed payment process. Access checks and an activity history help protect cases and resolve mistakes or disputes. Optional launch updates have their own registration choice.
Document reading and your case assistant
OpenAI software processes selected original documents, document readings, your questions and relevant case information to prepare assessments and answers. The software can miss details or be wrong. An assessment does not mean a person has reviewed it. Routine assessment and clarification do not depend on a person checking each result. You may email us to request a person to check an assessment or an answer. Under an accepted appointment and the authority you have given, authorised routine requests for missing details may be sent automatically to the named billing party within the agreed scope. Substantive outgoing letters require review and approval, including your approval of the proposed letter. An assessment alone cannot send substantive letters, accept a settlement or commit you to a payment. Settlements and payment commitments require your specific approval.
How automated processing affects your case
The software compares the lease and charge documents with account figures and correspondence, identifies apparent differences or missing information, and checks sources and calculations. Those results can shape the proposed work and routine clarification requests; an apparent difference is not a confirmed error or saving. Automated checks are not human review. You can give us your own explanation, challenge a result and ask the General Manager at help@servicecharge.help for a person to reconsider it. If a decision based solely on automated processing has a legal or similarly significant effect on you, you can obtain information about the decision, make representations, contest it and obtain human intervention from someone able to reconsider and change it. These safeguards are available on request; they do not mean every assessment or routine request is checked by a person.
Only send information relevant to this case
Remove unrelated account numbers, identity documents and other people’s private details where they are not needed. Keep separate properties in separate cases. Avoid sending health details, criminal-offence information or other sensitive information unless we have specifically explained why it is needed and how it will be handled.
Signing in and essential cookies
Email sign-in uses Supabase Auth in our dedicated London project. Supabase verifies your email code and manages the sign-in session. The website uses secure, HttpOnly, SameSite session cookies to keep you signed in and refresh your session. These cookies support the access you request and are separate from optional website measurement. Microsoft 365 sends your sign-in code from help@servicecharge.help. Our email hook does not store the code or save a sent-message copy. Signing out ends this website session; it does not delete your sign-in account or case records.
Who may receive information
The website runs through Sites and Cloudflare storage. OpenAI handles document reading and assistant requests. Supabase handles email authentication, rather than case document storage. Microsoft 365 handles email sent to our mailbox. Stripe handles secure card setup and payment processing when enabled; the website receives provider references and confirmations rather than full card details. The Render payment receiver checks and forwards signed Stripe events to the case system; these can include customer and payment-method information supplied by Stripe. It is not our case-document store. Render also processes account and service-usage data for its own operational purposes under its privacy policy. Where you appoint us, relevant information may be shared with the managing agent, freeholder or collector named in your agreement. Cases are not made visible to other leaseholders.
Stripe’s own responsibilities
When payments are enabled, Stripe also decides how payment information is used for fraud prevention, security and its legal compliance duties. For those purposes it acts as a separate data controller. Its privacy policy explains its own handling and rights-request routes: https://stripe.com/privacy.
Where information comes from
Most information comes from you and the documents or messages you supply. A document may also contain details about an agent, creditor, joint owner or another person. Once correspondence is connected or filed, relevant replies and attachments may come from the named counterparty. Email attachments must be matched to the correct property; an email address alone does not authorise access to a case.
Our processing grounds
For an individual requesting an assessment or appointing us, we use information necessary to take steps at their request before a contract, or to perform that contract. A client’s contract does not itself cover other people’s information. For relevant representatives, counterparties and other people named in case records, we rely on legitimate interests in assessing and resolving the authorised service-charge issue, subject to necessity and their rights. We also rely on legitimate interests for proportionate security, maintaining an accurate case history and handling disputes. Where a specific law requires a record, we rely on that legal obligation and can explain which obligation applies. Optional launch marketing uses its separate consent. Uploading paperwork is not blanket consent to other uses. We do not rely on an ordinary contract or legitimate interests alone to process special-category or criminal-offence information; we must identify an applicable additional legal condition before using such information.
Storage and retention
Our retention policy provides for removal of unappointed portal assessments after 90 days without case activity, unless a documented hold or unresolved matter requires review. We retain active appointed cases while needed, and normally keep closed-case agreements, approvals and financial records for six years after closure. We review unnecessary source documents for earlier removal. Legal claims, disputes, privacy requests and other obligations may require particular records to be kept longer, with the reason reviewed. Cleanup covers the portal and its file storage; Supabase sign-in accounts and copies in Microsoft 365, Stripe and provider backups require separate controlled handling. Removing a portal case does not itself remove its sign-in account. Ask the privacy contact to review account deletion as well as case records. A limited deletion record helps prevent deleted data being restored or reimported.
Processing locations and international transfers
Our Supabase Auth project is hosted in London. Supabase describes logs stored in EU data centres and global support, account and operational processing outside the selected project region. Exchange Online data-at-rest geography for our Microsoft 365 tenant is the United Kingdom; this does not establish UK-only processing of all service or support data. OpenAI document processing uses the standard Responses API endpoint with store:false. That setting does not establish Zero Data Retention or UK-only processing. Sites and Cloudflare host the portal and its storage; we have not established a UK-only location for all primary, recovery, support or log processing. Stripe describes processing in the United States and other countries and sets out transfer protections in its Data Transfers Addendum at https://stripe.com/gb/legal/dta. Our payment receiver runs in Frankfurt, while Render’s DPA describes primary processing in the United States and provides transfer protections, including the UK Addendum where applicable. Published provider agreements include relevant contractual transfer mechanisms, but their applicability depends on the actual processing and contract. Ask the General Manager at help@servicecharge.help for details of the safeguards that apply to your information and a copy, subject to appropriate redactions. We do not promise that all processing stays in the UK.
Payment receiver logs
The payment receiver has no local event store or application-level payment-payload logger. Its Render workspace is on Hobby, whose dashboard logs are available for seven days. This is a dashboard-log period, not a promise that all account, platform or backup information is erased after seven days. Other provider retention and privacy-request handling are assessed separately.
Your right to object
You can object to our processing based on legitimate interests, including security, case records or dispute handling, because of your particular situation. We will consider your objection and explain any lawful grounds for continuing. You can object to direct marketing at any time; we will stop using your information for that purpose.
Your choices and privacy requests
Address your request to the General Manager at help@servicecharge.help to ask for access to your personal information, a correction, deletion, restriction or a portable copy, where the relevant right applies. We may need to check your identity and explain any records we must retain. We respond without undue delay and normally within one month. If a lawful extension or pause applies, we explain the reason and the applicable deadline. You can object to processing based on legitimate interests and to direct marketing. Where consent is used, you can withdraw it at any time by contacting us; withdrawal does not affect the lawfulness of processing before withdrawal. Signed-in clients can also download their portal case information and record a tracked privacy request below. This case copy is not a full subject access response; contact us for other information. Stopping marketing is separate from cancelling your service agreement or changing payment permission.
Concerns and complaints
Please address concerns about our use of your information to the General Manager at help@servicecharge.help. Authorised senior management may receive these requests for urgent review and follow-up. We aim to acknowledge complaints within two working days and give a substantive reply within ten working days, or explain when you will receive one. We acknowledge data protection complaints no later than 30 days after receipt, investigate and keep you informed without undue delay, and explain the outcome and any action taken. This complaints process does not extend the separate deadlines for exercising your data rights. You can also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.
Website measurement
Launch registration and optional website measurement have separate information and choices. Case documents and assistant questions are processed for your case. We do not use their contents for advertising.
Your information and requests
Download a copy of the information shown in your case, or ask us about access, correction, deletion or another privacy right. A deletion request is reviewed before records are removed. Contact help@servicecharge.help for requests involving other records or if you cannot sign in.