1. Data Controller
Pink Chilli (“we”, “us”, “our”) is the data controller for personal data processed through this service. Contact our Data Protection Officer at dpo@pinkchilli.io.
2. Data We Collect
- Account data: name, email address, profile picture (from OAuth provider)
- Organization data: organization name, team memberships, roles
- Property & tenancy data: property details, landlord/tenant information, tenancy terms, compliance documents
- Usage data: feature usage, page views, actions performed
- Billing data: subscription plan, payment history (processed by Calmony Pay)
- Technical data: IP address, browser type, device information
3. How We Use Your Data
- Provide and maintain the service (legal basis: contract — Art. 6(1)(b) GDPR)
- Process payments and manage subscriptions (legal basis: contract)
- Send service-related communications (legal basis: contract)
- Facilitate tenant referencing and AML/KYC checks (legal basis: legal obligation — Art. 6(1)(c))
- Improve the service through usage analytics (legal basis: consent — Art. 6(1)(a))
- Send marketing communications (legal basis: consent — opt-in only)
- Comply with legal obligations (legal basis: legal obligation)
4. Data Retention
We retain your personal data only as long as necessary for the purposes described above, in accordance with our Records Retention Schedule:
- Account data: retained while your account is active, deleted within 30 days of account closure
- Audit logs: retained for 90 days
- Usage events: retained for 180 days
- Financial records: retained for 7 years as required by UK law
- Tenancy records: retained for the duration of the tenancy plus 6 years (limitation period)
- Compliance documents: retained for the duration of the tenancy plus 6 years
Records due for deletion are automatically flagged by our data retention enforcement system and reviewed before permanent deletion.
5. Your Rights
Under the UK GDPR, you have the right to:
- Access your personal data (Subject Access Request)
- Correct inaccurate data
- Delete your account and all associated data (right to erasure)
- Export your data in machine-readable format (data portability)
- Restrict processing of your personal data
- Object to processing based on legitimate interest
- Withdraw consent for analytics and marketing at any time
To exercise any of these rights, visit our GDPR & Data Rights page or email dpo@pinkchilli.io. We will respond within 30 days per GDPR Article 12(3).
6. Sub-Processors
We use the following third-party services to process data on our behalf:
- Vercel — hosting and deployment (US/EU)
- Neon — PostgreSQL database (configurable region)
- Calmony Pay — payment processing (US/EU)
- Resend — transactional email (US)
- Twilio — SMS and WhatsApp notifications (US)
See our Register of Processing Activities for full details.
7. Cookies
We use strictly necessary cookies for authentication and session management. Analytics and marketing cookies are only set with your explicit consent via the cookie banner. You can change your preferences at any time.
8. International Transfers
Some of our sub-processors operate outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place including Standard Contractual Clauses (SCCs) or equivalent protections under UK GDPR.
9. Complaints
If you are unhappy with how we handle your personal data, please contact us first at dpo@pinkchilli.io. If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO). Visit our GDPR & Data Rights page for full details of the complaints procedure.
10. Contact
For privacy-related inquiries, contact our Data Protection Officer at dpo@pinkchilli.io.