Privacy

Controller: Avlas Digital (sole trader, Ireland, registered business name No. 793798), Park House, The Square, Claremorris, Co. Mayo, F12 HE97, Ireland, [email protected]. Last updated 23 September 2026.

Free tools

The Eircode, dwelling details and rent you type are used to answer your query and are not stored against you. We keep the register results themselves (RT numbers, rents, areas; no names or addresses) to improve the service, and count how often each area is searched. To find the area and the BER for an Eircode we look it up with Microsoft Azure Maps and, when the certificate lacks a floor area, fetch the SEAI advisory report; only the Eircode is sent, nothing about you. For rate limiting we keep a salted hash of your IP address for up to two days, not the address itself; Cloudflare’s own logs hold IP addresses for a few days for security. If a search runs long and you leave an email address for the result, we store that address with your answers for 30 days, send one email with a link, and delete both after that.

Packs

When you buy a pack we store what you entered (address, Eircode, rents, dates, your email) and the result, for 6 years, so the pack stays available while a rent can still be disputed. If you start a purchase and do not finish it, what you entered is deleted after 30 days. Payment is taken by Stripe; we never see your card number. Emails are sent through Amazon Web Services in Ireland. Data is hosted in Ireland (Supabase, eu-west-1) and served through Cloudflare. During the free launch period a person checks each report before it is sent: the owner receives your answers and the PDF by email for that check. If you give us the date a notice was served, we store it with the pack and email you before the RTB deadlines; clear the date on the report page to stop.

Who processes your data

Stripe (payments and invoices), Amazon Web Services Ireland (email), Supabase (database, Ireland), Cloudflare (hosting and security), Microsoft Azure Maps (Eircode lookup), SEAI (BER register), Google (analytics and, if you arrived from an ad, conversion counting; Google may process this in the United States under its EU data transfer terms). Each acts on our instructions under a data processing agreement or, for public bodies, under their own terms. The legal basis is the contract with you for packs and accounts, and our legitimate interest in running and protecting the service for the rest.

Your account

If you open an account we store your email, the sign-in codes (hashed, 15 minutes) and a session token (hashed, 180 days on the device you signed in on). Business details you give Stripe at checkout (name, address, VAT number) appear on the Stripe invoice; we keep the invoice links so you can find them under Billing. Branding (name, licence number, logo) is stored and copied into each report you prepare. Credit purchases and uses are kept for six years for accounts purposes. Review reminders go to the email the report was bought with, at most twice per report. Email us to close the account; packs already bought stay available for six years unless you ask for them to be deleted too.

Your rights

Ask for a copy, correction or deletion of your data at [email protected]. We answer within a month. You may complain to the Data Protection Commission.

Cookies and analytics

Google Analytics 4 tells us which pages and tools get used. It sets cookies only if you press OK in the banner; say no and it runs without cookies, or not at all if your browser blocks it. If you arrived from a Google ad, the same tag tells Google Ads that a purchase happened, under the same cookie choice. Cloudflare Web Analytics counts visits without cookies. Your draft is kept in your browser’s session storage until you close the tab. If you came from a Google ad, the ad click ID from the link is kept the same way, in this tab only; when you ask for a report or pay, we store it with that order for 90 days to measure the ad, then delete it. The order itself is kept as described under Packs.