Subscriber Data Policy

1. Introduction

This Subscriber Data Policy (“Data Policy”) describes how USELATCH LTD (trading as “Latch”, company number SC879051, registered in Scotland) processes personal data on behalf of subscribers to our paid plans (Pro and Enterprise). This policy supplements our Privacy Policy and should be read in conjunction with our Terms of Use and Subscriber Terms.

• Where a subscriber (landlord or property manager) inputs personal data relating to their tenants, contractors, or other third parties into the Latch platform, the subscriber acts as the data controller for that data.
• Latch acts as the data processor, processing such data on behalf of and under the instructions of the subscriber.
• This policy sets out the terms upon which Latch processes subscriber data, in compliance with Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Definitions

• “Subscriber Data” means any personal data that a subscriber inputs, uploads, or transmits to the Latch platform relating to their tenants, contractors, suppliers, or other third parties.
• “Data Controller” means the subscriber who determines the purposes and means of processing Subscriber Data.
• “Data Processor” means USELATCH LTD, which processes Subscriber Data on behalf of the Data Controller.
• “Sub-processor” means any third-party service provider engaged by Latch to assist in the processing of Subscriber Data, as listed on our List of Subprocessors page.
• “UK GDPR” means the UK General Data Protection Regulation, as retained and adapted by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.

3. Types of Data Processed

Latch processes the following categories of Subscriber Data on behalf of data controllers:

4. Tenant and Property Data Handling

• All Subscriber Data is stored securely on Supabase infrastructure hosted on AWS in the EU region.
• Row-level security (RLS) policies enforce strict multi-tenant isolation, ensuring that each subscriber can only access data belonging to their own account.
• Account members can only access data within their assigned roles (Owner, Admin, PM, or Member).
• PM (Property Manager) users manage properties on behalf of landlord clients, with access to client data, financial records, and owner statement generation.
• Tenant portal users can only view data specifically assigned to them by their landlord.
• Subscriber Data is logically separated from other subscribers' data at the database level through account-scoped queries.
• HMRC-related sensitive data (NINOs, UTRs, and OAuth tokens) is encrypted at the application level using AES-256-GCM, providing an additional layer of protection beyond the database-level encryption at rest.

5. Data Processor Obligations

In accordance with Article 28 of the UK GDPR, Latch undertakes the following obligations as a data processor:

• Process Subscriber Data only on documented instructions from the data controller, unless required to do so by applicable law.
• Where a subscriber instructs Latch to submit data to HMRC via the MTD integration, Latch acts as the subscriber's processor in aggregating and transmitting the data. HMRC receives this data as an independent statutory authority and data controller. The subscriber's instruction to submit data to HMRC constitutes a documented processing instruction under Article 28(3)(a) of the UK GDPR.
• Use of AI sub-processors on Subscriber Data: Where the subscriber invokes an AI-powered feature, the subscriber hereby instructs Latch to (a) transmit the relevant Subscriber Data (prompts, attached file content, contextual account data) to the AI sub-processors listed on our List of Subprocessors; (b) log the call in the ai_feature_usagetable for cost monitoring and abuse detection; and (c) refuse the call where a global or per-account cost or abuse threshold has been exceeded. The subscriber acknowledges that some AI sub-processors are located outside the United Kingdom (the United States, and — for Zhipu AI — the People's Republic of China). Latch relies on the UK International Data Transfer Agreement and EU Standard Contractual Clauses + UK Addendum, supported by a documented Transfer Risk Assessment for any non-adequate jurisdiction.
• Agent actions:Where the subscriber enables AI agent actions, Latch will execute such actions strictly on the subscriber's account and will log every action (actor, timestamp, tool used, result) in an audit trail accessible to the subscriber.
• Ensure that all persons authorised to process Subscriber Data are bound by appropriate confidentiality obligations.
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as detailed in Section 6 below.
• Not engage another processor (sub-processor) without prior general written authorisation of the data controller. The subscriber is deemed to have given general written authorisation for the sub-processors listed on our List of Subprocessors page.
• Assist the data controller in responding to requests from data subjects exercising their rights under the UK GDPR.
• Assist the data controller in ensuring compliance with Articles 32–36 of the UK GDPR (security, breach notification, impact assessments, and prior consultation).
• At the choice of the data controller, delete or return all Subscriber Data upon termination of the service, and delete existing copies unless applicable law requires storage.
• Make available to the data controller all information necessary to demonstrate compliance with Article 28 obligations, and allow for and contribute to audits and inspections.

6. Data Security Measures

Latch implements the following technical and organisational measures to protect Subscriber Data:

7. Data Breach Notification

• In the event of a personal data breach affecting Subscriber Data, Latch will notify the affected subscriber (data controller) without undue delay and in any event within 72 hours of becoming aware of the breach.
• The notification will include: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences of the breach, and the measures taken or proposed to address the breach and mitigate its effects.
• Latch will cooperate with the subscriber in fulfilling the subscriber's own breach notification obligations to the Information Commissioner's Office (ICO) under Article 33 of the UK GDPR.
• Where a breach is likely to result in a high risk to the rights and freedoms of data subjects, Latch will assist the subscriber in notifying affected individuals under Article 34 of the UK GDPR.
• Breach notification covers both incidents in Latch's own systems and incidents reported to us by our sub-processors (Supabase, Stripe, SendGrid, Twilio, Plaid, Cloudflare R2, Google, Zhipu, Vercel, Inngest, Langfuse, Microsoft, Canopy). Where a sub-processor reports a breach affecting Subscriber Data, we will pass that information to affected subscribers within the same 72-hour window, to the extent we have it.

8. Data Portability and Export

• Subscribers may request a full export of their Subscriber Data at any time.
• Data exports are provided in structured, commonly used, and machine-readable formats (JSON and/or CSV), in accordance with the right to data portability under Article 20 of the UK GDPR.
• Export requests can be made by contacting [email protected].
• We will fulfil export requests within one calendar month of receipt. A self-serve export endpoint is in development; until launch, exports are produced manually by our team in JSON and/or CSV.

9. Sub-Processing

• Latch engages third-party sub-processors to assist in providing the Services. A complete and up-to-date list is maintained on our List of Subprocessors page.
• The subscriber is deemed to have given general written authorisation for the engagement of sub-processors listed on that page at the time of entering into the subscription.
• Latch will inform subscribers of any intended changes to sub-processors by updating the List of Subprocessors page and notifying affected subscribers via email.
• Subscribers may object to a new sub-processor by contacting us within 30 days of notification. If the objection cannot be reasonably accommodated, the subscriber may terminate their subscription.
• All sub-processors are bound by data processing agreements imposing equivalent data protection obligations.
• Note regarding HMRC:HMRC is not a sub-processor of Latch. HMRC is a UK government statutory authority that acts as an independent data controller for all data submitted to it. When subscribers use the MTD integration, data is transmitted to HMRC at the subscriber's instruction. HMRC's processing of that data is governed by HMRC's own privacy notice and applicable tax legislation.
• Note regarding Canopy (tenant referencing): Where a subscriber initiates tenant referencing through the platform, tenant personal data is shared with Canopy (RentalStep Ltd) for the purpose of conducting background screening. The subscriber (as data controller) is responsible for obtaining the tenant's explicit consent before initiating the referencing request. Canopy processes tenant data as an independent data controller for the purpose of conducting the checks. Refer to the List of Subprocessors page for full details.
• Note regarding Twilio (WhatsApp messaging):Where subscribers enable WhatsApp messaging for rent reminders and tenant communications, tenant phone numbers and message content are processed by Twilio Inc. under Twilio’s data processing agreement. Twilio acts as a sub-processor for WhatsApp message delivery, delivery status tracking, and inbound message handling. Message content additionally traverses Meta's WhatsApp infrastructure as part of the WhatsApp Business API. Subscribers are responsible for ensuring that tenants have provided valid opt-in consent to receive WhatsApp communications in accordance with applicable data protection and electronic communications regulations.
• Note regarding Plaid (Open Banking):Where subscribers link a bank account via Plaid for automatic transaction reconciliation, bank credentials are entered into Plaid Link directly on Plaid's domain and are never received by Latch. Plaid acts as a sub-processor for the resulting account identifiers, balances, and transaction history under its UK PSD2 licence and DPA. Bank-feed data is deleted within 90 days of the bank connection becoming inactive (or immediately on disconnect).
• Note regarding Zhipu AI: Zhipu AI operates from the People's Republic of China. Where the subscriber invokes an AI feature routed to Zhipu, prompts and contextual account data are transferred under the UK International Data Transfer Agreement (IDTA), supported by a documented Transfer Risk Assessment that considers the PRC Cybersecurity Law 2017, Data Security Law 2021, and Personal Information Protection Law 2021. Categories of data sent are constrained per the AI section of our Privacy Policy.

10. Data Deletion Upon Termination

• Upon termination or expiry of a subscription, the subscriber may request deletion of all Subscriber Data.
• A 30-day soft-delete grace period applies, during which the subscriber may request account restoration.
• After the grace period, all Subscriber Data will be permanently and irreversibly deleted from our systems and those of our sub-processors, except where retention is required by applicable law.
• Audit logs may be retained for a minimum of 6 years in accordance with UK financial record-keeping requirements.
• Stripe billing records are retained in accordance with applicable tax and accounting legislation (minimum 6 years).
• Upon account deletion or HMRC disconnection, encrypted HMRC tokens, NINOs, and UTRs will be permanently deleted. However, MTD submission history records may be retained for the minimum 6-year period required by UK financial record-keeping regulations. Data previously submitted to HMRC cannot be deleted or modified by Latch, as it is held by HMRC as an independent data controller.
• E-Signature audit trails: Retained for 6 years after the last signature event on a document, in line with the Limitation Act 1980, to provide evidence of signing events in the event of a legal dispute.
• Property management client financial data: Retained for 6 years after the end of the management relationship, in line with HMRC record-keeping requirements, including owner statements, fee ledgers, and payment records.

11. Subscriber Audit Rights

• Subscribers may request, no more than once per twelve (12) months, a written summary of Latch's technical and organisational security measures and the DPA / transfer-mechanism status of our sub-processors. Requests should be sent to [email protected] and we will respond within one calendar month.
• In the case of a documented regulatory investigation or material security incident, we will cooperate with reasonable additional audit requests beyond the annual cadence above, subject to a confidentiality undertaking and reasonable scoping.

12. Governing Law

• This Subscriber Data Policy shall be governed by and construed in accordance with the laws of Scotland.
• This policy is intended to satisfy the requirements of Article 28 of the UK GDPR and the Data Protection Act 2018.
• The courts of Scotland shall have exclusive jurisdiction over any dispute arising under this policy.

13. Contact

If you have any questions about this Subscriber Data Policy or wish to exercise your rights as a data controller, please contact us:

14. Material Change History

• 5 May 2026 (v2.0)— Added Plaid bank-feed, Tenant Portal, AI processing, Listings/prospects, and Bug Reports/Support sub-sections to §3; added Article-28 AI sub-processor instruction and agent-actions clause to §5; added AI-specific and document-storage security measures to §6; expanded §7 to cover sub-processor breach notification; added transitional “in-development” language to §8 portability; added Plaid and Zhipu AI clauses to §9; added new §11 Subscriber Audit Rights; renumbered subsequent sections.
• 23 March 2026 (v1.0)— Initial publication.