Last Updated: October 2026 • Real House Ltd (Trading as Lotsby)
1. Introduction & Data Controller
Welcome to Lotsby, a service owned and operated by Real House Ltd (“we”, “our”, or “us”), registered in the United Kingdom. We act as the Data Controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We are committed to protecting your personal data, respecting your privacy, and handling your information in accordance with applicable UK data privacy laws and standards overseen by the Information Commissioner's Office (ICO).
For privacy enquiries or to exercise your statutory rights, contact our Data Protection team at: support@lotsby.app.
2. Information We Collect
We only collect information necessary to deliver our auction research and analytical services:
Account & Contact Data: Name, authentication email (including Apple Private Relay aliases), verified contact email, phone number, and profile image.
Location Data: Geolocation coordinates (when granted via your device permissions) to calculate property proximity, local amenities, and commute insights.
Voice & Audio Input: Audio transcripts from speech recognition when utilizing voice search or voice navigation features.
Property Research & User Content: Saved favourites, search alerts, custom polygon areas, and PDF legal pack files uploaded for automated analysis.
Billing & Subscription Metadata: Subscription plan status, renewal dates, Stripe customer identifiers, and Apple App Store transaction IDs. We do not store credit card numbers on our servers.
Technical & Usage Telemetry: IP addresses, browser/device specifications, and non-essential analytics events (subject to your cookie/tracking consent).
Product Usage Records (first-party): How your signed-in account uses Lotsby — screens and tools opened, property lots viewed and saved, search filters and AI-search queries, voice command transcripts (text only, never audio recordings), timestamps and durations. Recorded by our own servers without cookies or tracking identifiers, used solely to improve and protect the service, and never sold or shared for advertising.
3. Lawful Basis for Processing
Under Article 6 of the UK GDPR, we process your personal data under the following legal bases:
Contract Performance
Creating your account, managing subscriptions, delivering property catalogues, and generating AI insights.
Explicit Consent
Speech recognition for voice commands, non-essential telemetry/cookies, and sharing contact info with specific auctioneers.
Legitimate Interests
Service security, platform monitoring, cryptographic fraud/promotional abuse prevention, and first-party product usage records.
Legal Obligation
Maintaining statutory accounting records and complying with UK regulatory requirements.
4. Third-Party Sub-processors & Data Sharing
We share data strictly with vetted sub-processors essential for infrastructure and functionality:
Google Cloud & Firebase (UK/EU/US): Cloud hosting, database (Cloud Firestore), user authentication, and secure document storage.
Google Generative AI (Gemini): Processing voice navigation queries and automated property/legal pack summaries under strict privacy terms.
Payment Gateways (Stripe & Apple StoreKit): Secure payment transaction handling and subscription management.
Auction Houses (Conditional): When requesting a legal pack provided directly by an auction house, we share your verified email and phone number only with your explicit, contextual consent recorded in our immutable consent ledger.
5. Account Deletion & 30-Day Grace Period
You may request account deletion at any time via the Settings menu in the Web App or Mobile App.
Soft Delete & Grace Period:
Upon requesting deletion, your account is immediately deactivated and enters a 30-day grace period. During this window, all marketing notifications are halted. You may restore your account and all associated research by signing in before the 30 days expire.
After 30 days, your account, personal data, and uploaded legal packs are permanently and irreversibly purged from our live database and storage.
Anti-Abuse Cryptographic Fingerprint: To protect our promotional welcome credits from systematic abuse, we retain an irreversible mathematical hash (SHA-256) of account identifiers. This cryptographic hash cannot be reversed to discover your email or personal identity.
6. Your Statutory Rights (UK GDPR)
As a data subject in the United Kingdom, you have the following rights under law:
Right of Access: Request a copy of your personal data.
Right to Rectification: Request correction of inaccurate information.
Right to Erasure: Request permanent deletion of your records.
Right to Portability: Obtain your data in a structured, standard format.
Right to Object: Object to processing based on legitimate interests.
Right to Withdraw Consent: Revoke consent at any time.
If you are unsatisfied with how we address any request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) via ico.org.uk or by telephone on 0303 123 1113.
7. Cookies & Tracking
We use strictly necessary session cookies to maintain your login state. On this promotional site (lotsby.com), zero third-party marketing cookies or ad-tracking scripts are loaded, ensuring privacy by design.
Strictly Necessary Cookies Only
Only functional cookies for authentication and essential session security are utilized.
8. How Long We Keep Your Data
We keep personal data only as long as each purpose requires:
Account, profile & research data (name, contact details, favourites, alerts, uploaded documents): kept while your account is active, and permanently deleted 30 days after you delete your account (the grace period during which you can change your mind — see Section 5).
Product usage records: linked to your account for a maximum of 12 months, after which the link to you is irreversibly removed and only anonymous statistics remain. If you delete your account, the link is removed at the end of the 30-day grace period instead.
Voice commands: audio is never stored; the transcribed text follows the product-usage-records rule above.
Email delivery logs (records that a notification or alert email was sent): up to 30 days, for delivery troubleshooting only.
Billing records: retained for 6 years after the transaction, as required by UK accounting law, even if the account is deleted.
Anti-abuse cryptographic hash (Section 5): retained indefinitely; it cannot be reversed to identify you.
Anonymous aggregated statistics: retained indefinitely — they contain no personal data.