Privacy policy

Depending on your role on the platform, we hold:

• Agencies and branches: the agency's trading name, address, phone number, email and website, and the name of the person who registers it. If a Companies House number is given, it is checked against the Companies House public register and we keep the company's registered name from that check. An agency may also give its consumer redress scheme and membership number, which we check by hand. The email address is confirmed before registration can go ahead: we send it a link, and the form opens only from that link. Each branch also has its own name, address and phone number.
• Agents and platform admins: name, work email, agency and branch, and role. An agent may also add a phone number, which is optional: you choose whether to give one, and you can remove it at any time from your account settings. There are no passwords: you sign in with a one-time code we email to you, and sessions are managed by our authentication provider (Supabase Auth). Agents and admins are also required to set up two-factor authentication (TOTP).
• Buyers and sellers: name and email, provided by the agent who invites you, and whether you have signed in yet. You cannot currently create an account yourself.
• Transaction and milestone data: the address of a claimed property, its status in the sale lifecycle, which milestones are complete, and a timestamped record of who toggled each one.
• Audit history: a permanent, append-only log of meaningful actions (claims, milestone changes, chain links, invitations) for accountability across the platform. It includes the postcodes an agent searches when looking for a property to link to, which is what lets us limit and detect searches sweeping across many postcodes. When an account is deleted, its email address, name and phone number are removed from this history, and its name from notifications other people received about it; the records themselves stay.
• Sign-in and abuse records: when a sign-in code is requested or entered, and when someone attempts an agency registration or a Companies House lookup on the registration form, we record the time and a one-way keyed fingerprint of the email address or IP address involved, never the address itself. These records exist only to limit repeated attempts, and a weekly job deletes them once they are 30 days old, so each is kept for between 30 and 37 days. Sign-in codes themselves are stored only as a similar fingerprint and are deleted once they are a day past expiry, at the latest by that same weekly job.
• IP address: we do not store it. As is inherent to running a website, it is processed in transit by our hosting provider (Vercel) on every request, and by Cloudflare as part of the bot check described below.
• Visits to chainsight.co.uk: we count visits to our website with Vercel Web Analytics, to see which pages are read and where visitors come from, so that we can improve it. It sets no cookies and stores nothing on your device, except a note of your choice if you ask not to be counted. Each visit records the page, the time, the site you came from, your country and region, and your browser, operating system and type of device. Vercel recognises repeat visits on the same day using a value it discards after 24 hours, and neither we nor Vercel can tell who you are from the counts. To stop being counted, use “Don't count my visits” at the foot of any page on chainsight.co.uk; browsers that send a Global Privacy Control signal are never counted. We can view the counts for 12 months.
• Device push token: if you use the ChainSight mobile app and allow notifications, we store the push token Google's Firebase Cloud Messaging issues for your device, linked to your account so your milestone and status updates reach you, together with the version of the app it came from, so we can tell which versions are in use. It is removed when you sign out. The Firebase software in the app also sends Google a random identifier for each installation of the app, which Firebase uses to deliver notifications to it; we never receive or store that identifier.

ChainSight is a toggle-based milestone tracker, not a document store, identity verification tool, or solicitor case management system. We do not store legal documents, identity verification documents, or financial account or payment details, and ChainSight does not interface with any legal or financial systems on your behalf.

Every data point above exists to run the actual service: verifying an agency at registration, showing each party in a chain the progress appropriate to their position, and keeping an accountable record of who changed what. The one exception is the count of visits to our website, which exists to improve the website. We don't run advertising on the platform and don't sell or share your data for marketing purposes.

UK data protection law requires a legal basis for each use of personal data. Ours are:

• Agencies, agents and admins: the contract with your agency to provide ChainSight, and the steps before it when an agency registers.
• Buyers and sellers: our legitimate interest, and the inviting agency's, in keeping the people in a sale informed of its progress, which is what an agent invites you to ChainSight for.
• Sign-in, abuse and audit records: our legitimate interest in keeping the service secure and in having an accountable record of who changed what.
• Visits to chainsight.co.uk: our legitimate interest in understanding which parts of our website are useful, so that we can improve it.
• Payments: the contract for the credits bought, and our legal obligation to keep financial records.

Contact details are shared with the agent directly next to you in a chain. Once a chain link between two properties has been accepted by both sides, the agents on each side can see the other's agency name and phone number, branch name and phone number, and the individual agent's name and email. This is so the two people handling adjoining properties can reach each other without going through anyone else. An agent's own phone number is not shared with other agents this way.

It goes no further than that. Properties beyond the one directly linked to yours show no contact details at all. Before a link is accepted, each side sees only what it needs to decide whether to accept: the other property's address, its agency's name, and the name and email address of the agent handling it. An agent who searches for a property by its full postcode, to ask for a link, sees the same. No phone number is shared until a link has been accepted.

Buyers and sellers see who is handling their own property. That is the agency, the branch and the agent, with the phone number the agent has chosen to publish, or the agency's if they have not. They never see contact details for anyone else's property. If you are an admin at an agency, your colleagues can also see your published phone number, so they know who to ask. The agent who invites a buyer or seller can see whether that person has signed in yet.

When people or properties move to another agency. If two agencies agree in writing that agents or properties should move from one to the other, for example when an office joins its company's agency or two agencies merge, ChainSight makes the move. The records of what happened before stay with the agency they happened in. The agency taking them on can also see the history of the properties it took on, and what the agents it took on did on properties, up to the moment of the move; not their other records, such as changes to colleagues' details. If you are a buyer or seller of a property that moves, we tell you which agency now handles it.

We use a small number of specialist providers to run the service, each only for what they're named for:

• Supabase: hosts our database and handles authentication, in the London (eu-west-2) region.
• Ideal Postcodes: resolves property addresses when a transaction is claimed, and a branch's office address when an agency adds or changes a branch.
• Companies House: verifies an agency's registration number at sign-up, via their public API.
• Postmark: sends the emails the service depends on, namely the link that starts an agency registration, then the emails confirming the registration arrived, that the agency is approved, or that it could not be approved; account invitations, and a notice when you are given access to a further property; the sign-in code you request each time you log in; the confirmation when you change your own email address; security notices telling you if an administrator changed your email address or reset your two-factor authentication; if you administer an estate agency, a notice when that agency’s access is suspended or restored; and, if you ask for your account to be deleted, an acknowledgement (a reply from us, if you asked by email) and then a confirmation once it is done. When an agency registers, or someone asks for their account to be deleted, ChainSight's own staff are also emailed the details, so the request can be checked. If you use the contact form on chainsight.co.uk, your name, agency, email address and message are emailed to us the same way. Replies to any of these reach our support team. Agents also receive a weekly summary email on Monday mornings, which you can turn off in your settings; it contains counts only, such as how many properties moved forward a stage, and never names a property or an address. Ordinary in-app notifications (milestone changes, chain link activity, and similar) are shown only within ChainSight itself and are not emailed to you.
• Resend: a standby email provider. It sends the same emails as Postmark, only while Postmark is unavailable and we have switched to it, so that you can still sign in.
• Vercel: hosts the application itself, in the London (lhr1) region. It also hosts our website at chainsight.co.uk, and counts visits to it as described above.
• Cloudflare: two separate things. It runs the bot check on our sign-in and registration pages and on the contact form at chainsight.co.uk, which receives your IP address and basic browser information in order to tell a person from an automated script, and it runs on those pages only. It also stores our nightly database backups, held in the European Union. Those backups are encrypted before they leave our systems, using a key Cloudflare does not have, so they are unreadable to them.
• Google (Firebase Cloud Messaging) and, on iPhones and iPads, Apple (Push Notification service): deliver mobile push notifications for milestone and status changes, if you use the app and allow them. Delivering a notification means passing its text through their infrastructure, and that text includes the property address, so it also appears on your device's lock screen. If you would rather it didn't, you can turn notifications off for ChainSight in your phone's own settings, which stops the push without affecting what you see inside ChainSight. Agents can also turn off the matching category in their notification preferences, which stops both; buyers and sellers have no such preferences, so the device setting is the route for them.
• Stripe: processes payment when an agency buys claim credits, and receives the purchaser's details and payment information directly. We never see or store card details ourselves.

Within the platform itself, chain visibility is deliberately tiered. Your own property is shown in full to you. An agent on a directly linked property sees its postcode, the agency and agent handling it, and overall progress; they see the individual milestones only if that property's own agent has chosen to share them, which is off unless it is turned on and can be turned off again. The full street address stops being shown to them once a link is accepted. Anyone further along the chain sees the position, the agency and a progress indicator, with no address and no postcode. Agency names are visible across the whole chain, so agents can identify and contact one another.

Our database, our application hosting and our backups are in the UK or the European Union. Some of the providers named above are based in the United States or process data there, each under a recognised safeguard:

• Postmark stores email data in the United States, under the Standard Contractual Clauses in its terms.
• Resend, when it is in use, processes email data in the United States, under the EU-U.S. Data Privacy Framework and its UK Extension, and the UK Standard Contractual Clauses in its data processing agreement.
• Stripe is certified under the EU-U.S. Data Privacy Framework and also offers the Standard Contractual Clauses with the UK Addendum.
• Google (push notifications) may process data anywhere on its global infrastructure, and complies with the EU-U.S. Data Privacy Framework and its UK Extension.
• Apple (push notifications on iPhones and iPads) generally stores data in the United States, under Standard Contractual Clauses.
• Vercel and Cloudflare are certified under the UK Extension to the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as well.

A claimed address and its milestones are kept for the life of the transaction. Once a sale completes, the transaction is archived automatically 28 days later and the address is released for a new claim. A withdrawn property is archived immediately instead; a sale that falls through relists the same property rather than closing it. Archived records and the audit log are retained after that point as the agency's own historical record and for platform accountability, not indefinitely promised for deletion. Contact us if you'd like a specific record reviewed or removed.

Sign-in and abuse records are the exception: they are deleted automatically once they are 30 days old, within a further week at most, because they exist only to limit repeated attempts.

We also take an encrypted backup of the database every night, so the service can be restored if something goes badly wrong. Each backup is kept for 30 days and then deleted automatically within a further five days. This matters for deletion requests: when we remove something at your request it goes from the live service straight away, but a copy can persist in those backups until they age out, which takes at most 35 days. We do not restore a backup in order to bring deleted information back.

Under UK GDPR, you can ask us to access, correct, delete, or export the personal data we hold about you, or object to how it's used. If you're a buyer or seller who was invited to a property, the agent who invited you is usually the quickest route to a correction, but you're welcome to contact us directly for any of the above.

You can ask for your account to be deleted from the ChainSight app, with “Delete my account” under your name on the list of properties, or by email without the app, as our account deletion page explains. We complete it within 30 days and email you when it is done, and your email address is removed from our audit history. If you are an agent, the properties you handle are passed to a colleague at your agency first (or, if you are your agency's only person, released, with the agency closed), and changes you made to other people's sales stay on their record, shown as made by a former agent rather than by you by name.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk. We would appreciate the chance to put it right first, so please contact us too.

For any question about this policy or a request relating to your data, email privacy@chainsight.co.uk.

If this policy changes materially, we'll update the date at the top of this page. Continued use of ChainSight after a change means you accept the updated policy.