Privacy Policy

DirectHome is a property marketplace focused on users and properties in the United Kingdom. It is operated from the United Kingdom by Dariusz Debowski trading as Smart AI Lab, who is the controller for the processing described in this policy under the UK GDPR and Data Protection Act 2018.

Operator information pending completion: the business correspondence address and applicable ICO registration/fee information have not yet been supplied. Contact support@directhome.uk for operator enquiries. These details require business/legal confirmation before final production acceptance.

This policy applies to the DirectHome website, accounts, property listings, internal communications, verification, promotions, support and related services.

For privacy and data-rights matters, contact privacy@directhome.uk. General support enquiries should be sent to support@directhome.uk. Requests are logged with a case or reference number and tracked to resolution.

privacy@directhome.uk · support@directhome.uk

We collect information users provide, information created through use of the platform and limited technical information needed to operate and protect the service.

• Account, profile and consent information
• Property listings, files and location information
• Messages, access requests and support enquiries
• Verification, moderation, payment and promotion records
• Login, device, cookie and security records

Account data can include full name, email address, primary phone number, optional WhatsApp number, account type, county and area, company name for agents, developers or companies, verification status, account activity, consent history, password hash, sessions and security information.

Passwords are stored only as secure bcrypt hashes and never as readable plaintext. Raw session tokens are not stored in the database; only hashed session tokens are retained server-side.

Users can update their primary phone number and can change or remove an optional WhatsApp number through their authenticated profile. Phone verification is not required. Sensitive account and listing actions require a verified email address and remain subject to the platform's authentication and security controls.

Listing data can include title, description, rent or sale type, property type, price in GBP, bedrooms, bathrooms, property size, area, estate, town, county, landmarks, location notes, listing status, verification status and promotion status.

Inactive listings are retained for 12 months unless a longer period is justified by a dispute, fraud report or legal requirement.

Property images are stored as optimised files on Hostinger-controlled storage. MySQL or MariaDB stores file paths, image metadata, dimensions, file size, ordering and technical information—not image binaries.

When an image is no longer referenced by an active database record, a scheduled bounded cleanup removes the orphaned file after a safety grace period. Cleanup failures remain eligible for a later retry. Images can be retained where required for a dispute, fraud report, legal hold or other justified legal matter.

A publisher must select the property's exact position on the map. DirectHome can store the private latitude and longitude of that pin together with area, estate, town, county, nearest landmark and location notes. Public pages show an approximate location unless the owner or authorised advertiser explicitly chooses to show the exact location publicly.

On-site GPS confirmation is optional. Only when the publisher chooses to use it, DirectHome can collect the captured device location, GPS accuracy, timestamp, distance from the selected property pin and presence-verification result. The browser or device asks for permission before GPS data is captured. A successful check can add a verified-location badge but is not required for submission or publication. It does not prove ownership, title, authority to sell or rent, property condition or freedom from disputes.

Exact coordinates are private by default. Public pages show an approximate location unless the owner or authorised advertiser explicitly chooses to show the exact location publicly. A registered interested user can request exact location through internal messaging. The owner or lister can approve, decline or revoke access.

Approval is personal, non-transferable, linked to one requester account, valid for 48 hours and logged with request, approval, expiry and revocation history. While approved, the requester can view the exact location on a map and use Get Directions. Raw latitude and longitude are not displayed unnecessarily. Owners and authorised administrators can view request and decision history.

Owner and agent phone and WhatsApp details are private by default. Initial contact takes place through internal messaging. A user can request access, and the owner or lister can approve or decline sharing for that specific requester. Approval is personal, logged, not public to all users and revocable where appropriate.

Internal messaging is text-only. Photo, PDF and other file attachments are not available. Users must not send passwords, card PINs, bank login credentials, unnecessary identity information or other sensitive credentials in message text.

Active conversations can be retained while an account is active. After account deletion or conversation closure, messages can be retained for up to 12 months. Messages related to fraud, abuse, disputes, claims or investigations can be retained for up to 24 months where justified.

Users must be at least 18 to create transaction-related accounts or publish listings. People who only search do not need to upload identity documents. Owners, agents, developers and other listers must verify identity and age using an identity document.

Full document images are scheduled for deletion 30 days after a completed decision. Legal or investigation holds can postpone removal, and failed cleanup is retried. Audit data can include verified name, age 18+ confirmation, document type, issuing country, expiry date, masked number, verification time, verifier, result, rejection reason, cryptographic file hash and consent/security log. That audit record can remain for the account lifetime and up to 12 months after deletion where justified.

DirectHome does not verify a property seeker's identity on behalf of a landlord or seller. The contracting party remains responsible for its own identity checks and contracts.

Live Video Verification calls are not recorded or stored. DirectHome does not retain video, audio, screenshots or document copies shown during the call. It retains only the verification time, verifier, outcome, short notes about what was checked and verification expiry.

Video Verification confirms only what was visibly checked during the live call. It is not title verification, proof of ownership, conveyancing, valuation, structural inspection or a guarantee against fraud.

Optional listing upgrades and promotions use Stripe when enabled and displayed at checkout. The service, GBP price and applicable conditions are shown before payment. Private location and contact access currently costs £0 and still requires the lister's approval.

Stripe processes checkout payments. Payment records include successful, pending, failed, cancelled and expired payments, refunds, partial refunds, disputes and chargebacks. Some outcomes require administrator reconciliation; a recorded adjustment is not a promise of an automatic refund. Relevant records can be retained for accounting, legal obligations and disputes. DirectHome does not store card PINs, online banking passwords or full card details.

Ordinary enquiries and support correspondence can be retained for up to 12 months after closure. Payment, fraud, complaint, dispute or legal-claim matters can be retained for up to 24 months where justified. Unnecessary sensitive information is deleted earlier when no longer needed.

Security records can include login date and time, protected IP-derived identifier or hash, device and browser information, failed login attempts, active sessions and devices. Users can sign out of the current session. There is no account screen for listing devices or signing out every other session; contact support if another session may be compromised. Login history can be retained for up to 12 months.

DirectHome stores service notifications in the user's account so important events such as enquiries, replies, access decisions, moderation outcomes and expiring access remain available after signing out, changing device or restarting the application.

Web Push is optional and requires browser or device permission. When enabled, we store a per-device push endpoint, public encryption keys, browser information and delivery status. Push alerts show a generic notice and link to the authenticated notification inbox; message content remains in the account. Browser delivery is not guaranteed. Users can disable Web Push from the notification menu or browser settings without disabling durable in-platform notifications. Invalid or expired device subscriptions are disabled automatically and their pending deliveries are marked failed.

Necessary cookies support authentication, sessions, security, account protection and core functions and remain active independently of analytics choices. Analytics is optional and off until permission is granted.

The cookie interface provides Accept, Reject and Manage Preferences, with Reject as easy as Accept. Choices can be changed or withdrawn later through Cookie Settings in the footer. Google Consent Mode defaults analytics and all advertising consent types to denied. DirectHome does not enable Google advertising cookies.

When analytics is enabled for the platform and a GA4 measurement ID is configured, Google Analytics 4 is loaded only after Analytics permission is granted. Withdrawing permission stops future analytics collection. The target GA4 user and event retention configuration is 14 months. Analytics can include pages viewed, interactions, device type, browser, approximate location, referral source, performance and usage events, but must not include private account content or direct identifiers.

Property discovery uses the search filters and location choices you provide. Signed-in users can save and remove properties from their saved list. The account UI does not currently provide a behavioural personalisation control or an automated personalised recommendation service. DirectHome does not sell advertising profiles.

Users can report listings, accounts, messages, fraud, abuse, harassment, impersonation, prohibited content, misleading information or safety concerns. A serious listing report temporarily hides the listing pending review, notifies the owner, creates a case number and provides a reason category. The owner can respond with an explanation and evidence.

An administrator records the investigation and can restore the listing, require corrections, maintain suspension or remove it. Reports, notes, evidence and decisions follow applicable dispute and investigation retention periods.

We use data to operate accounts and listings, provide messaging and controlled access, verify listers, protect users, moderate content, respond to support, process promotions and payments, improve property discovery, maintain security and meet legal obligations.

Depending on the activity, potential lawful bases include performance of a contract, legitimate interests in security, fraud prevention and service operation, legal obligations, consent for optional analytics and marketing, and establishment, exercise or defence of legal claims. One basis does not automatically apply to every activity.

Information marked as required is necessary to create or secure an account, publish a listing, verify a lister, process a requested service or meet a legal obligation. Optional information can be left blank or removed where the relevant feature permits.

Listing descriptions and selected public location information are public once published. Exact coordinates are private by default, but the owner or authorised advertiser can explicitly publish the exact location. Otherwise access to exact coordinates follows the existing account-specific approval mechanism. Private phone/WhatsApp details, messages, identity records, sessions and security records remain restricted by role, purpose and access approval. GPS presence verification is separate from public location visibility.

Data is shared only where necessary with Hostinger as infrastructure provider; email providers for service messages; Stripe for checkout and payment processing; analytics providers after consent; professional advisers; law enforcement or regulators where legally required; and a legitimate future buyer, investor or successor operator during a sale, merger or transfer, subject to confidentiality and legal safeguards.

The system remains self-hosted and transferable. The main application, database and optimized property files operate on Hostinger-controlled infrastructure.

DirectHome operates from and focuses on the United Kingdom. International access or processing can occur. Where UK personal data is transferred outside the United Kingdom, an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum or another lawful safeguard must be used where required. Business/legal confirmation of hosting locations and applicable transfer safeguards is still required before final production acceptance; no unverified location or safeguard is represented as confirmed here.

Controls include bcrypt password hashing, hashed server-side session tokens, HTTP-only cookies, prepared database statements, access controls, rate limiting, origin checks, security headers, audit logs and restricted exact-location access. No internet service can promise absolute security.

The operational retention target is at least 7 daily restore points and 4 longer-term weekly restore points where infrastructure permits. This is a target rather than a guarantee, and operators verify actual backup coverage without inferring retention from a hosting plan name. Deleted data can remain in restricted backups until the relevant restore point is overwritten or retired. Backups support disaster recovery and full-system restoration, not routine restoration of individual deleted accounts or listings. Specific operational retention periods are described in the relevant sections above.

A user must re-authenticate before requesting deletion. The system checks for active disputes, fraud investigations, unpaid obligations, legal holds, active paid promotions and other justified retention requirements.

Without a blocker, the account is immediately restricted from new activity, deletion or anonymisation is scheduled after 30 days and the result is displayed after submission. With a blocker, deletion is paused, the reason is explained and the case goes to administrator review. Administrators handle exceptional cases and cannot arbitrarily refuse deletion. Profile deletion or anonymisation is scheduled after 30 days, subject to continued blocker checks and cleanup retries; minimal security, fraud, dispute, legal and audit records can remain for up to 12 months where justified.

Users can request a copy of their personal data through privacy@directhome.uk. Requests can cover profile data, listings, saved properties, internal messages and exact-location request history. We verify identity and exclude unnecessary data belonging to others. There is no self-service export control in the current account UI.

Versioned records of Privacy Policy acceptance, Terms acceptance, marketing consent and withdrawal can include document type, version, time, action and relevant security metadata. Users and authorised administrators can review consent history.

Marketing consent is optional, separate from registration, off by default and withdrawable. Marketing choices do not imply that a marketing campaign is sent. Service notifications use the channels implemented for each event; there is no SMS or WhatsApp marketing service. Password resets, listing status, access requests, security notices, payment confirmations and moderation notices are service messages, not marketing.

Subject to applicable law and identity verification, rights can include access, correction, deletion, restriction, objection, portability, withdrawal of consent and complaint. Contact privacy@directhome.uk. A request does not always require immediate deletion where lawful retention applies.

The service is not intended for children. Users must be at least 18 to create property transaction accounts or publish listings.

Where an incident involving personal data or account security is likely to create a real risk, affected users are notified by email and in-platform notification. The notice explains what happened, affected data or systems, likely consequences, measures taken and practical protective steps.

Privacy concerns should first be sent to privacy@directhome.uk so they can be investigated and tracked. UK users may complain to the Information Commissioner's Office (ICO). Current complaint guidance is available from the ICO at ico.org.uk.

We update this policy when services, practices or legal requirements change. Material changes are communicated appropriately and the effective and last-updated dates are revised.