Privacy notice
Last updated 14 October 2026.
1. Who we are
The controller for the personal data described here is Bourne and Co Technologies Ltd, trading as Evidata, company number 17295566, registered office Bourne And Co, 11a Front Street, Durham, United Kingdom. We are registered with the Information Commissioner’s Office (ICO), registration number 00015931687. Contact: info@bournenco.com.
Important: when an agent uses Evidata to produce a report about a seller’s property, the agent decides why and how the seller’s details are used. For that information the agent is the controller and we act as the agent’s processor (see section 4). If you are a seller and want to use your rights, please contact the agent who ran your report first. You can also contact us and we will help.
2. Whose data, and what we collect
| Who | What we hold |
|---|---|
| Agents and agency staff with an Evidata account | Name, email address and profile picture from Google sign-in; agency name, logo, contact details, website and fee information that you add; credits balance, purchases, plan and invoices; the reports you run and their results; support emails; referral codes; basic technical and usage records (for example when a report ran and whether it succeeded). |
| Sellers whose property is the subject of a report | Property address and details; seller name and email address if the agent gives them; any notes, links or documents the agent uploads; the report itself, which can include the property’s sale history and other public records about it. |
| Sellers using an agent’s embedded valuation form | What you type into the form (usually name, email and property address), sent to the agent whose form it is. |
| Contributors to the optional rent network | Rent and property details you choose to contribute about lettings, held under the rent network terms, and the consent record for it. |
| Visitors to evidata.property | We do not use third-party analytics or advertising trackers. Our hosting provider keeps standard server logs (IP address, browser type, pages requested) for security and reliability. |
We do not knowingly collect special category data (such as health information), and ask agents not to upload it. We do not store card numbers; Stripe handles card payments.
3. Why we use it, and our legal basis
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Create and run your account, produce your reports, take payment, give support | Contract: we need it to provide Evidata to you. |
| Keep the service secure, prevent misuse and fraud, fix faults, understand costs and improve Evidata | Our legitimate interests in running a safe, working and sustainable service. |
| Keep invoices and accounting records | Legal obligation (tax and company law). |
| Send you service emails (reports ready, receipts, important changes) | Contract, and legitimate interests. |
| Send you marketing about Evidata, if you are an agent | Our legitimate interests in telling businesses about a related service (you can opt out at any time), or your consent where the law requires it. |
| Rent network contributions | As set out in the rent network terms and consent you gave when you joined; you can withdraw at any time. |
| Seller information in reports | Decided by the agent as controller (usually the agent’s legitimate interests in valuing the seller’s property, or the seller’s request). We process it on the agent’s instructions. |
4. Our role for sellers’ information
We only use the seller information an agent gives us to run, store and deliver that agent’s reports. We do not use it to market to sellers, and we do not sell it. We do not use it for our own purposes other than keeping the service secure and working. The agent’s terms with us (see our Terms of business) require the agent to be allowed to give us that information.
5. Who we share data with
We use these service providers (“processors”) to run Evidata. They may only use the data to provide their service to us.
| Provider | What for |
|---|---|
| Supabase | Database, sign-in and file storage |
| Vercel | Website and server hosting |
| Inngest | Running reports in the background |
| Anthropic | Artificial intelligence that reads the research and drafts the report. Property details and any notes or documents for the report are sent to it. We use it under business (API) terms. |
| PDFShift | Turning reports into PDF files |
| Resend | Sending report and service emails |
| Stripe | Taking card payments and managing subscriptions |
| Sign-in with Google. Map links in the site visit guide open Google Maps in your browser. |
To research a property we also send its address or postcode to data sources such as HM Land Registry, the EPC register, postcodes.io and property listing data providers. These are searches about a property, and do not include the seller’s name or contact details.
We may share data where the law requires, to protect our rights, or if the business is sold (the buyer would take it on under this notice). We never sell personal data.
6. Sending data outside the UK
Some of these providers are based in, or use servers in, the United States and other countries. When personal data goes outside the UK we make sure it is protected, for example by relying on the UK’s adequacy arrangements (including the UK–US data bridge for certified companies) or the UK International Data Transfer Addendum and standard contractual clauses. Ask us if you would like details.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account details and reports | While your account is open. When you ask us to close it, we delete or anonymise them within 90 days, except what we must keep by law. |
| Invoices and payment records | 6 years after the tax year they relate to, as the law requires. |
| Seller details in reports | As long as the agent keeps the report in their account, or until the agent or the seller asks us to delete it. |
| Rent network contributions | Deleted 18 months after contribution, or sooner if you withdraw, as the rent network terms say. |
| Server logs | Up to 90 days. |
8. Your rights
Under UK data protection law you can ask us to: give you a copy of your data; correct it; delete it; restrict how we use it; move it to someone else; and stop using it where we rely on legitimate interests or you have given consent. You can withdraw consent at any time, and you can unsubscribe from marketing from any email. Email info@bournenco.com and we will reply within one month. We may need to check who you are first.
If you are not happy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113.
9. Automated decisions
Evidata uses software and artificial intelligence to prepare appraisals of properties. These do not make decisions about individuals that have legal or similarly significant effects, and a person (the agent) reviews and decides how to use each report.
10. Cookies and similar technology
We use only what is needed to keep you signed in (a sign-in token stored in your browser), to remember simple settings, and, if you arrive from one of our adverts or posts, a note in your browser of which link brought you here. If you then sign up, we save that note against your account so we can see which campaigns work. We do not use advertising, tracking or analytics cookies on evidata.property. If that changes, we will ask for your consent first and update this notice.
11. Security
We protect data with access controls, encrypted connections, and by keeping secrets out of the browser. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the ICO as the law requires.
12. Children
Evidata is for businesses. It is not for anyone under 18 and we do not knowingly collect data about children.
13. Changes
We will update this notice when our service or the law changes, and put the new date at the top. For important changes we will tell account holders by email.