Privacy
Privacy notice
Last updated 26 September 2026.
This notice explains what personal data Quarterday holds, why, and your rights over it.
Who we are
Quarterday is run by its owner, who is the data controller for the personal data described here. Contact: privacy@getquarterday.co.uk.
What we collect
| Data | Why | Lawful basis |
|---|---|---|
| Your email address, and your name if you give it | To sign you in and send the reminders you asked for | Contract |
| Addresses and details of the properties you add | To work out which duties apply and when | Contract |
| Certificate dates and documents you record or upload | To track expiry and keep documents ready for registration | Contract |
| Energy performance certificate data for your properties | To show the rating, expiry and recommendations | Legitimate interests |
| Registration numbers you enter (LRN, PRN) | To track renewal and the 28-day update duty | Contract |
| A record of emails we send you | To avoid sending the same reminder twice | Legitimate interests |
| Your name and contact address, and an anonymous reference for your account | Given to Allies Computing, who run the Postcoder address lookup, when you use it. Their address data licence requires us to tell them who each lookup is for: each lookup carries only the reference, and we give them your name and address separately, matched to it | Legitimate interests |
| Your email address and a region, if you ask for a reminder when your region opens (no account needed) | To send the two reminders you asked for: when it opens, and a month before its deadline. Nothing is sent until you confirm from the email we send. Deleted a month after that region’s deadline, or after 7 days if you don’t confirm | Consent |
| Messages you send us from “How’s it going?”, with your email address and the page you were on | To read and answer them, and improve Quarterday. Deleted with your account, or after two years | Legitimate interests |
| The IP address you sign in from, and use when looking up addresses | To stop abuse, such as one person creating many accounts. Deleted after 30 days | Legitimate interests |
We do not collect tenant names or contact details. Tenancy information is limited to dates, rent, deposit amounts and the number of occupants.
The free tools need no account. A postcode you enter is used to answer the question and is not linked to you. If you ask for a region reminder, we keep the IP address it came from for 30 days, only to stop one person signing up many addresses.
Energy performance certificate data
The Ministry of Housing, Communities and Local Government treats address-level EPC data as personal data. We fetch certificate details from the government’s EPC register for properties you add, store the rating, dates and recommendations, and never store the register’s address fields. Owners and tenants can opt out of the public register; the absence of a certificate is not proof that none exists.
Who we share it with
We use these processors, under contract, to run the service:
- Supabase (database, sign-in and document storage, hosted in London)
- Cloudflare (hosting, security, a check on the sign-in form that you’re not a bot, and sending our emails)
- Allies Computing (Postcoder address lookup). Their licence requires us to give them the name and contact address of each customer who looks up addresses
We do not sell personal data or use it for advertising. Our analytics are cookieless and collect no personal data.
How long we keep it
IP addresses: 30 days. Everything else: for as long as you have an account. When you delete your account, your properties, dates, documents and email history are deleted straight away. Copies in our database backups are kept for up to 7 days, then they’re gone too.
Security
Data is encrypted in transit and at rest. Documents are stored privately and can only be opened through short-lived links. Row-level security means each account can only ever read its own records.
Your rights
You can access, correct, export or delete your data at any time from Settings, or by emailing us. You can also object to processing, ask us to restrict it, or complain to the Information Commissioner’s Office.
Cookies
We set only the cookies needed to keep you signed in. No tracking cookies, so there is no cookie banner.