Privacy notice

Who we are

Proper-ly is a compliance and document management platform for UK residential blocks.

The company operating it is Lapis Research Ltd., registered in England and Wales under company number 12568336, with its registered office at 88 St. Cross Road, Winchester, England, SO23 9PX.

We are the data controller for the personal data described below. The Information Commissioner's Office is the supervisory authority for data protection in the UK, and you can complain to them about how we handle your data — see “Your rights” below.

You can reach us about anything in this notice at contactus@proper-ly.co.uk.

Our role, and your block's role

Two different sets of people appear in Proper-ly, and our responsibility for them differs.

• Your account. When you sign up we decide how your account data is handled, so we are the controller for it.
• Your block's records. The leaseholders, owners, occupants and documents you enter belong to your block. The management company or managing agent decides what goes in and who may see it, and we process it on their instructions.

Where we act as processor we act only on the documented instructions of the block's management company or managing agent, who remains the controller for those records. The terms recording that — our obligations on security, sub-processing, assisting with your data protection duties, and deletion when the relationship ends — form part of the agreement we enter into with each block.

This split matters because most people whose data is held here — leaseholders and occupants — never create an account and never see this page. Where we are the processor, it is the management company rather than us that owes them a privacy notice.

What data we hold

• Account information — your name and email address, handled through Clerk.
• Block information — addresses, unit details, service charge shares and lease terms.
• People records — names, email addresses and phone numbers of leaseholders, owners and occupants that you enter.
• Company officers — when you add a block by company number, we retrieve the registered company details and the names of its directors from Companies House.
• Documents — the files you upload, such as leases, certificates, inspection reports and correspondence.
• Text extracted from those documents — we do not only store the file. Each document is converted to text, split into passages, and each passage is stored in our database along with a numerical representation of its meaning (an “embedding”) that makes search possible. A lease held here is therefore stored twice: as the original file, and as its text.
• Compliance records — obligation dates, completion notes and the assessments described below.
• Calendar events — dates you enter, and dates extracted from documents.
• Questions you ask the assistant — the question, the answer given, and which documents the answer drew on. See below.
• Enquiries — if you contact us through the form on our home page, we store the name, email address and any other details you type into it. You do not need an account to send one, and we use it only to reply.

Why we process it, and on what basis

Our lawful bases under Article 6 of the UK GDPR are:

• Contract — creating and operating your account, and providing the service you signed up for.
• Legitimate interests — holding your block's records so that the building can be managed and its compliance obligations met, and replying to enquiries you send us. Most of the people in those records are not our customers, so we have weighed the block's need to manage the building against their interests and rights. You can ask us for that assessment.
• Legal obligation — where the law requires us to keep something, such as records kept for tax.

Where we act as processor for a block's records, the lawful basis for that processing is the management company's to determine rather than ours.

We use the data to:

• show and manage your block's records;
• extract dates and compliance information from documents you upload;
• answer questions you ask about your block;
• keep a record of the advice the software has given, so it can be checked later;
• diagnose faults and keep the service running.

We do not sell or rent your personal data, and we do not share it with third parties for marketing. We do share it with the service providers listed below, who process it only to run the service.

How the AI works, and what it sees

Two things in Proper-ly use AI models, and both send your content to a model to do their work.

• Document extraction. When you upload a document, its contents are sent to a model to pull out dates, certificate results and other structured information.
• The assistant. When you ask a question, passages from your block's documents are retrieved and sent to a model along with your question so it can answer from them.

Both run on Amazon Bedrock using Anthropic's Claude models. Your content is not used to train any AI model, and it is not shared with the model provider.

Extracted dates and compliance suggestions are always shown to you for review before they change anything in your records. Assistant answers are information rather than advice: they can be wrong, they list the documents they relied on so you can check them, and they say so when they are answering from general knowledge rather than from your documents. Proper-ly is not a substitute for professional advice.

Every question and answer is recorded, along with which documents the answer cited. That record is readable by the person who asked and by nobody else — not by other members of your block, and not by its directors or managing agent.

Where your data is processed

Documents and database records are stored in the United Kingdom, in Amazon Web Services' London region.

AI processing is different. To provide capacity and resilience, model inference may run in any Amazon Bedrock region within the European Union — currently Ireland, London, Paris, Frankfurt, Stockholm, Milan and Spain. This means the content of your documents and questions may be processed outside the UK, within the EU. Transfers of this kind are covered by the UK's adequacy regulations for the EEA.

Authentication is different again. Clerk hosts account data in the United States and does not offer a choice of region. Clerk is self-certified under the UK Extension to the EU–US Data Privacy Framework, and that is the safeguard relied on for these transfers; where it cannot be relied on, Clerk's terms fall back to the Standard Contractual Clauses together with the UK Addendum. What reaches Clerk is your name, your email address and your sign-in activity — not your documents, and not your block's records.

How we store and protect it

Data is stored on Amazon Web Services. Files are held in Amazon S3 and records in a managed PostgreSQL database, both encrypted at rest. Communication between your browser and our servers is encrypted in transit using TLS.

Authentication is handled by Clerk, a specialist identity provider. We never store your password.

Within a block, access to a document is decided by a single rule applied everywhere it could be reached — the document list, search, and the assistant — so a document you cannot open is also one the assistant will not read to you. Documents marked private are visible only to the person who uploaded them.

How long we keep it

We keep your block's records for as long as the block relationship continues. When it ends, records of compliance assessments and of the advice the software gave are kept for a further six years, matching the limitation period for claims in England and Wales — these are the records someone would need if a decision taken here were later questioned. Everything else, including uploaded documents and the text and embeddings derived from them, is deleted within 90 days of the relationship ending.

Deleting a document removes the stored file and everything derived from it — the extracted text, the embeddings and the extracted facts — not merely the entry in the list.

There is no self-service account deletion yet. To close an account and have its data removed, email us and we will do it by hand — within one month of your asking, as Article 12(3) requires, and in practice sooner.

Enquiries sent through the form on our home page are kept while we are still in contact with you about it, and for twelve months afterwards if it goes no further, after which they are deleted. Because you do not need an account to send one, you cannot delete it yourself — so email us and we will, and you do not have to wait for the twelve months.

Your rights

Under UK GDPR and the Data Protection Act 2018 you have the right to ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• delete data, where there is no overriding reason for us to keep it;
• restrict or object to how we use it;
• provide it in a portable form.

Email contactus@proper-ly.co.uk and we will respond within one month.

If you are not satisfied with how we have handled your data, you have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. We would prefer you raised it with us first, but you do not have to.

Cookies and analytics

We use only the cookies needed to run the platform — the authentication session cookies managed by Clerk. We do not use advertising cookies, and nothing here follows you to other websites.

We do measure how our public pages are used, through Vercel Web Analytics. It records the page visited, the referring site, and approximate country and device type. It is deliberately a cookieless service: it stores nothing on your device and keeps no identifier that links your visits together over time, which is why you are not asked to accept anything on arrival. It derives a short-lived, non-reversible hash from your IP address to count a visit once, and that hash is discarded daily. We cannot use it to identify you, and it does not run on your block's pages — only on the public site.

Our basis for this is legitimate interests: we cannot tell whether the site explains the product properly without knowing which pages people read. You can object to it, and most browsers' “do not track” and content-blocking settings will already prevent it.

Who else processes your data

• Amazon Web Services — hosting, file storage, the database, job queuing, and AI processing through Amazon Bedrock.
• Clerk — authentication and user accounts.
• Companies House — a UK public authority. We send a company number and receive registered company details and director names in return.

AWS and Clerk each process data under a data processing agreement that forms part of their standard terms — the AWS GDPR Data Processing Addendum and Clerk's Data Processing Addendum — so both apply automatically rather than needing to be negotiated, and both incorporate the Standard Contractual Clauses where data leaves the UK. Companies House is not our processor: it is a public authority and a controller in its own right for the register it publishes.

Changes to this notice

We will update this notice when what we do with data changes, and update the date at the top when we do. Material changes will be brought to your attention rather than left to be discovered.

Contact

Email contactus@proper-ly.co.uk with any question about this notice or about the data we hold.