Privacy policy

Last updated 7 May 2026.

This privacy policy explains how LandlordFile collects and uses your personal data when you use the LandlordFile website or service.

1. Who we are

LandlordFile is operated by Metal Dog Services Ltd, a company registered in England and Wales (company number 17199387), with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Metal Dog Services Ltd is the data controller for the personal data described in this policy.

For all privacy questions and requests, contact privacy@landlordfile.co.uk.

Metal Dog Services Ltd is subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What data we collect

LandlordFile is software that helps UK landlords submit quarterly Making Tax Digital (MTD) Income Tax Self Assessment (ITSA) returns to HM Revenue & Customs (HMRC). To provide that service we collect:

• Account information — your name and email address.
• HMRC identifier data — the tax references and identifiers you authorise LandlordFile to access through HMRC's MTD ITSA APIs, together with Companies House identifiers where you choose to link them.
• Rental records — the rental income and expense data you import into LandlordFile, which we transmit to HMRC on your instruction.
• HMRC OAuth tokens — access and refresh tokens issued by HMRC when you authorise LandlordFile to act on your behalf.
• Payment metadata — a transaction reference and billing status from Stripe. We do not receive or store your card details; these are handled by Stripe.
• Operational logs — request and error logs needed to operate the service securely.

3. Why we collect it and our lawful basis

• Contract — we process your account information, HMRC identifier data, rental records, OAuth tokens and payment metadata to provide the LandlordFile service you have signed up to.
• Legal obligation — we retain records of MTD submissions for the period HMRC requires.
• Legitimate interest — we process operational logs to secure, debug and improve the service, balanced against your rights.

4. Who we share it with

We only share your personal data where it is necessary to deliver the service, and only with the following categories of recipient:

• HM Revenue & Customs (HMRC) — the receiving tax authority for your MTD ITSA submissions.
• Stripe — payment processing (PCI-DSS compliant).
• Postmark — sending transactional emails such as receipts and submission confirmations.
• Vercel — hosting of the LandlordFile website and application.
• Neon — Postgres database hosting (eu-west-2, London region) for your account and rental data.

We do not sell your data. We do not share it for advertising purposes.

5. How we secure your data

All connections to LandlordFile use TLS 1.2 or later. Customer data at rest is encrypted at the database layer by our hosting provider. HMRC OAuth tokens are additionally encrypted at the application layer using AES-256-GCM before being written to the database. Encryption keys are managed separately from the database and rotated on incident.

6. Reporting a security issue

If you believe you have found a security vulnerability in LandlordFile, email security@landlordfile.co.uk. We aim to acknowledge reports within two working days. Please do not disclose the issue publicly until we have had an opportunity to investigate and fix it.

7. How long we keep it

• Tax submission records — kept for seven years after your account closes, to meet HMRC's record-keeping requirements.
• HMRC OAuth tokens — deleted 30 days after their last use.
• Marketing email addresses (for example, the notify list on this site) — deleted immediately on request and, in any event, once the launch announcement has been sent.
• Operational logs — retained for 30 days, then deleted.

8. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• ask us to rectify inaccurate data;
• ask us to erase your data, except where we are required by HMRC to retain tax submission records;
• receive a copy of your data in a portable format, or have it sent to another provider where technically feasible;
• object to or restrict certain processing;
• complain to the Information Commissioner's Office at ico.org.uk.

To exercise any of these rights, email privacy@landlordfile.co.uk.

9. Cookies

landlordfile.co.uk uses only strictly-necessary cookies required for the site to function. We do not use analytics or advertising cookies, and will not do so without your consent.

10. International transfers

The LandlordFile application is hosted on Vercel's London function region (lhr1) and customer data is stored in Neon Postgres (eu-west-2, London region). Customer data is processed within the United Kingdom. Some processors we use (Stripe for payments, Postmark for transactional email) may process limited operational data outside the UK in line with their published regional policies; where this happens we rely on UK-approved transfer mechanisms such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

11. Changes to this policy

If we make material changes to this policy we will update the date at the top of this page and, for registered users, notify you by email at least 14 days before the changes take effect.

12. Contact

For any privacy question or request, contact privacy@landlordfile.co.uk.