Privacy notice
This tells you what Wholesale Velocity UK holds about you, why, who else can see it, how long it is kept and what you can make us do about it. Last updated 8 September 2026.
1. Who is responsible
Incomplete. The operator has not yet published a postal address for service, an ICO registration number. That is a real gap and it is stated here rather than filled with something plausible. Data-subject requests are still answered — write to privacy@wholesalevelocity.co.uk.
Not yet registered with the ICO. Most UK controllers who process personal data for business purposes must pay the data protection fee and appear on the public register. That registration is in progress and this line will carry the number when it is issued. It is stated rather than omitted, because a privacy notice that quietly skips the question is answering it.
Privacy questions and data-subject requests: privacy@wholesalevelocity.co.uk.
2. What is held, and why
Every category the application stores is listed. If something is not here, the application does not collect it — there is no analytics package, no advertising pixel, no session recorder and no third-party tracker anywhere in this software.
| Category | What that means | Why | Lawful basis | Where it sits |
|---|---|---|---|---|
| Your account | Email address and a hashed password. Nothing else is required to sign up. | To let you sign in and to keep your records separate from everybody else's. | Performance of a contract | Supabase |
| Properties and deals you record | Addresses, postcodes, tenure, condition, asking and offer prices, your own notes, photographs you upload, and documents you attach. | To provide the service — this is the work product you came here to keep. | Performance of a contract | Supabase |
| Third-party contact details you enter | The name, telephone number and email address of a seller, a buyer or an agent, and the record of your contact with them. | To let you run your own pipeline. For this category you are the controller and we are your processor — see 'When you are the controller' below. | Performance of a contract | Supabase |
| Assistant questions and answers | The question you asked, the answer given, which model answered, and what it cost. A seller's name, telephone number and email address are removed before anything leaves this application. | To answer you, to bill nothing to the wrong account, and to cap spend. | Performance of a contract | Supabase, Anthropic |
| Error reports | The message, the page it happened on, and the browser. Personal data is scrubbed before the report is stored. | To find and fix faults. | Legitimate interests | Supabase |
| Email we send you | The address we sent to, and whether it was accepted for delivery. | To send the things you asked for — a password reset, a digest you enabled. | Performance of a contract | Resend |
3. When you are the controller, not us
Most of what this application holds is not about you. It is about other people — sellers, buyers, agents — whose details you entered. For that data you are the controller and we are your processor. We hold it, keep it isolated from every other account and act on your instructions; we do not use it for our own purposes, we do not sell it, and we do not use it to train any model.
That division has a consequence worth stating plainly, because it is the one people get wrong: your obligations to those people are yours. If you record a seller's telephone number, you are the one who owes them a privacy notice, a lawful basis and a response if they ask what you hold. This software helps — it records consent per buyer, keeps a suppression list, timestamps every contact and refuses to send anything on its own — but it cannot discharge a duty that is yours.
The application deliberately has no bulk outreach feature. Under PECR, unsolicited marketing by electronic mail to an individual subscriber needs consent or a narrow soft opt-in, and there is no lawful bulk source of UK homeowner contact details. Software that made mass contact easy would mostly be helping people break the law quickly. See Acceptable use.
4. Who else touches it
Four services. This list is generated from the application's own configuration.
| Service | What it does | Where the data sits |
|---|---|---|
| Supabase | Database, authentication and file storage. Everything you record lives here. | London, United Kingdom (eu-west-2) |
| Vercel | Hosting and content delivery. Serves the application and its API routes. | London (lhr1) for compute; a global edge network for static assets |
| Anthropic | The assistant. Receives the question and a brief about the deal, with seller contact details removed. Receives nothing when the assistant is not used. | United States |
| Resend | Sends transactional email — password resets, and a digest if you turn one on. | United States |
Transfers outside the UK. Your records sit in London. Two services — Anthropic and Resend — are United States companies, and data reaching them leaves the UK. Those transfers rely on the standard contractual clauses with the UK Addendum, under each provider's data processing agreement. The assistant is the only route by which deal content reaches Anthropic, it is used only when you ask it something, and a seller's name, telephone number and email address are stripped before the request is made.
5. What is not sent anywhere
- Your password. It is hashed by Supabase; nobody here can read it.
- Seller and buyer contact details, to the assistant. They are removed first.
- Anything, to an advertiser or a data broker. There are none.
- Anything, to train a model. No provider here is permitted to train on this data.
6. Where the numbers come from
The valuations, comparables and area figures in this application are built from published open data. Nothing about you is sent to these sources — a postcode is looked up, and that is the whole of the exchange.
| Source | Used for | Licence |
|---|---|---|
| HM Land Registry Price Paid Data | Sold comparable prices for England and Wales. | Open Government Licence v3.0. Contains HM Land Registry data © Crown copyright and database right. |
| postcodes.io / Office for National Statistics | Postcode coordinates, administrative geography and deprivation rank. | Open Government Licence v3.0. Contains OS data © Crown copyright and database right. |
| Energy Performance of Buildings Register | EPC rating, floor area and recorded measures. | Open Government Licence v3.0, via the Department for Levelling Up, Housing and Communities. |
| Environment Agency | Flood risk for a location. | Open Government Licence v3.0. |
| The Gazette | Published probate and insolvency notices. | Open Government Licence v3.0, via The Gazette's public API. |
7. How long it is kept
- Your records — for as long as your account exists. They are your working files; deleting them on a schedule would lose you deals.
- After you close your account — deleted within 30 days. The delay exists so an accidental deletion can be reversed, not so we can keep it.
- Assistant history — 12 months, then deleted. It exists to show you what you asked and what it cost.
- Error reports — 90 days.
- Audit trails (activity, agent steps, learning evidence) — these are insert-only by design and are kept for the life of the account, because a record that can be edited afterwards is not a record.
8. Your rights
Under UK GDPR you can require us to:
- Show you what we hold. The application already does this — Settings exports every record we have about you as JSON, immediately, without asking anyone.
- Correct anything wrong. Every field is editable.
- Delete your account and its contents.
- Give you a portable copy — the same JSON export.
- Restrict or object to processing based on legitimate interests.
Write to privacy@wholesalevelocity.co.uk. We answer within one month. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk, and you do not have to ask us first.
9. Security
- Every table enforces row-level security keyed on your user id, in the database itself rather than in the application. Another signed-in user querying your rows gets an empty result, not an error — and an anonymous caller gets nothing at all. This is checked by an automated test on every build and by a live health check.
- The application never uses a privileged database key that could bypass those rules. The build fails if such a key appears anywhere in the source.
- Links you share — a deal pack for a buyer, a status page for a seller — are unguessable tokens that expose a hand-picked list of columns and can be revoked. A token grants a view; it never grants the record.
- All traffic is over HTTPS.
If you believe you have found a security problem, write to privacy@wholesalevelocity.co.uk with enough detail to reproduce it. You will get a reply.
10. Automated decisions
The scores in this application — motivation, deal score, buyer match, risk — are arithmetic, not a model, and each one shows its own workings on screen. None of them produces a legal or similarly significant effect on any individual within the meaning of Article 22: they rank your own opportunities for you to act on. No decision about a person is taken by this software.
11. Changes
If this notice changes materially you will be told inside the application before the change takes effect, not by a silent edit to this page.
12. Law
This notice is governed by the law of England and Wales.