Privacy Policy

Introduction

This Privacy Policy explains how Acreonix Ltd ("Acreonix", "we", "us") collects, uses, stores and protects personal data when you use the Acreonix property management platform.

By creating an account or using our platform, you agree to the terms of this Privacy Policy. If you do not agree, please do not use Acreonix.

1. Who we are

Acreonix Ltd is a company registered in England and Wales. We provide a property management platform for landlords, letting agencies and property managers in the UK, UAE, USA and other markets.

• Registered office: London, United Kingdom
• Platform URL: platform.acreonix.co.uk
• Website: acreonix.co.uk
• Privacy contact: privacy@acreonix.co.uk

2. Data we collect

2.1 Account data (you provide directly)

When you create an account, we collect:

• Identity: your name, email address, password (hashed), and the agency name you represent.
• Contact: phone number (optional), business address.
• Billing: if you subscribe to a paid plan, payment is handled by Stripe. We store a Stripe customer ID and the country and currency of your subscription. We do not see or store your full card details.
• Preferences: workspace settings, default currency, notification preferences.

2.2 Platform usage (collected automatically)

To run the service and improve it, we automatically log:

• Login timestamps and IP address (kept for security and audit purposes).
• The features and screens you interact with, and the actions you take (creating a property, sending a message, running a report).
• Browser type, device type, screen size and language (for compatibility and bug diagnosis).
• AI usage: which AI features are run, the credit cost, and a coarse-grained breakdown by action type. We do not retain the body of AI prompts or responses beyond what is needed to deliver the feature.

2.3 Property data (you upload or generate)

When you operate your business in Acreonix, you upload or create:

• Properties: addresses, descriptions, photos, owner relationships, financial records.
• Tenants: names, contact details, lease history, payment records, ID documents (if uploaded).
• Leads and buyers: names, contact details, conversation history, qualification status.
• Landlords: contact details, statements, fees, communication history.
• Documents: leases, contracts, invoices, statements, anything you upload to the document store.
• WhatsApp conversations (Professional plan and above): messages exchanged through the Lead Agent are stored as part of the lead record.

For all of this data, you are the Data Controller, and Acreonix is the Data Processor under a DPA included in your terms of service.

3. How we use your data

We process the data described above under the following lawful bases:

4. Article 13, lead and tenant data

When your agency uses Acreonix to capture leads (for example, through the WhatsApp Lead Agent) or to manage tenants, you become the Data Controller for those individuals. You must:

• Have a lawful basis for collecting their data (most commonly consent or contract).
• Provide them with privacy information at the point of collection (Article 13 UK GDPR).
• Respect their rights (access, rectification, erasure, portability).

Acreonix provides tooling to help you meet these obligations, including data export, deletion-on-request, and audit logs. You remain responsible for compliance in your own business.

5. Who we share data with

We share data only with the following categories of recipients, and only as needed to deliver the service:

We do not sell your data, and we do not share it with data brokers. Google and Meta receive website visit data only if you accept analytics or marketing cookies, as described in section 8. We may disclose data when required by law, by court order, or to protect our legal interests, the safety of users, or the integrity of the platform.

6. Meta Platform integrations

Acreonix integrates directly with Meta's Platform APIs to deliver messaging, advertising analytics and lead ingestion features. When you connect a Meta Business Account to Acreonix, we request only the permissions we need for the features you use.

Permissions we request

Each Meta feature is connected separately, and Meta shows you the exact permissions before you agree. Nothing is requested for a feature you do not connect.

• whatsapp_business_messaging — send and receive WhatsApp messages on your behalf as part of the Lead Agent and campaigns.
• whatsapp_business_management — manage your WhatsApp Business Account (message templates, phone numbers, business profile).
• business_management — list the Meta Business portfolios you administer so you can choose which ad accounts and Pages to connect.
• public_profile — identify the Meta user completing the connection (name, ID).
• ads_read — read the results of the ad accounts you connect (spend, impressions, clicks, leads, cost per lead, reach and audience breakdowns) and show them in your Acreonix workspace, next to the leads each ad produced.
• ads_management — only when a manager in your workspace asks for it: pause or resume a campaign, change its name or budget, or create a new campaign. Campaigns Acreonix creates start paused, and nothing is spent until someone in your agency switches them on.
• pages_show_list — list the Facebook Pages you administer so you can choose which Pages to connect.
• pages_read_engagement — read basic details of the Pages you connect (name, picture, lead forms).
• pages_manage_metadata — subscribe Acreonix to new-lead notifications for the Pages you connect, so leads arrive within seconds.
• pages_manage_ads — read the lead ads and lead forms that belong to the Pages you connect, and promote a Page post as an ad when you ask for it.
• leads_retrieval — read the answers people submit on your lead forms and add each one to your Acreonix leads, with the ad, form and campaign it came from.

We use Meta data only to provide these features to the agency that connected it. We do not sell it, use it to advertise to anyone, or combine one agency's Meta data with another's.

How Meta data is stored

Access tokens Meta issues to Acreonix are encrypted at rest using AES-256-GCM before being written to our database. Tokens are scoped to a single tenant (your organisation) via row-level security enforced at the database layer. We do not share tokens or Meta data between tenants under any circumstances.

Ad results are read from Meta when you open them and are not kept as a separate copy. Lead form answers become part of the lead record in your workspace.

Deauthorization and data deletion

Meta requires every app to expose an automated Deauthorize Callback and a Data Deletion Request URL. Ours are:

• Deauthorize Callback: https://platform.acreonix.co.uk/api/meta/deauthorize. When you remove Acreonix from your Meta account (via Meta Business Tools), Meta notifies this endpoint. Acreonix then marks the connection as deauthorized, deletes the stored access token and stops all calls to Meta on your behalf.
• Data Deletion Request URL: acreonix.co.uk/data-deletion.html. Instructions for requesting full deletion of your Meta-sourced data (WhatsApp conversations, ad insights, lead form submissions) held by Acreonix.

You can also revoke Acreonix's access at any time from inside the Acreonix platform (Settings → Integrations → Meta → Disconnect) or directly from your Meta Business Settings.

Google integrations

If you connect Google, Acreonix asks only for what the feature you choose needs:

• Google Calendar — show and create the viewings and meetings you book in Acreonix in your calendar.
• Google Ads (https://www.googleapis.com/auth/adwords) — read the results of the Google Ads accounts you choose (spend, clicks, conversions, campaigns), report the leads that became viewings or deals back to Google Ads as offline conversions, and pause, resume or change the budget of a campaign when a manager in your workspace asks for it.
• Google Ads lead forms — receive the answers people submit on your Google lead forms as new leads, through a private webhook address and key for your workspace.

Acreonix's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide these features to the agency that connected it. We do not sell it, use it for advertising, or use it to train AI models, and people at Acreonix read it only with your permission, for security, or where the law requires. You can disconnect Google at any time in Acreonix (Settings, Integrations) or at myaccount.google.com/permissions.

7. Data retention

• Account data: kept for as long as your account is active, then 12 months after closure (in case you reactivate), then deleted.
• Property and tenant data: kept for as long as your subscription is active. On cancellation, you have 90 days to export or migrate. After 90 days, we delete or permanently anonymise.
• Lead records and AI conversation history: retained for 24 months from the lead's last activity, then automatically deleted.
• Outbound message logs (WhatsApp, SMS, email): retained for 12 months for delivery diagnostics and compliance, then deleted.
• Campaign dispatch logs: retained for 12 months, then deleted.
• Meta ad results (spend, impressions, campaign metrics): read live from Meta and not stored.
• Google Ads results: daily figures are kept for up to 24 months so you can compare periods, and are deleted within 30 days of you disconnecting Google Ads.
• Meta Lead Ad form submissions: ingested into the lead record and follow the 24-month lead retention rule above.
• API key audit logs: 30 days.
• Backups: retained for up to 30 days for disaster recovery, then overwritten.
• Platform audit logs: 7 days (Free), 30 days (Starter), 90 days (Professional), unlimited (Enterprise).
• Billing records: retained for 7 years to meet HMRC and equivalent tax obligations.

When an organisation terminates their Acreonix subscription, all associated data (leads, conversations, ad insights, tokens, connectors) is permanently deleted within 30 days of the 90-day export window closing, unless you request earlier deletion via privacy@acreonix.co.uk.

8. Cookies and local storage

The Acreonix platform uses only essential cookies and a small amount of browser local storage. Our marketing website also offers optional analytics and marketing cookies. These load only after you agree in the cookie banner, they are off by default, and refusing them is as easy as accepting them.

When you accept analytics or marketing cookies, Google and Meta receive information about your visit, such as the pages you viewed and whether you sent a request, and process it under their own privacy policies. We use Google Consent Mode, so Google is told which choices you made. If your browser sends a Global Privacy Control signal, we treat it as a refusal unless you opt in yourself.

We keep your choice for 12 months and then ask again. You can change or withdraw your consent at any time; if you withdraw it, we stop the tags and delete the cookies they set on our domain.

Change cookie settings

9. Your rights

Under UK GDPR and EU GDPR

If we hold personal data about you, you have the right to:

• Access the data we hold about you and receive a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data (with some exceptions, such as billing records we must keep by law).
• Restrict or object to certain types of processing, including direct marketing.
• Port your data to another provider in a structured, machine-readable format.
• Withdraw consent for any processing we do based on consent, such as marketing cookies or marketing emails, at any time.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by phone on 0303 123 1113, or with the data protection authority in your EU country.

Under UAE law

If you are in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) gives you the right to:

• Be informed about how and why we process your data and who receives it.
• Access your data and receive a copy, including in a structured format you can transfer to another provider.
• Correct or delete data that is inaccurate or no longer needed.
• Restrict or stop processing, including for direct marketing.
• Object to decisions made only by automated processing that have legal or similarly significant effects on you.
• Withdraw consent at any time, without affecting processing that took place before.

We process personal data from the UAE on the basis of your consent, to take steps you ask for before entering a contract (such as a demo or pilot request), or to meet our legal obligations. Agencies in the DIFC or ADGM may also be covered by those free zones' own data protection laws. You can complain to the UAE Data Office, or to the DIFC or ADGM Commissioner where their law applies.

To exercise any of these rights, email privacy@acreonix.co.uk. We respond within 30 days.

10. Security

We take security seriously. Our measures include:

• All data in transit is encrypted with TLS 1.3.
• All data at rest is encrypted using AES-256.
• Passwords are hashed with industry-standard algorithms (bcrypt, scrypt).
• Access to production data is restricted to a small number of named engineers and audited.
• Row-level security policies enforce that one agency cannot see another's data.
• Regular backups and tested restore procedures.
• Vulnerability disclosure: email security@acreonix.co.uk. We acknowledge reports within 48 hours.

11. International transfers

Some of our sub-processors (notably Anthropic, Stripe, Vercel and Resend) are based in the US. When we transfer data outside the UK or EEA, we rely on:

• The UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs).
• Sub-processors certified under the EU-US Data Privacy Framework where applicable.
• Additional technical and organisational measures, including encryption and access controls.

When we transfer personal data from the UAE, we do so only to countries with adequate protection or under the safeguards the PDPL allows, such as contractual clauses with our sub-processors.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address on your account) at least 30 days before the changes take effect. The "Last updated" date at the top of this policy always reflects the most recent revision.

13. Contact us

For any privacy questions, data requests, or concerns: