How we look after your information

The Host Files is run by The Saltwater Group Ltd, a company registered in England and Wales (company number 17417170), registered office 82a James Carter Road, Mildenhall, IP28 7DE. The Saltwater Group Ltd is the “data controller” for the personal information described in this policy, meaning we decide how and why it’s used.

The Saltwater Group Ltd also runs Saltwater Creative (web design) and The Saltwater Group (coastal property management) as separate services under the same company. This policy covers The Host Files specifically. Where it involves the other two, we say so clearly below.

When you use The Host Files, we collect:

Account details: your email address, and a password if you choose to set one instead of using a magic sign-in link.

Property details: the name, address, postcode, sleeping capacity and size you enter for each property you add.

Certificate documents: the compliance certificates you upload (gas safety, EICR, EPC, fire risk, insurance, PAT, hot tub, legionella), along with the expiry dates, boiler details and any “not applicable” reasons you record against them.

Billing information: if you add a second property, our payment provider Stripe collects and holds your card details directly. We only ever see your card’s brand, last 4 digits and expiry date, never the full number.

Preferences: whether you’ve opted in to product updates, and separately, whether you’ve opted in to a free property audit from The Saltwater Group.

Support and closure feedback: anything you tell us directly, for example if you email us, or an optional reason you give us if you close your account. If you give us closure feedback, we deliberately keep it disconnected from your name or email once your account is deleted, so it survives as anonymous product feedback rather than personal information.

We use your account and property details to run the service you’ve signed up for: keeping your certificate checklist, reading dates off documents you upload, looking up your EPC, sending renewal reminders and handling billing. This is necessary to perform our contract with you, which is our legal basis for this core processing.

We use billing details to charge you correctly and prevent fraud, which we’re allowed to do under our legitimate interest in running a functioning, fraud resistant business, balanced against your rights.

We only send you product updates, or pass your details to The Saltwater Group for a property audit, if you’ve separately and specifically ticked the relevant box on your account page. Both are off by default. This is consent, and you can withdraw it at any time from Account settings.

When you upload a certificate, the file is sent to Anthropic’s Claude AI to read the expiry date, and for gas safety certificates, the boiler make and model, so you don’t have to type them in by hand. This is an automated reading step, not an automated decision about you: nothing is approved, rejected or acted on without you seeing it first, and the date shown on your dashboard is always something you can review and correct yourself if it’s ever misread.

We’d always encourage you to check an automatically read date against your actual certificate, particularly for handwritten documents.

When you add a property, we send its postcode to the UK government’s public Energy Performance of Buildings register to find its existing EPC. This is a lookup against a public government dataset, not a disclosure of your personal information to a third party.

We use a small number of specialist providers to run The Host Files, each only for the specific job described:

Supabase hosts our database, user accounts and the certificate files you upload, in Supabase’s London (UK) data region.

Stripe handles payment processing and holds your card details.

Resend sends the account and renewal reminder emails on our behalf.

Anthropic reads uploaded certificates to extract dates and boiler details, as described above.

Google Analytics helps us understand how the site is used, but only if you’ve accepted analytics cookies. See Cookies below.

We don’t sell your information, and we don’t share it with The Saltwater Group or anyone else for marketing purposes unless you’ve specifically opted in to that.

Our database and file storage sit in the UK. Some of the providers above, including Stripe, Resend and Anthropic, are based in the United States. Where information is transferred outside the UK, we rely on their standard contractual safeguards recognised under UK data protection law to keep it protected to the same standard.

We keep your account, property and certificate information for as long as your account is open, so the service keeps working. If you close your account, we cancel any active subscription immediately, delete your uploaded certificate files, and delete your account, which automatically removes your properties, certificates, billing record and preferences with it. Any closure feedback you gave us is kept, but only in a form that can no longer be linked back to you.

Under UK data protection law, you can ask us to: give you a copy of the information we hold about you; correct anything that’s wrong; delete your information; restrict or object to certain processing; or receive your information in a portable format. You can close your own account and erase your data at any time from Account settings, or contact us using the details below for anything else.

The Host Files uses strictly necessary cookies to keep you signed in, which don’t require consent.

With your permission, we also use Google Analytics to understand how visitors use the site, so we can improve it. These cookies are off until you accept them in the banner shown on your first visit, and you can change your mind at any time using the “Cookie preferences” link in the bottom corner of the site. We don’t use advertising or cross-site tracking cookies.

The Host Files is a business tool for people who let out property, and isn’t directed at or knowingly used by children.

If you’re unhappy with how we’ve handled your information, please tell us first at info@thesaltwatergroup.co.uk. We’ll acknowledge your complaint within 30 days and look into it without unnecessary delay.

You can also complain directly to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

We may update this policy from time to time, for example as the service grows. We’ll update the date at the top of this page when we do, and let you know directly if a change is significant.

Questions about this policy or your information can be sent to info@thesaltwatergroup.co.uk.