Privacy Policy

Introduction

This Privacy Policy explains how Acreonix Ltd ("Acreonix", "we", "us") collects, uses, stores and protects personal data when you use the Acreonix property management platform.

By creating an account or using our platform, you agree to the terms of this Privacy Policy. If you do not agree, please do not use Acreonix.

1. Who we are

Acreonix Ltd is a company registered in England and Wales. We provide a property management platform for landlords, letting agencies and property managers in the UK, UAE, USA and other markets.

• Registered office: London, United Kingdom
• Platform URL: platform.acreonix.co.uk
• Website: acreonix.co.uk
• Privacy contact: privacy@acreonix.co.uk

2. Data we collect

2.1 Account data (you provide directly)

When you create an account, we collect:

• Identity: your name, email address, password (hashed), and the agency name you represent.
• Contact: phone number (optional), business address.
• Billing: if you subscribe to a paid plan, payment is handled by Stripe. We store a Stripe customer ID and the country and currency of your subscription. We do not see or store your full card details.
• Preferences: workspace settings, default currency, notification preferences.

2.2 Platform usage (collected automatically)

To run the service and improve it, we automatically log:

• Login timestamps and IP address (kept for security and audit purposes).
• The features and screens you interact with, and the actions you take (creating a property, sending a message, running a report).
• Browser type, device type, screen size and language (for compatibility and bug diagnosis).
• AI usage: which AI features are run, the credit cost, and a coarse-grained breakdown by action type. We do not retain the body of AI prompts or responses beyond what is needed to deliver the feature.

2.3 Property data (you upload or generate)

When you operate your business in Acreonix, you upload or create:

• Properties: addresses, descriptions, photos, owner relationships, financial records.
• Tenants: names, contact details, lease history, payment records, ID documents (if uploaded).
• Leads and buyers: names, contact details, conversation history, qualification status.
• Landlords: contact details, statements, fees, communication history.
• Documents: leases, contracts, invoices, statements, anything you upload to the document store.
• WhatsApp conversations (Professional plan and above): messages exchanged through the Lead Agent are stored as part of the lead record.

For all of this data, you are the Data Controller, and Acreonix is the Data Processor under a DPA included in your terms of service.

3. How we use your data

We process the data described above under the following lawful bases:

4. Article 13, lead and tenant data

When your agency uses Acreonix to capture leads (for example, through the WhatsApp Lead Agent) or to manage tenants, you become the Data Controller for those individuals. You must:

• Have a lawful basis for collecting their data (most commonly consent or contract).
• Provide them with privacy information at the point of collection (Article 13 UK GDPR).
• Respect their rights (access, rectification, erasure, portability).

Acreonix provides tooling to help you meet these obligations, including data export, deletion-on-request, and audit logs. You remain responsible for compliance in your own business.

5. Who we share data with

We share data only with the following categories of recipients, and only as needed to deliver the service:

We do not sell your data, and we do not share it with advertising networks or data brokers. We may disclose data when required by law, by court order, or to protect our legal interests, the safety of users, or the integrity of the platform.

6. Meta Platform integrations

Acreonix integrates directly with Meta's Platform APIs to deliver messaging, advertising analytics and lead ingestion features. When you connect a Meta Business Account to Acreonix, we request only the permissions we need for the features you use.

Permissions we request

• whatsapp_business_messaging — send and receive WhatsApp messages on your behalf as part of the Lead Agent and campaigns.
• whatsapp_business_management — manage your WhatsApp Business Account (message templates, phone numbers, business profile).
• business_management — list and connect the Meta Business Accounts and assets you administer.
• public_profile — identify the Meta user completing the connection flow (name, ID).
• ads_read — read your Meta ad campaign performance metrics (spend, impressions, clicks, cost per lead, reach) for display inside your Acreonix workspace. We do not create, edit, pause, or delete campaigns.
• pages_show_list — list the Facebook Pages you administer so you can choose which Pages to scope ads analytics and lead ingestion to.
• pages_read_engagement — read basic engagement metadata associated with the Pages you connect.
• leads_retrieval (planned, subject to Meta approval) — ingest Meta Lead Ad form submissions into your Acreonix CRM pipeline in real time via webhook, so your agents can respond to enquiries within minutes.

How Meta data is stored

Access tokens Meta issues to Acreonix are encrypted at rest using AES-256-GCM before being written to our database. Tokens are scoped to a single tenant (your organisation) via row-level security enforced at the database layer. We do not share tokens or Meta data between tenants under any circumstances.

Deauthorization and data deletion

Meta requires every app to expose an automated Deauthorize Callback and a Data Deletion Request URL. Ours are:

• Deauthorize Callback: https://platform.acreonix.co.uk/api/meta/deauth. When you remove Acreonix from your Meta account (via Meta Business Tools), Meta notifies this endpoint. Acreonix then marks the connector as deauthorized, revokes the stored access token, stops all outbound API calls to Meta on your behalf, and notifies the org administrator via email.
• Data Deletion Request URL: acreonix.co.uk/data-deletion.html. Instructions for requesting full deletion of your Meta-sourced data (WhatsApp conversations, ad insights, lead form submissions) held by Acreonix.

You can also revoke Acreonix's access at any time from inside the Acreonix platform (Settings → Integrations → Meta → Disconnect) or directly from your Meta Business Settings.

7. Data retention

• Account data: kept for as long as your account is active, then 12 months after closure (in case you reactivate), then deleted.
• Property and tenant data: kept for as long as your subscription is active. On cancellation, you have 90 days to export or migrate. After 90 days, we delete or permanently anonymise.
• Lead records and AI conversation history: retained for 24 months from the lead's last activity, then automatically deleted.
• Outbound message logs (WhatsApp, SMS, email): retained for 12 months for delivery diagnostics and compliance, then deleted.
• Campaign dispatch logs: retained for 12 months, then deleted.
• Meta ad insights (spend, impressions, campaign metrics): retained for 24 months to allow year-over-year analysis, then deleted.
• Meta Lead Ad form submissions: ingested into the lead record and follow the 24-month lead retention rule above.
• API key audit logs: 30 days.
• Backups: retained for up to 30 days for disaster recovery, then overwritten.
• Platform audit logs: 7 days (Free), 30 days (Starter), 90 days (Professional), unlimited (Enterprise).
• Billing records: retained for 7 years to meet HMRC and equivalent tax obligations.

When an organisation terminates their Acreonix subscription, all associated data (leads, conversations, ad insights, tokens, connectors) is permanently deleted within 30 days of the 90-day export window closing, unless you request earlier deletion via privacy@acreonix.co.uk.

8. Cookies and local storage

We use only essential cookies and a small amount of browser local storage. We do not use third-party advertising or tracking cookies. The items we set are:

• Session token: keeps you signed in (essential).
• Workspace preferences: remembers the last workspace and module you used (essential for the platform to load consistently).
• Anonymous analytics: page views, performance metrics, no cross-site tracking (Vercel Analytics).

9. Your rights under UK GDPR

If we hold personal data about you, you have the right to:

• Access the data we hold about you and receive a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data (with some exceptions, such as billing records we must keep by law).
• Restrict or object to certain types of processing.
• Port your data to another provider in a structured, machine-readable format.
• Withdraw consent for any processing we do based on consent (such as marketing emails).

To exercise any of these rights, email privacy@acreonix.co.uk. We respond within 30 days.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by phone on 0303 123 1113.

10. Security

We take security seriously. Our measures include:

• All data in transit is encrypted with TLS 1.3.
• All data at rest is encrypted using AES-256.
• Passwords are hashed with industry-standard algorithms (bcrypt, scrypt).
• Access to production data is restricted to a small number of named engineers and audited.
• Row-level security policies enforce that one agency cannot see another's data.
• Regular backups and tested restore procedures.
• Vulnerability disclosure: email security@acreonix.co.uk. We acknowledge reports within 48 hours.

11. International transfers

Some of our sub-processors (notably Anthropic, Stripe, Vercel and Resend) are based in the US. When we transfer data outside the UK or EEA, we rely on:

• The UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs).
• Sub-processors certified under the EU-US Data Privacy Framework where applicable.
• Additional technical and organisational measures, including encryption and access controls.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address on your account) at least 30 days before the changes take effect. The "Last updated" date at the top of this policy always reflects the most recent revision.

13. Contact us

For any privacy questions, data requests, or concerns: