Privacy notice

Overview

Clarity (Clarity Homes) provides an operational housing platform. This notice covers information collected through public Marketplace pages, account registration, paid Rent-to-Rent (R2R) workspaces, optional Google Account connections, and optional Connect AI connections.

Last updated 2026-10-28.

Who we are

Ali Koz trading as Clarity Homes operates Clarity. Organisation form: Individual / sole trader. Nature of work: Software Development / SaaS.

Privacy contact: privacy@clarityhomes.co.uk

Correspondence address: 36 Queensway, Enfield, London, EN3 4SA, United Kingdom.

Privacy matters are handled by the Founder. A formal data protection officer is not appointed.

When Clarity is controller and when it is processor

Clarity decides the purposes of its own service administration. That includes accounts and sign-in, security and abuse prevention, subscription and billing records, Founder governance and support administration, platform monitoring, error telemetry, service reliability and provider observability, support requests, rehearsal and sales enquiries, partner and referral administration, website and privacy requests, breach and privacy records, and records kept because the law requires them.

Customer organisations normally decide the purposes of operational housing data they enter in a workspace. For that data Clarity acts as processor. It includes residents and tenants, properties, rooms and placements, repairs, workforce activity, quality checks, inspections, compliance, operational communications, customer-directed email and SMS, contractors, stakeholders, complaints and safety records, and customer operational documents and evidence.

Where Clarity is processor, the customer organisation is normally the controller and decides the lawful basis. Questions about a resident, repair, or workforce record should go to that organisation first. Clarity will help the organisation respond.

Marketplace enquiries

When you enquire about a Marketplace listing, Clarity collects the contact details you submit so the listing publisher can reply about that home.

Enquiry fields typically include:

• your name
• email address
• optional phone number
• optional room preference
• your message

Do not include payment card details or other sensitive financial credentials in an enquiry.

Enquiry details are shared with the organisation that published the listing. Clarity may access enquiry records for support, abuse prevention, and platform reliability. Clarity does not sell Marketplace enquiry contact details.

Marketplace listings may show the full UK postcode where available. Exact residential street addresses, house numbers, and flat or unit details are not displayed publicly.

Accounts and R2R workspaces

If you create a Clarity account, we collect the details you submit at registration — typically first name, last name, email address, mobile number, and a password. The password is stored in hashed form for sign-in, not as readable text.

When you subscribe to the R2R package, Clarity stores organisation and workspace records needed to provide the service. That includes property, resident, repair, compliance, contractor, communication, and related operational records that operators and invited users enter in the workspace.

Subscription and payment are processed by Stripe. Clarity keeps the billing identifiers and subscription status needed to activate and operate the workspace. Payment card details are entered on Stripe's payment fields; Clarity does not store full card numbers.

Connect AI (your own AI provider)

Connect AI is optional. A workspace user can connect their own account with an AI provider, such as Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini), xAI (Grok) or another compatible service, using an API key from that provider. An organisation admin can turn Connect AI off for the workspace.

What is sent to the AI provider

• what the user types and the files they attach
• earlier messages in the same conversation
• Clarity records the AI asks to read on the user's behalf, limited to records that user can already see in Clarity

Right-to-rent and identity documents, bank details, and stakeholder access links are not made available to a connected AI.

Who is responsible

The user or their organisation chooses the provider and holds the account with it. Clarity sends the data on the organisation's instruction. The provider handles it under the organisation's own agreement with that provider and its privacy terms, which decide how long it keeps the data and what it uses it for. A provider chosen this way is not a Clarity subprocessor. Some providers may use data sent with a free key to improve their services. Where Clarity knows this applies, the AI cannot read workspace records until the user confirms the key is on a paid plan.

What Clarity stores

• the API key, encrypted by Clarity before it is saved and decrypted only on Clarity servers when the connection is used
• the last four characters of the key, the provider, the chosen model, and what the connection can do
• the user's Connect AI conversations and attached files, visible only to that user
• usage counts (such as tokens and images), visible to the connection owner

The key is never shown in the browser after it is saved, is never shown to people the owner shares the connection with, and is not written into ordinary application logs. Disconnecting deletes the key Clarity holds. Users can delete their conversations. The provider may keep its own copies under its terms.

A connected AI does not make decisions in Clarity. It can prepare drafts, and nothing is saved, sent, deleted or paid until a person confirms it.

Purposes and lawful bases

Where Clarity is controller, it uses personal information for these reasons:

• Contract, where the information is needed to provide the account or paid service you asked for.
• Legitimate interests, for organisation-user administration, security, fraud and abuse prevention, governance, Founder and customer support, reliability and error monitoring, provider observability, reasonable business follow-up, and partner or referral administration where a contract is not the right basis.
• Legal obligation, for tax, accounting, and certain privacy and breach records.
• Consent, where PECR or another rule requires it, including non-essential tracking.

You can object to processing based on legitimate interests, and you can withdraw consent where consent is the basis. Withdrawal does not undo processing that was already lawful.

Clarity does not make solely automated decisions that decide housing access, employment, benefits, repairs, or similar legal or significant outcomes. Workspace tools can sort and display operational records. A person remains responsible for those decisions.

Recipients and international transfers

Clarity uses service providers to host the application, store data, send email and SMS, monitor errors, take payments, protect sign-in from abuse, and connect optional Google features. The customer data processing agreement identifies which of those providers are subprocessors and which have a mixed or still-unconfirmed role.

Some providers process personal information outside the United Kingdom. Clarity does not describe its hosting as UK-only. Where a transfer needs a safeguard, Clarity relies on UK adequacy regulations or another lawful transfer tool that is actually in place for that provider. Where the contract evidence for a provider is still being collected, that gap is recorded internally and is not described here as a completed safeguard.

Customer organisations receive the operational data they enter. Marketplace enquiry details are shared with the organisation that published the listing. Clarity does not sell personal information.

When Ask Clarity explains a question in plain language, Clarity may send a shortened version of that question, recent turns in the same conversation, the user's role, and help topics that person is already allowed to use to OpenAI. Before that call, Clarity removes the signed-in person's name and contact details, the selected property address, the selected repair's resident name, and email, UK phone, and UK postcode patterns. Documents, images, and evidence files are not sent. If the question matches the product's sensitive-content check, Clarity does not call OpenAI and answers from its own rules instead. OpenAI API content is not used to train OpenAI models by default. This notice does not say that processing stays in the United Kingdom or the European Union, and it does not say that OpenAI keeps no copy for abuse monitoring.

If a user turns on Connect AI, data is also sent to the AI provider that user or their organisation chose, as described in the Connect AI section. That provider may process it outside the United Kingdom under its own terms.

Retention, backups, and security

Clarity keeps controller records for as long as the account or legal duty needs them, then deletes or restricts them. Customer operational data follows the customer organisation's instructions and the contract. This notice does not promise a fixed number of days for every category. The internal retention schedule records proposed periods and marks anything that is still a manual pilot control.

Backups exist so the service can be restored. Deleting a record from the live service does not instantly remove every backup copy. Backup copies are treated as beyond use for ordinary operations and are destroyed on the backup cycle. The current pilot uses manual database and file backups. It does not use point-in-time recovery or a provider-managed automatic database backup.

Security includes organisation isolation, access controls, encrypted transport, server-side handling of provider credentials, optional authenticator protection, and monitoring. Optional authenticator protection is available for any account. It is not required. These measures reduce risk. They do not remove it.

Cookies and similar storage are described in the cookie notice.

Your rights and complaints

Where Clarity is controller you can ask for access, correction, erasure, restriction, a portable copy where the right applies, and you can object. You will not be asked for a passport as a routine step. Clarity may ask for enough information to confirm the request is yours.

The usual time limit is one month. Clarity aims to acknowledge and triage a request within two working days. Some requests need the customer organisation because that organisation is the controller.

You can complain to Clarity at privacy@clarityhomes.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk. Clarity aims to acknowledge a privacy complaint within five working days.

Children and sensitive information

Clarity is housing and property operations software for organisations. It is not designed for independent use by children. There is no separate child account and no age check at sign-up, so this notice does not say that a child cannot open or be invited to an ordinary account.

Customer organisations decide who may use their workspace and are responsible for authorising those users lawfully. Information about children may still appear in household, property, complaint, and safeguarding records that a customer organisation enters. That position will be reviewed before any feature is introduced for direct use by children.

Clarity is not a medical record system. Free-text operational records, complaints, and evidence can still include health information or information about alleged criminal offences. Customer organisations must have a lawful basis, and an additional condition where the law requires one, before they enter that information. Clarity does not decide those purposes.

Contact

To ask about personal information Clarity holds, email privacy@clarityhomes.co.uk or contact Clarity by booking an Operational Rehearsal. Operators manage their own property and compliance records inside the signed-in Clarity workspace.