Privacy Policy
Last updated April 2026
Who we are
DepositBack is a trading style of Gator Labs Limited (company number [to be confirmed]). Gator Labs Limited is the data controller for the purposes of UK GDPR. Contact: admin@getdepositback.co.uk.
What data we collect
When you use DepositBack, we collect the information you provide through our form. This includes your email address, tenancy details such as the start and end dates of your tenancy, the deposit amount, and the deposit protection scheme your deposit is held with. We also collect the details of each proposed deduction from your deposit, including the category, amount claimed, your landlord's stated reason, and your version of events. If you choose to upload photographs of the property, we collect those too. We also collect any correspondence with your landlord that you paste into the form.
Why we collect it
We collect your data for one purpose: to analyse your deposit dispute and generate your evidence pack. Your email address is used to associate your submission with your account and to send you your results. Your tenancy details, deduction information, and photographs are used to assess the strength of your case, generate your dispute letter, and prepare your submission guide.
How we process it
Your data is sent to Anthropic's Claude AI for analysis. Anthropic processes data under their API terms and does not use API inputs for model training. Your photographs and text are processed by the AI to generate your case assessment, detailed deduction analysis, dispute letter, and submission guide. The AI output is then stored alongside your submission so you can access your evidence pack.
Storage
Your data is stored securely on Supabase, which is hosted in the EU, with encryption at rest. Photographs you upload are stored in private cloud storage and are not publicly accessible. All data transmission between your browser and our servers is encrypted using TLS.
Retention
Submission data, including your tenancy details, deduction information, photographs, and evidence pack content, is retained for six months after creation and then automatically deleted. If you opt into outcome tracking so we can learn how your dispute was resolved, we retain your email address and outcome data for up to twelve months before deletion.
Payment data
Payments for the evidence pack are processed by Stripe. We do not store your card details or any payment credentials on our servers. We only store a reference to your Stripe checkout session so we can confirm your payment was successful. Stripe's own privacy policy applies to the processing of your payment information.
Your rights under UK GDPR
Under the UK General Data Protection Regulation, you have the right to access the personal data we hold about you, the right to request that we delete your data, the right to receive your data in a portable format, and the right to withdraw your consent to processing at any time. To exercise any of these rights, please contact us at admin@getdepositback.co.uk. We will respond to your request within 30 days.
Cookies
We use only essential functional cookies that are required for the site to operate correctly. These are necessary for things like maintaining your session while you complete the form. We do not use analytics cookies, advertising cookies, or any third-party tracking cookies.
Changes to this policy
We may update this privacy policy from time to time to reflect changes in our practices or for legal reasons. The date at the top of this page shows when the policy was last updated. We encourage you to review this page periodically.