Privacy Policy

Symfonic is a trading name of Worx Worldwide Ltd, a company registered in England and Wales (company number 10014914), of Lower Lodge Studios, Haslemere, Surrey GU27 3NH ("we", "us", "our"). We provide a property management platform for landlords, letting agents and property managers, with a portal and app for their tenants (the "Service").

We act in two roles under the UK GDPR and the Data Protection Act 2018:

• Controller for the personal data we need to run our own business: user accounts and sign-in security, billing, support, service emails, and our records of how the Service is used.
• Processor for the personal data our customers (landlords and agents) put into the Service about other people, such as tenants, occupiers, guarantors and suppliers. The landlord or agent is the controller of that data and decides how it is used. If you are a tenant, your landlord or agent is your first point of contact for questions about your tenancy data.

Questions about this policy: help@symfonic.app.

Account and sign-in data: name, email address, role, organisation membership, and the data needed for multi-factor sign-in (for example an authenticator app link or one-time codes sent by email).

Organisation data: business name, address, landlord contact details, company number where provided, and joint landlord details.

Property and compliance data: property addresses and features, certificate dates and documents (gas safety, EICR, EPC, smoke and carbon monoxide alarms, licensing and similar), inventories and check-in records.

Tenancy data: tenant and occupier names, contact details, tenancy dates, rent and deposit details, Right to Rent check records, tenancy agreements, notices and signed documents (including signer name, time, IP address and device information).

Financial data: income and expense transactions, bank statement imports, tax year settings and, if you connect them, HMRC Making Tax Digital details (including National Insurance number and HMRC business identifiers) and Xero data.

Maintenance data: fault reports, photos and videos, work orders, supplier details, comments and resolution notes.

Communications: messages with our AI assistants (Si for landlords, Geoff for tenants, Charlie for land and estates), in-app messages, WhatsApp messages where enabled, and emails sent through the Service.

Billing data: plan, subscription status and invoices. Card details are collected and held by Stripe; we do not see or store full card numbers.

Technical and usage data: pages visited within the Service, audit logs of actions taken, push notification subscriptions, and whether onboarding emails were opened or clicked.

We do not intend to process special category data. Landlords and tenants should avoid entering health or similar information unless it is needed, for example to record a hazard affecting a vulnerable occupier.

• Providing the Service and managing your account (contract, Article 6(1)(b)).
• Billing, tax and accounting records (contract and legal obligation, Article 6(1)(b) and (c)).
• Security, fraud prevention, audit trails and keeping the Service working (legitimate interests, Article 6(1)(f)).
• Service and onboarding emails, and measuring whether they are useful (legitimate interests; you can unsubscribe from onboarding emails at any time).
• Optional connections to HMRC, Xero, WhatsApp and other services, and push notifications (your request and, where required, consent, which you can withdraw by disconnecting or changing your settings).
• Data we process for landlords and agents is processed on their instructions; they are responsible for having a lawful basis and for giving their tenants privacy information.

AI assistants. When you use Si, Geoff or Charlie, your message and the records the assistant needs to answer it are sent to an AI model provider to generate a reply. Symfonic does not train AI models on your data. Assistants give general information and may be wrong; they do not make decisions that have legal or similarly significant effects on you.

We do not sell personal data. We share it only as needed to run the Service:

Hosting platform. The Service is built and hosted on Base44 (Base44, Inc., United States), which acts as our processor. Base44 uses its own sub-processors, currently: MongoDB (database), Supabase (file storage), Render (servers), Google Cloud (analytics services), SendGrid (email), Datadog (logging), OpenAI and Anthropic (AI models), all in the United States, and Wix.com Ltd (Israel), Base44's parent company. Base44 publishes its current list at base44.com.

Our other providers:

• Resend: delivery of service and notification emails.
• Stripe: subscription payments, processed in the UK, Ireland and the United States. Stripe is also a controller for its own fraud and compliance checks.
• AI model providers reached through Base44 (OpenAI, Anthropic and Google): generating assistant replies and reading uploaded documents.
• Meta (WhatsApp Business Platform): tenant messaging, only where a landlord has enabled it and the tenant has linked their number.
• Browser and device push services (for example Google, Apple and Mozilla): delivering push notifications you have switched on.

Services you choose to connect: HMRC (Making Tax Digital submissions), Xero (accounting), Guesty (holiday let bookings) and Google Chat. Their own terms and privacy notices apply to data held on their side.

Public data look-ups. To show property information we send property addresses or postcodes, or company numbers, to public sources: the EPC register, HM Land Registry, Companies House, the Environment Agency (flood data), data.police.uk and postcodes.io. We do not send names of tenants or users for these look-ups.

People you ask us to share with: tenants (documents, notices and messages), suppliers and contractors (work order details, access notes and photos) and team members in your organisation, according to the permissions you set.

We may also disclose data where the law requires it, or to protect the rights and safety of users and others.

Our primary hosting, database and file storage are currently in the United States, so personal data in the Service is transferred outside the UK. Where we or our providers transfer data from the UK to a country without UK adequacy regulations, the transfer is protected by an approved mechanism: the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or the EU Standard Contractual Clauses with the UK International Data Transfer Addendum. Transfers to Israel rely on the UK's adequacy regulations for Israel.

We intend to move primary hosting to a UK or European region. We will update this policy when that happens. You can ask us for more detail about the safeguards for any transfer.

• While your account is active, we keep your data so the Service works.
• Financial and tax records: six years, in line with HMRC record-keeping rules.
• Tenancy agreements, signed documents, notices and compliance records: six years after the tenancy or record ends, as evidence in case of claims.
• Audit logs, fault reports and work orders: six years.
• Properties beyond the free plan after a trial ends: read-only for 90 days, then permanently deleted if no paid plan is chosen (see our Terms).
• Connection tokens (HMRC, Xero and others): deleted when you disconnect.
• Onboarding email tracking: kept until the onboarding sequence ends or you unsubscribe.

After an account is closed we delete or anonymise data when its retention period ends. Landlords and agents can ask us to delete or return their data earlier, subject to these legal retention needs.

• Data is encrypted in transit (TLS) and stored with providers that encrypt it at rest.
• Every account must complete a second sign-in step (multi-factor authentication).
• Access controls limit each user to their own organisation and, for team members, to the properties they manage.
• Sensitive documents (for example Right to Rent checks, tenancy agreements and signatures) are kept in private storage and opened through short-lived links issued only to people allowed to see them.
• Connection tokens for HMRC, Xero and similar services are kept on the server and never sent to your browser.
• Key actions are recorded in audit logs.

If a personal data breach occurs, we will report it to the Information Commissioner's Office within 72 hours where required, tell affected people without undue delay where there is a high risk to them, and tell affected landlords and agents without undue delay so they can meet their own duties.

You have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to its use, to data portability, and to withdraw consent where we rely on it. These rights have some legal limits, for example where we must keep records.

To use them, email help@symfonic.app. We will reply within one month. If you are a tenant and your request is about your tenancy records, we will pass it to your landlord or agent, who is the controller, and help them respond.

You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.

Symfonic does not use advertising or analytics cookies, and does not use third-party tracking on the Service. We use storage on your device only where it is needed for the Service to work or to remember your choices:

• Sign-in: a sign-in token kept in your browser's local storage, and session storage during the sign-in and multi-factor steps. These are strictly necessary.
• Preferences and convenience: recently viewed properties, assistant chat history, and a plan or referral code chosen on our website, held until sign-up finishes.
• HMRC connection: the details you enter to connect HMRC are held briefly while you are sent to HMRC to sign in, then cleared when you return.
• Push notifications: if you switch them on, your browser holds a subscription that lets us send notifications.

Our hosting provider records which pages signed-in users open so the Service can be operated and supported. Onboarding emails contain a small image that records when they are opened; you can stop this by unsubscribing from onboarding emails.

Accounts are for adults (18 and over). Landlords may record details of occupiers who are children where the law requires it, for example for Right to Rent or licensing; they should record only what is necessary.

We will update this policy when our practices or providers change, and tell you about material changes by email or in the Service. The date at the top shows when it was last revised.

Worx Worldwide Ltd (trading as Symfonic), company number 10014914, Lower Lodge Studios, Haslemere, Surrey GU27 3NH.

Email: help@symfonic.app