Last updated: 28 March 2026
This Privacy Policy explains how Awaybase Software Ltd ("Awaybase", "we", "us", "our") collects, uses, shares, and protects your personal data when you use our website at awaybase.co.uk and our platform at portal.awaybase.co.uk (together, "the Service").
We are the data controller for the personal data we collect about you. We are registered with the Information Commissioner's Office (ICO) under registration number ZB726100.
If you have any questions about this policy or how we handle your data, please contact us at team@awaybase.co.uk.
Full card numbers and CVV are never seen or stored by Awaybase. All payment card data is handled directly by our payment processor, Stripe.
We process this data solely to provide the analysis service to you. We do not use your property data for any other purpose, including AI model training, without your explicit consent.
We collect personal data in the following ways:
We rely on the following lawful bases under UK GDPR Article 6:
We process your account, billing, and usage data where necessary to provide the Service under our Terms of Service. This includes creating and managing your account, delivering property deal analysis, processing payments, and providing support. You cannot use the Service without us processing this data.
We process certain data where we have a legitimate interest that is not overridden by your rights. These activities include:
Where we rely on legitimate interests, you have the right to object (see Section 10).
We rely on your explicit consent for:
You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before that point.
We retain certain financial and account records where required by law, including HMRC record-keeping requirements and the Companies Act 2006.
| Purpose | Data Used | Lawful Basis |
|---|---|---|
| Account creation and management | Account data | Contract |
| Delivering the deal analysis platform | Account, property, and usage data | Contract |
| Payment processing and billing | Billing and account data | Contract |
| Transactional emails (billing, password resets) | Account data (email) | Contract |
| Customer support | Communications and account data | Contract |
| Platform security and fraud prevention | Usage and technical data | Legitimate interests |
| Service improvement and analytics | Usage data (aggregated) | Legitimate interests |
| Marketing to existing subscribers | Account data (email) | Legitimate interests |
| Marketing to prospective users | Contact data | Consent |
| Analytics cookies | Cookie and usage data | Consent |
| Legal compliance and financial record-keeping | Billing and account data | Legal obligation |
| AI-powered property analysis | Property and usage data | Contract |
We do not sell your personal data. We share it only with the following categories of third parties, all of whom are bound by Data Processing Agreements:
We use Stripe to process subscription payments. Stripe receives your billing name, address, email, and payment card details. Stripe operates under its own privacy policy and is certified under the UK-US Data Bridge. Full card data is never transmitted to or stored by Awaybase.
Our platform is hosted on secure cloud infrastructure. Our hosting provider processes technical and usage data as a data processor acting on our instructions, with data stored in UK or EEA data centres.
Our deal analysis features are powered by AI. When you submit property data for analysis, that data is transmitted to our AI API providers for processing. These providers act as data processors under our instructions. They are not permitted to use your data to train their own models. See Section 8 for full AI disclosures.
We use a third-party email delivery service to send transactional and marketing emails. This provider processes your email address and, where applicable, your name.
We may disclose personal data to law enforcement agencies, courts, the ICO, or other government authorities where required or permitted by law, or to protect the safety of our users.
In the event of a merger, acquisition, or sale of Awaybase Software Ltd, personal data may be transferred to the acquiring entity. We will notify you before your data is transferred and becomes subject to a different privacy policy.
Cookies are small text files placed on your device by our website. We also use similar technologies including local storage and session storage.
These are essential for the website and platform to function. They include authentication cookies, session management, security tokens (e.g. CSRF protection), and your cookie preference record. You cannot opt out of strictly necessary cookies while using the Service.
These help us understand how visitors use our website. They collect anonymised data about pages visited, session duration, and navigation patterns. These cookies are only set with your consent.
When you first visit our website, you will be shown a cookie banner where you can accept all cookies, reject non-essential cookies, or customise your preferences by category. You can change your preferences at any time via the "Cookie Preferences" link in the footer.
Awaybase uses artificial intelligence and machine learning to power property deal analysis. When you input property details and financial parameters, our system generates deal analysis outputs including estimated returns, yield calculations, and investment metrics.
Our AI is a decision-support tool. It does not make investment decisions on your behalf and does not assess your personal suitability for investment. All outputs are analytical estimates — you remain entirely responsible for any investment decisions you make. Please verify all AI outputs independently and seek professional advice before acting.
Our AI outputs do not produce legal or similarly significant effects on you as defined by Article 22 UK GDPR. If this changes, we will update this policy and provide appropriate safeguards including the right to human review.
To power analysis features, property data you submit may be transmitted to third-party AI API providers. These providers act as data processors under our instructions, are bound by Data Processing Agreements, and are not permitted to use your data to train their own models without your explicit consent.
We do not currently use your property input data or personal data to train our own AI models. If we propose to do so in the future, we will seek your explicit, specific, and informed consent — and refusal will have no impact on your use of the Service.
Some of our third-party service providers are located outside the United Kingdom. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place:
You can request details of the specific transfer mechanisms in place by contacting us at team@awaybase.co.uk.
We retain personal data only as long as necessary for the purposes for which it was collected and to meet our legal obligations.
| Data Type | Retention Period | Reason |
|---|---|---|
| Account data (active account) | Duration of subscription + 90 days after closure | Contractual necessity |
| Property data and deal analyses | Duration of subscription + 90 days, unless deleted earlier by you | Contract / your control |
| Billing records | 7 years from end of relevant financial year | HMRC & Companies Act requirements |
| Support communications | 3 years from last communication | Legitimate interests |
| Security and access logs | 12 months | Security monitoring |
| Marketing consent records | Duration of consent + 3 years | Accountability / legal obligation |
| Cookie consent records | 13 months | PECR compliance |
After the applicable retention period, data is securely deleted or anonymised. Anonymised data is no longer personal data and may be retained for statistical purposes.
Under UK GDPR you have the following rights. To exercise any of them, contact us at team@awaybase.co.uk. We will respond within one calendar month and will verify your identity before processing your request.
You have the right to receive a copy of the personal data we hold about you and information about how it is processed. This is provided free of charge (though we may charge a reasonable fee for manifestly unfounded or excessive requests).
You have the right to require us to correct inaccurate data or complete incomplete data. You can update most account data directly within your account settings.
You have the right to request deletion of your personal data in certain circumstances — for example, where the data is no longer needed, you withdraw consent, or you object to processing. This right is not absolute; we may retain data where required by law (e.g. financial records).
You have the right to request that we limit the processing of your personal data in certain circumstances, such as while we verify disputed data.
Where we process your data on the basis of contract or consent using automated means, you have the right to receive your data in a structured, commonly used, machine-readable format (e.g. CSV or JSON) and to transmit it to another provider.
You have the right to object to processing based on our legitimate interests at any time. You have an absolute right to object to the use of your personal data for direct marketing, which we will always honour immediately.
As described in Section 8, our current AI features are decision-support tools and do not produce legally significant automated decisions. If this changes, we will provide the right to request human review of any such decisions.
Where we rely on consent, you can withdraw it at any time:
We implement appropriate technical and organisational security measures to protect your personal data, including:
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours. If the breach poses a high risk, we will also notify you directly without undue delay.
No security system is completely impenetrable. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.
Our Service is intended for adults (18+) engaged in property investment research. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us at team@awaybase.co.uk and we will delete it promptly.
If you have a concern about how we have handled your personal data, please contact us first and we will do our best to resolve it:
We will acknowledge your complaint within 5 working days and aim to provide a full response within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Phone: 0303 123 1113
Website: ico.org.uk
Online complaint form: ico.org.uk/make-a-complaint
We review this Privacy Policy regularly and update it when our processing activities change. We will notify you of material changes by posting a notice on our website and/or sending you an email to the address on your account. The date of the most recent revision is shown at the top of this page.
For any questions about this Privacy Policy or how we handle your personal data: