Privacy policy

Last updated 30 September 2026

This policy explains what personal data Kept collects, why, who we share it with and the rights you have over it under UK GDPR and the Data Protection Act 2018.

1. Who we are

Kept is a trading name of Cube Systems Limited ("Kept", "we", "us"), part of Crushed Ice Group. Cube Systems Limited is registered in England and Wales, company number 17220899, and its registered office is Unit 11, Olney Business Park, Osier Way, Olney, Buckinghamshire, MK46 5FP. We are registered with the Information Commissioner's Office as a data controller, registration number ZC216972.

Kept is a compliance-tracking service for residential landlords with properties in England. We are the data controller for your account, for this website and for our trade partner and referral programme records. For data you add about other people, such as tenants, see section 6. If you are a trade partner or a member of our referral programme rather than a landlord, section 5 is the one written for you.

2. What we collect

Account details: name, email address, phone number (optional, and only if you opt in to SMS reminders), password (stored as a salted argon2 hash, so we never see or store the password itself), two-factor authentication secrets if you turn two-factor authentication on, and your notification preferences, including quiet hours.
Property and tenancy information you add: property addresses and postcodes (which we look up to place the property on your map and find its local council), certificate and licensing dates, tenancy details (tenant names, contact details, deposit and Right to Rent dates) and the documents you upload, such as certificates, tenancy agreements and proof of service.
Correspondence handled through Kept: emails and letters you send to tenants and the replies received, and messages forwarded to your personal certificate-mailbox address, including sender details, message content, timestamps and attachments. These are stored so your account holds a dated record of correspondence and evidence.
Tenant response pages and engagement tracking: when a letter is sent with a secure response page, we record when the email is opened (using a tracking pixel), when the response page is viewed, postcode-confirmation attempts (successful and failed), when a response form is started, and any response submitted: the respondent's name, chosen or suggested appointment times, an optional message and technical details of the visit such as IP address, browser, device and timezone. This is collected on the landlord's behalf as part of their dated compliance and evidence record (see section 6). The response page tells the tenant this before they submit.
WhatsApp send logs: if you choose to send a letter by WhatsApp, it is sent from your own WhatsApp account and does not pass through Kept's systems. Kept stores only the letter content and your own declaration of whether you sent it, with a timestamp, as part of your evidence record. WhatsApp is operated by Meta, and your use of it is governed by Meta's terms and privacy policy.
Billing information: handled by our payment processor, Stripe. We store your plan, subscription status and invoice references. We never store full card numbers.
Security and technical data: IP address, browser and device details, sign-in times and the devices you sign in from (used for new-device alerts), and server logs. When you sign up we also record basic context such as the referring page, so we understand how people find Kept.
Enquiries you send us: when you use the contact form we receive your name, email address, company (if you give one), the type of enquiry, your message and the Kept account you were signed in to, if any. The same applies to support emails, and to your email address if you join the newsletter or waitlist.
Visitor details sent with an enquiry: a contact-form enquiry also tells us about the visit: the page you sent it from, the page you first landed on and when, the site that referred you, any campaign tags and ad click identifiers in the link you arrived by, the previous page and how many pages you viewed. It also includes technical details: IP address, browser and operating system, device type, language, timezone and local time, screen and window size, whether touch and cookies are enabled, and the Google Analytics client ID if you allowed analytics. The journey details wait in your browser tab until you send the form (see the cookie policy).
Trade partner and referral programme applications: if you apply to be listed as a trade partner or to join the referral programme, we collect your business name, your name, email address, telephone number, website, trade, registration or accreditation number, years trading, team size, the postcode districts you cover and anything you write in the application, plus how you reached the form (page, referring site and any campaign tags). See section 5.
Referral link clicks: if you arrive through somebody's referral link we record the click with a random visitor identifier and a salted, one-way hash of your IP address, used only to avoid counting the same click twice. We do not store the IP address itself. See sections 5 and 13.

On the website we use Google Analytics 4 to understand how visitors use the site: pages viewed, approximate location, device type and events such as starting a signup or sending an enquiry. It runs only if you choose “Accept” on the cookie banner. Until then the Google script does not load, no analytics cookies are set and nothing is sent to Google. GA4 does not log or store IP addresses. We do not use advertising trackers, remarketing or social media pixels anywhere on the website or in the app.

3. Why we use it (lawful bases)

To provide the service (performance of our contract with you): tracking obligations, sending email and SMS reminders, filing inbound documents, sending correspondence you start, generating audit packs and calendar feeds, serving shared read-only links you create, and billing.
To keep accounts secure and the service reliable (our legitimate interests): authentication, two-factor authentication, new-device sign-in alerts, rate limiting, fraud and abuse prevention, logging, debugging and backups.
To communicate with you about the service (contract, or our legitimate interests): reminders, law-change alerts affecting your to-dos, billing and security notices, and replies to your enquiries. These are service messages, not marketing.
To answer enquiries (our legitimate interests): reading and replying to your message and passing it to the right person. We use the visitor details sent with an enquiry to route and respond to it and to understand which pages lead to enquiries. We do not use them for advertising or to build a profile of you.
To assess and run partner and referral applications (steps taken at your request before entering a contract, and our legitimate interest in verifying who we list): reviewing an application, checking a registration number against the relevant public register, publishing and billing an approved listing, producing performance statements and paying commission.
To meet our own legal obligations (legal obligation): tax, accounting and responding to lawful requests from authorities.
With your consent: newsletter, offer and product-update emails (opt in at signup or in your account, and opt out at any time through the link in each email), SMS reminders (opt in and out in your notification settings) and website analytics (Google Analytics runs only after you choose “Accept”, and you can withdraw that at any time through Cookie settings in the footer). Withdrawing consent does not affect processing that happened before.

4. Partner offers shown to landlords

The Free plan may show offers from vetted local trade partners, inside the app and inside the reminder emails we send you as a deadline approaches. Matching happens entirely inside Kept, using your property's outward postcode district. We never send your name, contact details or property information to a partner. Partners only receive aggregate statistics, for example how many times their offer was shown and how many times it was clicked, broken down by postcode district. Paid plans do not see partner offers unless they choose to switch them on, and can switch them off again at any time.

If you contact a partner, you do so directly and on your own initiative. From that point they are a separate data controller handling your enquiry under their own privacy notice, and we are not involved in the job or the contract.

5. If you are a trade partner or referral partner

This section applies if you apply to be listed in the Kept trade directory, or to join our referral programme. Here we are the data controller for your information. The commercial rules are in the trade partner terms and the referral programme terms.

What we collect: the application details listed in section 2, plus anything you send us afterwards, your approval status and any notes we make while reviewing you. For sole traders and partnerships, business contact details are personal data and are treated as such.
Public register checks: where your trade has a mandatory register or competent-person scheme (Gas Safe, NICEIC, NAPIT, ELECSA, STROMA, Elmhurst, Quidos, ECMK and similar), we look your registration number up on that scheme's public register before approving you, and check it again from time to time. We record the result, the date and the source. That information comes from the scheme, not from you.
What we publish: if we approve your listing, your business name, trade, registration or accreditation number, coverage area, description and (on the tiers that include it) your logo are shown to landlords in the directory, in the app and in reminder emails. Publication is the point of the service. If you do not want that, do not apply.
Statements and analytics: we measure how often your listing was shown and clicked so we can produce your statement. Those figures are aggregate and are never traced back to an identifiable landlord.
Landlord data you do not get: we never give partners a landlord's name, email address, telephone number, property address or compliance status, and we never sell or rent landlord details to anybody.
Billing and payments out: listing fees are taken by Stripe, as for any subscription. Where we owe you referral commission we hold the payment details you give us and issue self-billing statements. We arrange those details with you directly after approval and never ask for bank details through a web form.
Referral reporting: your toolkit shows clicks, signups, conversion rate, commission and anonymised referral records. It never shows the name, email address, telephone number, property addresses or compliance status of anybody you referred, and there is no way to contact them through Kept.
Your rights: the rights in section 11 apply to you in the same way. Email us to see, correct or delete what we hold, or to withdraw a live listing.

6. Tenant and third-party data

If you add tenant details, upload documents naming other people, or correspond with tenants and contractors through Kept, you are the data controller for that information and Kept acts as your data processor: we store, organise and transmit it only on your instructions. You are responsible for having a lawful basis to hold and use it and for keeping it accurate. This includes the data collected through tenant response pages. Email opens, page views, postcode-confirmation attempts and submitted responses (including the technical details described in section 2) are collected on your behalf as part of your compliance record. Our data processing agreement sets out what we commit to as your processor.

If you are a tenant or contractor whose details are held in a landlord's Kept account, please send requests about that data to the landlord first, because they control it. You can also contact us, and we will pass your request on or help where we can.

8. Where your data is stored and international transfers

Kept is hosted in the UK on Amazon Web Services (AWS). Our servers, databases, uploaded documents and inbound mail are in the UK. Some providers, such as Stripe, Google, Mapbox and content-delivery infrastructure, may process limited data outside the UK. Where that happens the transfer is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for Google Analytics), the UK International Data Transfer Agreement or Addendum, or equivalent safeguards. The sub-processors page lists each provider and where it processes data.

9. How we protect it

All traffic is encrypted in transit (HTTPS).
Passwords are hashed with argon2id, and email-verification and password-reset tokens are stored only as SHA-256 hashes.
Optional two-factor authentication, and email alerts when your account is used from a new device.
Document downloads use signed, time-limited links rather than public ones.
Access to production systems is restricted, and we keep encrypted backups for disaster recovery.

10. How long we keep it

While your account is active: we keep your account, property, document and correspondence data so your compliance record stays complete. That is the point of the service.
If you close your account: there is a seven-day cooling-off window during which you can reactivate. After it, your account data, documents and correspondence are permanently deleted within 30 days, except the limited records below.
Billing records: kept for up to six years after the transaction, as tax and accounting rules require. Commission and self-billing statements paid to partners and referrers are kept on the same basis.
Enquiries: kept for up to 24 months from our last contact about them, unless they become part of an account or partner record.
Partner and referral applications: declined or withdrawn applications are kept for 12 months so we can answer a query or a new application, then deleted. Records for approved partners and referrers are kept while the listing or code is live and for 12 months after it ends, apart from the billing records above. Public-register check results are kept for as long as the listing is live plus 12 months, as evidence of the verification we advertise.
Referral click records: the visitor identifier and hashed IP address behind a click are kept for up to 24 months so attribution and commission can be audited, then deleted.
Google Analytics data, if you allowed analytics: up to 14 months, then deleted by Google.
Server and security logs: kept for a short rolling period, then deleted or anonymised.
Newsletter subscriptions: kept until you unsubscribe.

11. Your rights

Under UK GDPR you have the right to:

access the personal data we hold about you;
correct inaccurate data (you can edit most account data yourself in settings);
delete your data (close your account in settings, or ask us);
export your data in a portable format: your documents and records can be exported as a zip on any plan, at any time, including after cancellation, and we can help if you need it;
restrict or object to some processing, including processing based on our legitimate interests, and withdraw consent where processing is based on consent (for example marketing emails, SMS reminders or analytics).

To use any of these rights, use your account settings or email hello@usekept.co.uk. We may ask you to confirm your identity first. We respond within one month, normally free of charge.

12. Complaints

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection: online at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Our ICO registration number is ZC216972.

13. Cookies and similar technologies

Kept uses a small number of cookies and browser storage items. The ones that keep you signed in, keep your account secure and take payments are strictly necessary and need no consent. If you follow somebody's referral link, two first-party cookies (kept_visitor and kept_ref) credit the person who recommended us. They are never shared with other companies or used for advertising.

Google Analytics cookies (_ga and _ga_<container-id>) are set only if you choose “Accept”. You can change your choice at any time through Cookie settings in the footer of any page.

The cookie policy lists every cookie and storage item the website and the app use, what each one is for and how long it lasts.

14. Children

Kept is a service for landlords and is not intended for anyone under 18. We do not knowingly collect data from children.

15. Changes to this policy

We update this policy as Kept's features, programmes and providers change, including when features marked “coming soon” (such as manager access, tenant handover packs, engineer contacts and public-record imports) launch and introduce new processing. We will tell you by email about any material change before it takes effect. The date at the top shows the current version.

16. Contact

Cube Systems Limited, trading as Kept, Unit 11, Olney Business Park, Osier Way, Olney, Buckinghamshire, MK46 5FP. Email hello@usekept.co.uk or call 01234 672 617.