Privacy Policy

Mather Software Ltd (“we”, “us”, or “our”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your information when you use our AI-powered property research service.

We are the data controller for the personal data we process, and we are based in the United Kingdom. Our contact email for privacy matters is support@mathersoftware.com.

• Mather Software Ltd
• Registered in England and Wales, company number 17443861
• View on Companies House (opens in a new tab)

2.1 Account Information

• Email address (required for account creation)
• Name (if provided during registration)
• Authentication tokens (managed by Clerk)

2.2 Payment Information

• Payment card details (processed and stored by Stripe, not by us)
• Billing history and transaction records
• Subscription status and billing history

2.3 Usage Data

• Property listings you send us with the browser extension, including their web addresses
• AI-generated property analyses and chat conversations
• User preferences (budget, property types, priorities, deal-breakers)
• Saved properties, favourites, and portfolio data

2.4 Technical Data

• Browser type and version
• Device information
• IP address (collected by authentication provider)
• Session cookies for authentication
• The page on our site you first landed on during the visit in which you created your account, and the site that referred you to it — recorded as that site's address only (for example “google.com”), never the search terms you typed. It is written to your account once and never changed afterwards, and it tells us which of our pages actually bring people to HomeThink. We rely on our legitimate interests in understanding how people find the service (Article 6(1)(f)).

To hold that last item until you sign up, we keep it in your browser's session storage, which your browser clears when you close the tab. It is not a cookie, it is never read by anyone else, and if you do not create an account it is never sent to us at all.

2.5 Analytics Data

We use PostHog for product analytics, routed through our own domain, and Vercel Web Analytics for page-level traffic measurement. There are three separate streams, and they are governed differently.

Browser analytics (consent-gated)

Only collected once you accept analytics cookies. Nothing is sent from your browser before then, and accepting is entirely optional. This stream covers:

• Page views and navigation patterns
• Feature interactions (e.g., properties added, tabs viewed, valuations requested)
• An anonymous device identifier stored on your device
• For signed-in users: user ID and email address (linked to analytics events)

Traffic measurement (consent-gated)

Also only collected once you accept analytics cookies — the script is not loaded at all before then. Vercel Web Analytics records which pages are viewed, the referring site, and coarse device and country information. It is not linked to your account and we do not send it your name or email address.

Service telemetry (legitimate interests)

A small set of events is recorded on our servers when the underlying action happens, whether or not you have accepted analytics cookies. We rely on this to know that the service works, what it costs us to run, and whether payments succeed — we could not operate the product reliably without it, and consent-gated data cannot answer those questions because it undercounts by an unknown amount.

• Analyses started, completed, and failed; free daily limits reached; chatbot turns taken
• Subscription and billing lifecycle events (checkout started, started, cancelled, payment failed)
• Browser-extension usage and error signals
• When you are signed in and not subscribed, which Pro offers you were shown or pressed, counted once a day each and kept for 180 days

These records carry an internal account or session identifier and factual details of the action (such as which feature ran and whether it succeeded). Where you are not signed in, that identifier is the one generated for your visit; no IP address, and no value derived from one, is attached to these events. We do separately hold a hashed form of your IP address on the records that apply fair-use limits, and on a message you send us through the contact form, so we can stop abuse. That hash stays in those records — it is never sent to our analytics provider. They never include your name or email address, and we do not collect the content of any property, listing, note, or message — though an error report may incidentally include the page or request that failed. This processing relies on our legitimate interests in operating, securing, and billing for the service (Article 6(1)(f) UK GDPR) rather than on consent. You have the right to object — see section 7.

See our Cookie Policy for full details of the browser stream.

We process your personal data under the following legal bases:

• Contract Performance: Processing your property research requests, delivering AI analysis, and managing your subscription
• Legitimate Interest: Improving our service, preventing fraud, ensuring platform security, and the server-side service telemetry described in section 2.5
• Consent: Optional browser analytics and functional storage. You can withdraw this at any time in Settings → Legal & Privacy → Cookie preferences, and withdrawing is as easy as giving it.
• Soft opt-in (PECR reg. 22(3)): Occasional email with product tips and offers about HomeThink and HomeThink Pro, a similar service to the one you signed up for or bought. When you create an account we tell you we will send these and give you a box to tick to refuse them; if you tick it, or have not been shown that notice, we send none. Every one of those messages carries a one-click unsubscribe link that works without signing in, and we record when and why we became entitled to send it. Receipts and “your report is ready” notices are not marketing and are covered by Contract Performance above — unsubscribing does not stop them.
• Legal Obligation: Complying with UK tax and financial regulations

We use your personal data to:

• Create and manage your account
• Process property analysis requests using AI
• Facilitate payments and manage your subscription
• Provide customer support
• Send service-related notifications (e.g., subscription confirmations, renewal receipts)
• Improve the quality of our analysis and the service
• Understand how users interact with HomeThink and improve the experience (with your consent, via analytics)
• Detect and prevent fraudulent activity
• Comply with legal obligations

We share your data with third-party service providers who help us operate HomeThink. Those processors are contractually bound to protect your data and use it only for the purposes we specify.

Separately, building a report means looking a property up in public registers and open datasets. Those bodies are not our processors and we have no contract with them; what we send them is set out in 5.2 below, and it is a fact about the property rather than a fact about you.

5.1 Service Providers

• Clerk (US-based): Authentication and user management. Processes email addresses and authentication tokens.
• Convex (US-based): Database and backend infrastructure. Stores all application data including properties, analyses, and user preferences.
• Stripe (US-based): Payment processing. Handles all payment card details (we never see your full card number).
• Anthropic (US-based): The AI provider behind our analysis and chat. Receives the property listing content, your stated preferences and your chat messages. For a Pro report it is also given the web addresses of the listing's own photographs, floorplan and EPC graphic, as they appear on the page you captured, and loads those images from the property portal's image servers in order to read what they show about the condition of the house. We do not copy, host, store or display those images ourselves; we hold only the written conclusions drawn from them. The addresses themselves are deleted 3 days after the capture, at the next daily clean-up. Anthropic does not train its models on data submitted through its business API.
• PostHog (US-based): Product analytics. When you consent to analytics cookies, PostHog receives page views, feature interactions, and for signed-in users your user ID and email address, to help us understand user journeys and improve the service. Separately, and regardless of your cookie choices, we send PostHog a small set of pseudonymous server-side events recording actions taken in the product (for example: a report was generated, a subscription started). These carry your account identifier but not your name, email address or IP address, and we rely on legitimate interests for them — see section 2.5. You can object to this processing at any time by contacting us.
• Sentry (US-based): Error monitoring. Receives technical details of errors that occur while you use HomeThink, including your account identifier, name and email address, so we can understand and contact you about a failure that affected you. We rely on legitimate interests in keeping the service working. Only if you have allowed analytics in the cookie banner may Sentry also record a masked replay of a browser session in which an error occurs — text content and media are obscured before leaving your device. Without that consent no replay is recorded and nothing is stored on your device for it.
• YourMail (UK-based): Email delivery. Receives your name and email address in order to deliver the emails you have asked for, or that we must send you about your account.
• Cloudflare (US-based): Bot protection on our forms. Receives your IP address and browser characteristics in order to distinguish you from automated traffic.
• Vercel (US-based): Website hosting and delivery. Processes the requests your browser makes to us, including your IP address, in order to serve the site.
• OpenRouteService (Germany): Travel-time calculation. Receives the start and end coordinates of a commute you ask us to calculate. It is not told who you are.
• Vercel Web Analytics (US-based): Page-level traffic measurement, loaded only if you accept analytics cookies. Receives the page you are viewing, the site that referred you, and coarse device and country information. It is not linked to your account — see section 2.5.
• Ministry of Housing, Communities and Local Government (UK) and postcodes.io (UK): Public register lookups (the EPC register and postcode geography). Receive the address or postcode of a property you ask us to analyse. Neither is told who you are.

5.2 Public register and map lookups

To build a report we look a property up in a number of public registers and open datasets. Our servers make these requests; none of them is told who you are, and none receives your name, email address or account identifier. What each receives is the fact about the property that the lookup needs:

• HM Land Registry (UK): the property's postcode, or its outward code, to retrieve recorded sale prices.
• data.police.uk (UK): the property's approximate coordinates, to retrieve street-level crime counts.
• Environment Agency (UK): the property's approximate coordinates, for flood and noise data.
• planning.data.gov.uk (UK): a small bounding box around the property, for nearby planning applications.
• Historic England (UK): a small bounding box around the property, for listed buildings.
• Ofsted (UK): the property's approximate coordinates, to find nearby schools and their ratings.
• Overpass API (community-run servers in the EU, querying OpenStreetMap data): the property's approximate coordinates, for nearby amenities. This is a third-party service, not a government one.
• Imperial College London air quality API (UK): the code of the nearest published monitoring station. It is not sent the property's address or coordinates.
• Bank of England and public news feeds (UK): nothing about you or your property — these are fetched on a schedule for market rates and property news.

Some parts of the site are drawn by your own browser, which contacts these parties directly. That means they see your IP address and the location you are looking at, and we cannot see or control what they log:

• OpenStreetMap Foundation (UK-based): the map tiles for the maps and map thumbnails, requested from openstreetmap.org.
• OpenFreeMap (a free, community-funded map tile service): the vector map styles and tiles used by the maps inside a report.
• Environment Agency (UK): the flood-zone overlay drawn on top of a map.
• data.police.uk and postcodes.io (UK): crime and postcode lookups on the maps and on some of the free tools, made from the page rather than from our servers.

5.3 International Transfers

Some of our service providers are located outside the UK, mostly in the United States. Where that is a restricted transfer under Article 44 and a data processing agreement is in force with the supplier, it is made under the UK Addendum to the EU Standard Contractual Clauses — the instrument the UK actually uses, alongside the International Data Transfer Agreement (IDTA). Where we have not yet confirmed that agreement, the register says so for that supplier. Not every supplier involves a transfer at all: two of them process in the EU and the UK respectively.

The mechanism that applies to each individual supplier — and whether one is needed — is stated per supplier in the sub-processor register, rather than summarised here.

We retain your personal data for as long as necessary to provide our services:

• Account data: Retained while your account is active. When you delete your account we erase your personal data immediately rather than holding it for a recovery window, so deletion cannot be undone
• Property analyses and preferences: Retained while your account is active
• Transaction records: Retained for 7 years to comply with UK tax regulations
• Chat conversations: Retained while your account is active
• Analytics data: Retained by PostHog according to our project settings (currently up to 1 year). You can withdraw consent at any time, after which no new data is collected

After the retention period expires, we securely delete your personal data from our systems. Content captured from a property listing is kept only as long as the analysis needs it, and no longer than the limits below, whether or not your account is still active. Each 7-day and 30-day limit counts from when the property was first added. Deletion runs once a day, so content can remain for up to a day after its limit; if you capture an older property again, the new copy is deleted within a day.

• The raw page content your capture sent: deleted once the property is 7 days old. We keep it until then so that a report can be re-run or retried without another capture.
• The listing's description, key features and the snapshot the extraction was read from: deleted once the property is 30 days old.
• The name of the estate agent, as the listing gives it: deleted once the property is 30 days old. It is read from the listing when we extract its details, is never shown on a shared report, and is not used in our analysis or chat after that.
• The web addresses of the listing's photographs, floorplan and EPC graphic: deleted 3 days after the capture, at the next daily clean-up. They are used only for the Pro photo read described in 5.1, where they are sent to our AI provider as links.
• A capture held while you start a Pro refresh: unusable after 30 minutes and deleted within a day.
• Rankings of your saved list: deleted after 90 days. They hold no photo link.

For as long as you keep a property, we keep its address, asking price and property facts (such as bedrooms, type, tenure and floor area), our analysis and scores, and your own notes and chat. These are deleted when you delete the property or your account.

We do not display any listing photograph, floorplan or EPC graphic on HomeThink, and we never download, copy or host the images themselves. We no longer record a “main photo” link for a property or a ranking. Short phrases quoted from the agent's wording are kept as part of the analysis itself and are not covered by these limits.

You have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal retention requirements)
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Restrict Processing: Limit how we use your data in certain circumstances

To exercise any of these rights, contact us at support@mathersoftware.com. We will respond within 30 days of receiving your request.

We use essential cookies to operate HomeThink and optional analytics cookies (Vercel Web Analytics and PostHog) to understand how users interact with our service. Analytics cookies are only enabled with your explicit consent and can be withdrawn at any time via the cookie consent banner or Settings → Legal & Privacy → Manage Cookie Preferences.

For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

HomeThink is not intended for users under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately so we can delete it.

The suppliers above are our processors under Article 28. The full register — what each one does, where it is, what it receives and the transfer mechanism — is maintained at /legal/sub-processors. If we add one, we will update that page before they begin processing.

Almost everything HomeThink produces is automated. Two of those automated processes are about you rather than about a property, which is what data protection law calls profiling, so they are worth setting out plainly.

• Your preferences summary. We use AI to turn the preferences you enter — budget, areas, household, priorities — into a short written summary, so reports can be framed around what you told us matters.
• A fit score. Where you have given us preferences, a report can show how well a property matches them.

Neither produces a decision with a legal or similarly significant effect on you, so Article 22 of the UK GDPR does not apply: nothing here decides whether you get credit, a service, or a price. The property score is a different thing again — it is about the house, not about you.

How the property score is reached is deliberately open. It is calculated by a fixed formula rather than by the AI — the model is not permitted to output the score at all — and every report shows the weight of each category, what it contributed, and the evidence behind it. You can change the offer price on any report and watch the score recalculate.

You can object to profiling at any time by emailing support@mathersoftware.com, and you can clear the preferences it draws on from your account settings. If you think a report has something wrong, tell us — corrections you send are fed back into the analysis.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. Material changes will be communicated via email or prominent notice on our website.

Continued use of HomeThink after changes take effect constitutes acceptance of the updated policy.

If you have concerns about how we handle your personal data, please contact us first at support@mathersoftware.com. We will do our best to resolve the issue.

You also have the right to lodge a complaint with the UK's data protection authority:

For any questions about this Privacy Policy or how we handle your data, please contact us: