Last updated: 12 October 2026
HolidayLetContracts (holidayletcontracts.co.uk) is a trading name of POLICYANDPLAY LTD, a company registered in England and Wales (company number 17253846). Registered office: 7 Cosford Drive, Shortstown, Bedford MK42 0DQ, United Kingdom. ICO registration: ZC165321. We are not VAT registered.
Email: [email protected]
POLICYANDPLAY LTD is the data controller for the personal data described in this policy.
Your clients' information. When you fill in a rental agreement, guest registration record or other template, the guest details you type stay on your device and in any PDF or printout you make. They are not sent to us. You are the data controller for your guests' information. We only store it if you choose to use our client workspace, where we hold it on your behalf as your processor.
| Data | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|
| Email address, password (stored scrambled by Supabase, never readable by us) and the pack you bought | To create your account, sign you in and give you the documents you paid for | Contract | While you have an account. We delete it within 30 days of you asking, apart from purchase records |
| Purchase details: name, email, billing address, what you bought, the amount and date. Card details go straight to Stripe; we never see them | To take payment, send your confirmation email and keep tax records | Contract; legal obligation | 6 years after the end of the financial year of the purchase |
| Which documents you open and save | To show your progress in the dashboard, let our assistant suggest the next document, and notice when a customer who has paid has not opened anything, so we can check whether they are stuck and help | Legitimate interests (a useful dashboard) | While you have an account |
| Business details you type into the autofill panel: your name, business name, address, phone, email, logo and brand colour | To fill in your documents | Contract | Saved in your own browser, not on our servers, until you clear them. If you save a workspace profile, it is kept in your account until you delete it |
| A postcode you type into the address finder | To look up your town | Contract | Not kept by us. It is sent to postcodes.io for the lookup |
| Messages you send to Haven, our assistant | To answer your question | Contract | Not stored by us. See section 4 |
| Free form sign-ups on our guides: email address, which form you asked for, a record of your consent and a scrambled (hashed) version of your network address | To send the form and occasional practical emails. The hashed address is used only to stop the form being abused | Consent (emails); legitimate interests (abuse prevention) | Until you unsubscribe. After that we keep only your email address on a do-not-email list so we never contact you again |
| Email address entered in the free download form on our home page | To send the download link you asked for | Consent | Until you ask us to delete it, and no longer than 2 years |
| Client details you add in the client workspace, if it is switched on for your account: names, contact details, notes, bookings and documents you send | To run the workspace for you. For this data you are the controller and we act as your processor | Contract | Until you delete it or close your account |
| Emails you send us | To reply and keep a record of what was agreed | Legitimate interests | Up to 2 years after the conversation ends |
| Problem reports you choose to send with "Report a problem": your message, the page and document you were on, your browser type, a shortened one-way hash of your network address and, if you are signed in, your account ID | To fix faults and reply to you. A copy is emailed to us, with your account email address if you are signed in | Legitimate interests (fixing faults and helping customers) | 90 days |
| Automatic error reports, sent if one of our own scripts fails in your browser: the error message and where in our code it happened, the page and document, your browser type and a shortened one-way hash of your network address. They do not include your name, email address, account ID or anything you typed | To find and fix faults | Legitimate interests (a working site) | 90 days |
| Technical data: IP address, browser type, pages requested and time, plus records of password reset requests | To keep the site secure, stop abuse and fix faults | Legitimate interests | Server logs are kept for up to 30 days |
| Advertising cookies and similar technology, only if you click Accept | Microsoft Advertising (Bing UET) and Meta Pixel measure our adverts; Google AdSense shows adverts on our free guides | Consent | See our cookie policy |
We do not make decisions about you using only automated processing that have legal or similarly significant effects.
We only send marketing emails if you have asked for them, for example when you request a free form and tick the consent box. Every email has an unsubscribe link and you can object to direct marketing at any time. Emails about something you bought (receipts, sign-in links, password resets) are service emails, not marketing.
Haven runs on AI models reached through OpenRouter (US). When you ask a question we send your message, the last few messages in the conversation and a list of the documents you have opened. We do not send your name or email address. We use free models, and the companies that run them may keep prompts or use them to improve their models. Please do not type client names, health information or other personal details into the assistant. Its answers are general information, not legal advice, and can be wrong.
We never sell personal data. We may share data if the law requires it, or with a buyer if the business is sold, in which case this policy continues to protect it.
Some providers are in the US. We rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the ICO's International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.
The table in section 2 sets out how long we keep each type of data. In short: purchase records for 6 years for tax; account data until you ask us to delete it (we do so within 30 days); free form and newsletter data until you unsubscribe; server logs for up to 30 days; problem reports and automatic error reports for 90 days.
You have the right to:
Email [email protected] to use any of these rights. We reply within one month.
If you're unhappy with how we've handled your data, email [email protected] with 'Data protection complaint' in the subject. We'll acknowledge within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
Advertising cookies only load if you click Accept on our cookie banner. See our cookie policy for the full list, or change your choice at any time with Cookie settings.
HolidayLetContracts is for UK holiday let hosts. It is not aimed at children under 13 and we do not knowingly collect their data.
We update this policy when the way we work changes. The date at the top shows the latest version. If a change materially affects how we use data you have already given us, we will email you before it takes effect.