Privacy

What we do with your information

Plainly, and without the usual hedging. If anything here is unclear, ask and we will explain it properly.

Last updated 28 September 2026.

Who we are

Phil Hurman, trading as Homeproof, a sole trader, is responsible for the information described here. In data-protection language we are the controller.

Our address is Bakersgate Cottage, Ash Road, Woking, Surrey GU24 0NA. Write to us at hello@homeproofuk.co.uk about anything on this page. We do not have a Data Protection Officer, and at our size we are not required to appoint one.

We are registered with the Information Commissioner's Office as a data controller, reference ZC244437. You can look that up on the ICO register.

When you run a property check

You do not need an account to run a check. When you run one we handle:

• The address you typed, and the report we build from it.
• A random identifier stored in a cookie, so that the checks you ran in this browser are shown back to you.
• Your network address, held only in the server's memory for a few minutes, to stop one person running thousands of checks. It is never written to disk.

We do this because you asked for the report, and because we have a legitimate interest in keeping the service working for everyone. To build the report we send the address or its coordinates to the organisations listed under where the facts come from.

If you create an account

We store your name, email address, a scrambled version of your password that cannot be turned back into the original, and whether you signed up as a private individual, an estate agent or a conveyancer. We keep a record of which checks are yours, which you have marked as favourites, and what you have bought.

If you belong to a firm's account, we also keep which firm, your role in it (owner, admin or member), your branch, and which version of the firm terms you accepted and when.

We do this to provide the account you asked for, which in legal terms means the processing is necessary to perform our contract with you.

If you buy something

Payments are taken by Stripe. Your card details go straight to Stripe and never reach us. We keep what you bought, how much you paid, the date, and Stripe's reference for the payment, so that we can deliver the certificate, answer questions about it, and keep the business records HMRC requires. Those records are kept for six years.

Emails we send you

We send a message to confirm your address when you create an account, when a check you started has finished, when a payment is received, and when you ask to reset your password. When someone at a firm invites you to its account, we send you the invitation. These are part of the service rather than marketing. We do not send newsletters and we do not sell or share your address with anyone for their own purposes.

Mail is delivered through Resend, which sends on our behalf.

Information about other people

A property report can contain information about people who are not our customers. Once our HM Land Registry connection is live, a purchased certificate will name the registered owner of the property. Reports also include past sale prices and dates, and where a seller has signed a declaration it carries their name and what they told us.

All of this comes from public registers that anyone may inspect, or from a seller who chose to provide it. We rely on our legitimate interest in providing property information, which is the ordinary basis on which conveyancers, estate agents and search companies work. If you are named in a report and want to know more, or object to it, write to us and we will deal with it.

Where the facts come from

To build a report we query HM Land Registry, planning.data.gov.uk, the Environment Agency, the Mining Remediation Authority, the energy performance register, Ofcom, police.uk, the Department for Education, the Department for Transport, Companies House, Ordnance Survey, Google, OpenStreetMap and, for an address in Wales, Cadw and the Welsh Government through DataMapWales. Each query tells that organisation which address or location we are asking about. We do not tell any of them who is asking.

Who else sees your information

• Mythic Beasts, who host our server in London.
• Stripe, for payments.
• Resend and Amazon Web Services in Ireland, who deliver our email.
• Microsoft, who host our own mailbox, if you write to us.

Those four work for us and only on our instructions. The recipients below do not.

If you belong to a firm's account, the firm's owner, admins and other members see your name, email address, role and branch, and they see and work on every check you start for the firm and what is bought for it. Ordnance Survey is given the firm's register of members (described under How long we keep things) only if it asks for it, as its licence allows.

Two more kinds of recipient are the ones a seller should know about: if you sign a seller declaration, you can send your answers on to your estate agent, as a one-page material information statement, and to a conveyancer, as the full pack with the papers behind it. Neither is sent anywhere by us on our own initiative. Each goes out only when you create the link, each link expires, and you can withdraw either at any time. Once they have your answers the agent and the conveyancer decide for themselves what to do with them, which in data-protection language means they are separate controllers, not our processors, and their own privacy notice covers what they do next.

We do not sell your information, and nothing you tell us, the addresses you check, your answers or your account, is used for advertising. The one advertising tool on the site runs only if you allow it, and it is described under Cookies below. Some of these organisations are based outside the United Kingdom, principally in the United States. Where that is the case the transfer relies on the UK government's adequacy decisions or on standard contractual clauses, which are the approved routes.

Cookies

We use one cookie of our own. It keeps you signed in and remembers which checks you ran in this browser. It is strictly necessary for the site to work, which is why you are not asked to consent to it: there is nothing to opt out of without breaking the service.

The only other thing that can set cookies here is Google's advertising tag, and it runs only if you allow it. The first time you visit, a short notice at the bottom of the page asks, with "Allow" and "No thanks" side by side. Until you choose "Allow", nothing from Google is loaded and no Google cookie is set. If you do allow it, the tag tells Google Ads that someone who clicked one of our ads reached the site, so that we can see whether an ad was worth paying for, and it sets Google's advertising cookies to do that. We do not use it to show you personalised ads or to build advertising audiences: it tells Google not to.

The tag runs only on our information pages: the home page, How it works, the sample documents, the order page for each product (while you are signed out) and this page, and on the brief "Starting your check" page you pass through after asking for a free check, and on the brief "Order received" page you pass through after placing an order. It sends Google the address and title of the page you are on, without any search terms, and nothing else we hold. On "Starting your check" it also tells Google that a check was started: not which address, and not your name or email address. On "Order received" it also tells Google that an order was placed, its value, and a reference that does not identify you or your order to Google: not which address, and not your name or email address. It never runs on the pages about a property you check, on your account, on sign-in or password pages, or on anything we send to an agent or a conveyancer, so Google is never told which addresses you check. We keep your answer in your browser for six months, then ask again.

Google decides for itself what it does with what the tag sends it, which makes Google a separate controller, not our processor: its privacy policy applies, and it explains how Google uses information from sites that use its services. You can change your mind at any time with Cookie choices at the foot of those pages, this one included. Choosing "No thanks" then stops the tag and removes its cookies from this site; cookies Google keeps on its own sites are cleared from your Google account or your browser's settings.

We do not use Google Analytics or any other analytics service. We count visits ourselves, without a cookie: see How we count visits.

How we count visits

We count visits to this site ourselves, without a cookie and without any analytics service. When a page opens we record which kind of page it was (never the address of a property, a check's reference or anything you typed), the hour, the name of the website that sent you here if there was one, the kind of page on this site you came from, whether someone was signed in, and a code made from your connection for that day only. Each page also sends us one empty message once it has opened in your browser, so that we can tell a person's browser from a program that only fetches pages: it carries nothing about you and sets no cookie.

The code is made from your connection, that day's date and a secret key that only we hold, so the same connection gives a different code each day. Without that key the code cannot be turned back into your network address, it does not tell us who you are, and it cannot link one day's visits to another's. We use it only to count how many different people visited on a day. None of this is sent to Google or anyone else, and it is not linked to your account.

These records are kept for 90 days. After that only the daily totals remain: how many times each kind of page was opened, and by how many people.

How long we keep things

• Your account and your checks: until you delete them. You can close your account and erase everything yourself from your account page, without asking us. Checks you ran for a firm's account, and what was bought for them, are the firm's: they stay with the firm when you leave it or close your account.
• Checks you have not saved to an account: seven days, then deleted automatically. You do not need an account to run a check. Keeping one is what the account is for, and the certificate says the date it goes.
• Purchase records: six years, because tax law requires it. If you add a comment to an order, it is kept with that order and emailed to our own mailbox so that a person at Homeproof reads it. The copy kept with the order is removed if you close your account.
• Which title was asked for, and by whom: 7 years. For every official copy or search we order from HM Land Registry we note the date, the title number, the email address of the account that asked for it and the firm, if any, it was asked for. Our agreement with HM Land Registry asks us to keep that record, so it stays for the 7 years even if you close your account.
• Members of a firm's account: a firm's account keeps a register of the people who can use it, with each person's name, email address and the dates they joined and left. We give it to Ordnance Survey only if Ordnance Survey asks for it, as its licence allows. Someone who leaves the firm, or closes their account, stays on that register for 12 months, then is removed.
• Your acceptance of a firm's terms: which version you accepted, for which firm, and when. Kept while you are in the firm and for 12 months after you leave it or close your account, the same as the register, then deleted.
• Password reset links: one hour, then they stop working.
• Email confirmation links: two days. Links inviting a seller to sign a declaration: three days. Both work once.
• Invitations to join a firm's account: 7 days, and they work once. The invitation, with the email address it was sent to, is deleted a day after it is used, withdrawn or expires.
• Statement links to an estate agent: 30 days. You can withdraw one sooner, and it stops working by itself as soon as you change an answer behind it.
• Links to your answers for a conveyancer: 60 days, and you can withdraw one sooner. What the agent or the conveyancer keeps after that is theirs to decide, and you would ask them rather than us.
• Network addresses: minutes, in memory only.
• Records of pages opened: 90 days, then only daily totals.
• Backups: fourteen days, after which they are overwritten.

One thing that cannot be undone

Every finished report is fingerprinted, and that fingerprint is recorded permanently in the Bitcoin blockchain so that anyone can later prove what the report said and when. That record cannot be removed by us or by anyone else.

If you ask us to delete a report we will delete it, and it will no longer be readable by anyone. What remains is the fingerprint, which is a one-way calculation. It cannot be turned back into the report and it does not reveal anything about you or the property.

Your rights

You can delete everything yourself at any time: your account page has a Close account option that erases your details and your checks immediately, apart from the records listed under How long we keep things that are kept for a set time after an account closes. You can also ask us to show you what we hold, correct it, delete part of it, restrict what we do with it, or provide it in a portable form. You can object to processing we carry out on the basis of legitimate interests. Write to hello@homeproofuk.co.uk and we will respond within one month. There is no charge.

If you think we have handled your information badly, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Automated decisions

A report is assembled automatically and the findings are produced by fixed rules, but nothing on this site makes a decision with a legal or similarly significant effect about you. A report is information for you and your advisers to weigh, not a decision about you.

Changes

If we change how any of this works we will update this page and change the date at the top. Where a change matters to you, we will tell account holders by email rather than relying on you noticing.