Privacy policy

Notable Consulting Ltd (Tepilo) is the data controller for personal data collected through this website and our services, unless we tell you otherwise.

Privacy enquiries: privacy@tepilo.com or our Contact page.

This policy applies to visitors, account holders, valuation users, Sale Ready customers, partner invitees and anyone who contacts us. It does not cover third-party websites linked from Tepilo, estate agents you choose to contact through us, or payment pages operated by Stripe.

Depending on how you use Tepilo, we may collect:

• Identity and contact details — name, email address, phone number.
• Property information — postcode, selected address, property characteristics you provide or we retrieve from third-party sources (for example EPC, council tax band, planning data).
• Account and session data — magic-link sign-in tokens, session identifiers, optional passkey credentials, anonymous session cookie (tepilo_anon) to link activity before sign-in.
• Sale Ready workspace data — questionnaire answers, checklist progress, uploaded documents and metadata, share links and access logs.
• Payment-related data — purchaser name, email and phone supplied at checkout; Stripe processes card details — we do not store full card numbers.
• Agent contact requests — when you explicitly consent, we record your contact details, chosen agents, property context and consent timestamps.
• Communications — messages you send via our contact form or email.
• Technical and usage data — IP address, browser type, device information, pages viewed and server logs; limited product analytics events (for example checkout started, pack viewed) stored in our systems.

You can use many free tools without creating an account. We only ask for personal details when needed for a feature you choose to use.

• Directly from you — forms, checkout, uploads, questionnaire answers and support messages.
• Automatically — cookies, session tokens and server logs when you browse or sign in.
• From third parties — address lookup (Ideal Postcodes), property datasets (Homedata, official EPC registers, planning sources), payment confirmation (Stripe), email/SMS delivery status (Resend, Twilio where used), and infrastructure providers (Google Firebase / Cloud).

We use personal data to:

• Provide valuations, property tools and Sale Ready features you request (contract / steps prior to contract).
• Create and manage your account, magic-link sessions and document vault (contract).
• Process payments and activate paid features (contract).
• Share your details with estate agents you explicitly select and consent to contact (consent).
• Send transactional messages such as sign-in links, pack notifications and service updates (contract / legitimate interests).
• Respond to enquiries and provide support (legitimate interests / contract).
• Improve reliability, security and product performance (legitimate interests).
• Comply with law, respond to regulators and enforce our terms (legal obligation / legitimate interests).

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Withdraw agent-sharing consent by not submitting a lead request; for marketing (if introduced later), use unsubscribe instructions or contact us.

We do not sell your personal data. We share data only as needed with:

• Service providers acting as processors — hosting (Google Firebase / Cloud Functions), email (Resend), SMS (Twilio, where enabled), payments (Stripe), address and property data providers (Ideal Postcodes, Homedata and similar APIs).
• Estate agents you choose — only after you give explicit consent to share your contact details and property context.
• Professional advisers, insurers or authorities — where required by law or to protect rights.
• Successors — if our business is reorganised, merged or sold, subject to equivalent protection.

Processors are bound by contract to use data only on our instructions and to apply appropriate security measures.

Some providers may process data outside the UK (for example in the United States or EU). Where this occurs, we rely on appropriate safeguards such as UK adequacy regulations, UK International Data Transfer Agreements or equivalent contractual clauses, unless a specific exception applies.

We keep personal data only as long as necessary:

• Magic-link tokens and short-lived sessions — until used, expired or deleted (typically up to 24 hours).
• Sale Ready workspaces and vault documents — for the life of your subscription or account, then deleted or anonymised within a reasonable period unless law requires longer retention.
• Payment records — as required for tax, accounting and dispute resolution (typically up to 6 years).
• Agent lead records — long enough to evidence consent and handle queries, then archived or deleted.
• Server logs and analytics — limited periods appropriate for security and debugging.
• Contact form messages — until the enquiry is resolved and for a reasonable follow-up period.

You may request deletion where we have no overriding legal reason to retain data (see your rights below).

Subject to exemptions, you have the right to:

• Access — request a copy of personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete data in certain circumstances.
• Restriction — limit how we use your data in certain cases.
• Portability — receive data you provided in a structured, machine-readable format where processing is automated and based on contract or consent.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is consent-based.

To exercise these rights, email privacy@tepilo.com or use our Contact page. We may need to verify your identity. We respond within one month, extendable where permitted.

You may complain to the Information Commissioner's Office (ICO) at ico.org.uk. We encourage you to contact us first so we can try to resolve your concern.

We use cookies and local storage for essential purposes:

• tepilo_anon — anonymous session identifier to link pre-sign-in activity (SameSite=Lax).
• tepilo_magic_session — keeps you signed in after a magic link (HTTP-only, limited duration).
• Admin and security cookies — where applicable for authorised staff sessions.

We do not use third-party advertising cookies on the core service. You can control cookies through your browser; disabling essential cookies may prevent sign-in or certain features from working.

We apply technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS), access controls, hashed tokens, and segregated storage for uploaded documents. No method of transmission or storage is completely secure; please use strong, unique contact details and report suspected unauthorised access promptly.

Tepilo is intended for adults dealing with property transactions. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided data, contact us and we will delete it.

Tepilo may score or prioritise property checks and planning results to highlight items worth review. These outputs are guidance only — not legal, surveying or valuation decisions about you. You are not subject to decisions with legal or similarly significant effects based solely on automated processing.

We may update this policy from time to time. The “Last updated” date at the top will change and, where changes are material, we will take reasonable steps to inform you (for example a notice on the website).

See also our Terms of use.