Legal

Privacy policy

Last updated 3 October 2026

TerraTecton is a lettings back office for UK letting agencies. It is operated by TerraTecton (“we”, “us”). This policy explains what personal data we handle when you visit terratecton.com, use the app at app.terratecton.com, or are a tenant, guarantor, landlord or contractor of an agency that uses TerraTecton.

Questions or requests: hello@terratecton.com.

Our role

• Agency users and website visitors — we are the controller of your account and contact details.
• Tenants, guarantors, landlords and contractors — the letting agency is the controller of your data; we process it on the agency’s instructions as its processor, under a data processing agreement. Requests about that data are best sent to the agency; we will help them answer.

What we collect

Agency data comes from the agency itself — mostly a daily export from its property management system (for example Jupix). The website sets no advertising or analytics cookies; the app uses only what it needs to keep you signed in.

Google and Microsoft calendar data

An agency can connect its own Google Calendar or Microsoft Outlook calendar from Integrations → Calendar in the app. This is optional and done by an agency user signing in with Google or Microsoft.

What we access

• Your account’s email address (scopes openid, email), to show which account is connected.
• Your list of calendars and the events in the calendar you choose — time, title and busy/free status — with read-only access (Google calendar.readonly; Microsoft Calendars.Read).

How we use it

• To show your existing appointments on the TerraTecton calendar page.
• To avoid booking tenant call-backs at times you are already busy.

We never create, change or delete events in your calendar.

How we store and share it

• Sign-in tokens are kept on our servers in your agency’s own record, encrypted at rest, and are never sent to the browser or to another agency.
• Calendar events are fetched when needed and held in memory for about a minute; we do not copy your calendar into our database.
• We do not sell calendar data, use it for advertising, or share it with anyone except as needed to run the feature, to comply with the law, or with your consent. Calendar data is not used to train AI or machine learning models, and is not sent to AI models.
• Our staff do not read your calendar data, except with your permission to fix a problem, for security, or where the law requires it.

Removing access

Disconnect at any time from Integrations → Calendar: we revoke the token with Google and delete it from our records straight away. You can also remove access from your Google account permissions or Microsoft account.

Legal basis

• Contract — to provide the service to agencies and their users.
• Legitimate interests — to keep the service secure, keep an audit record, and reply to enquiries.
• Legal obligation — where the law requires us to keep or disclose records.
• For tenant, guarantor and landlord data, the agency determines the basis as controller.

AI

Some features — triaging a repair reported by WhatsApp, drafting messages, answering questions in the app — send the relevant text to a large language model through our own gateway (Azure OpenAI, and Anthropic where configured). Providers process it to return an answer and do not use it to train their models. Voice calls use speech recognition and synthesis that run on our own servers. A person at the agency approves every chase before it is sent.

Who we share data with

We use these service providers, each under a contract that limits what they may do with the data:

• Microsoft Azure — hosting and database (UK South region), Azure OpenAI
• Anthropic — language model, where configured
• Twilio — SMS, WhatsApp and phone calls
• Resend — email delivery
• Google and Microsoft — calendar sign-in, only for agencies that connect a calendar
• Stripe — payments, where used

We keep a tamper-evident audit record of key events. Only cryptographic hashes — never names, contact details or message content — may be anchored to a public blockchain. We do not sell personal data.

Where data is stored

Data is stored in the United Kingdom (Azure UK South). Where a provider processes data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum.

How long we keep it

• Account data — while the account is active, then deleted or anonymised within 90 days of closure.
• Messages and agency records — for the period the agency sets, then deleted automatically; audit records as long as the agency needs them to evidence compliance.
• Calendar tokens — until the calendar is disconnected or the agency leaves.
• Contact form enquiries — up to 24 months.

Security

Data is encrypted in transit (TLS) and at rest. Each agency’s data is kept separate and access is checked on every request. Staff access is limited to what is needed to run and support the service.

Your rights

Under UK GDPR you can ask to access, correct, delete or export your data, object to or restrict how it is used, and withdraw consent where we rely on it. Email hello@terratecton.com; we reply within one month. If you are a tenant, guarantor or landlord, you can also ask your letting agency. You may complain to the Information Commissioner’s Office.

Children

TerraTecton is a business service and is not intended for anyone under 18.

Changes

We will post changes here and update the date at the top. If a change materially affects how we use your data, we will tell agency users by email before it takes effect.