How we handle personal data — both on this website and inside the software we provide to letting agencies.
Last updated: 12 September 2026
The short version. For this website and our own business contacts, we decide how data is used, so we are the "controller". For the property, tenant and landlord records inside an agency's workspace, the agency decides — we only act on their instructions, so we are the "processor". Those two roles carry different duties, and this policy keeps them separate throughout.
Quantum Reach Ltd, company number 15874185, registered in England and Wales at 42-46 Cheapside, Luton, LU1 2HN. We trade as Quantum Reach and operate the website at qreach.ai and the Quantum Suite, Quantum Ledger, Quantum Feed and AI Receptionist products.
For data protection questions, write to hello@qreach.ai or use the postal address above. We are registered with the Information Commissioner's Office under registration number ZC207641.
This matters, because it determines who you should contact about your data.
In that second case the agency is the controller. The data lives in a database and storage account provisioned for that agency, and we act only on their instructions. If you are a tenant, landlord, guarantor, contractor or caller and you want to access, correct or delete your information, contact the agency you deal with. If you contact us instead, we will pass the request to them and tell you we have done so, but we cannot action it ourselves.
Standard technical information needed to serve the site securely, including IP address, browser type and the pages you request. With your consent, we also collect anonymised analytics about how the site is used. See our Cookie Policy.
Your name, email address, phone number (if given), your agency's name, the approximate size of your portfolio, which products you are interested in, and anything you choose to tell us about how you work. If you book a meeting, our scheduling provider also records the time you chose and any details you enter on their form.
Account details for each member of your staff who logs in (name, work email, role), your billing and bank details for paying and invoicing, the documents and agreements we exchange with you, and our correspondence and support history.
Whatever your agency chooses to record. In practice that typically includes property addresses; landlord, tenant and guarantor names and contact details; tenancy and rent records; inspection reports, photographs and condition notes; compliance certificates; right-to-rent check records; deposit records; contractor details; and, where the AI Receptionist is enabled, caller details, call summaries, transcripts and (only if the agency switches it on) call recordings.
Some of that is special category data or data about criminal offences — for example immigration-status evidence gathered for right-to-rent checks, or health information a caller volunteers to explain an urgent repair. Where our software holds such data, the agency is responsible for identifying its lawful basis and the additional condition required under UK GDPR Article 9 or 10.
Where we are the controller, we rely on the following:
| What we do | Lawful basis |
|---|---|
| Run and secure this website | Legitimate interests — keeping our site available and protected from abuse |
| Respond to your enquiry and arrange a walkthrough | Steps taken at your request before entering a contract |
| Provide the products you have subscribed to, and support them | Performance of our contract with your agency |
| Invoice you and keep our accounts | Legal obligation, and our legitimate interest in being paid |
| Send service messages about changes, incidents or renewals | Performance of our contract |
| Analytics about how the website is used | Your consent, which you can withdraw at any time |
| Marketing emails about our products | Your consent, or our legitimate interest where you are an existing business customer — every message carries an unsubscribe link |
| Defend legal claims and meet regulatory duties | Legal obligation, and our legitimate interest in establishing or defending claims |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and concluded it is not. You can ask us for that assessment, and you can object — see your rights.
Where we are the processor, our basis for processing is our client agency's written instructions, recorded in the contract between us.
Two parts of our software use artificial intelligence, and we want to be plain about both.
When an inspector dictates a room description, the transcript is sent to our AI provider to be turned into structured, tidied report text. The provider processes it to return that result and does not use it to train its models. The condition grades themselves are set by the inspector, not the AI, and every suggested edit is shown for approval before it is applied.
Where an agency enables it, incoming calls are answered by an AI voice agent, which captures the caller's details and the reason for the call and creates a structured record. Callers are told at the start of the call that it is being handled this way and, where recording is enabled, that it may be recorded.
We do not make automated decisions that produce a legal or similarly significant effect about anyone. The software categorises and prioritises enquiries to help staff triage them; the decisions that follow — who gets a viewing, whether a tenancy proceeds, whether a deposit is retained — are made by people at the agency.
We do not sell personal data, and we do not share it for anyone else's marketing. We use the following providers to run our service. Each is bound by a contract that limits them to our instructions.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, login and file storage for each agency workspace | AWS, EU (Ireland) |
| Cloudflare | Website hosting, content delivery and security | Global edge network |
| Anthropic | AI processing of dictated inspection notes | United States |
| Retell AI | The AI voice agent that answers calls — speech recognition, the conversation itself, transcription, call summaries, and storage of call recordings where an agency has enabled them | United States |
| Twilio | The phone numbers, and carrying calls between the public telephone network and the voice agent | United States |
| Calendly | Booking walkthrough meetings | United States |
| Website analytics (only with your consent) and web fonts | United States |
Several of these providers are international groups that contract with us through a UK or European entity while processing data in the United States. The "where" column above describes where data is actually processed, not which company we contract with. Wherever data leaves the UK, the safeguards in section 7 apply.
We may also share personal data with our professional advisers, or where we are required to by law, a court, or a regulator. If our business is sold or reorganised, data may transfer to the buyer, who would remain bound by this policy.
Client agencies can ask us for our current sub-processor list and for a data processing agreement.
Agency workspace data — the property, tenant, landlord and financial records — is held in a database and storage account provisioned for that agency on infrastructure in the European Union (Ireland). We do not keep separate copies of it on our own devices.
Some of our providers are based outside the UK, as shown in the table above. Where personal data is transferred outside the UK, we rely on the UK's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for details of the mechanism used for a particular transfer.
| What | How long |
|---|---|
| Enquiries that do not become clients | Up to 24 months from our last contact, then deleted |
| Client account and contract records | For the life of the contract, then 6 years, to cover the limitation period |
| Invoices and accounting records | 6 years after the end of the relevant financial year, as tax law requires |
| Website analytics | Up to 14 months |
| Agency workspace data | Set by the agency, not by us. On termination we give a reasonable window to export before deletion. |
No system is perfectly secure. If a breach occurs that is likely to result in a risk to people's rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, and tell those affected where the risk is high. Where we are the processor, we will notify the agency without undue delay so that they can meet their own obligations.
Under UK data protection law you have the right to:
To exercise any of these, email hello@qreach.ai. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. Remember that for data inside an agency's workspace you should approach the agency, not us.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
We use very few, and none for advertising. Analytics only load if you agree. The detail, including how to change your mind, is in our Cookie Policy.
Our products are sold to businesses and are not directed at children. We do not knowingly collect data from children through this website. An agency's records may include the names or ages of children living at a property; that data is the agency's responsibility as controller, and our software holds it on the same terms as the rest of their workspace.
We may update this policy as our products or the law change. The date at the top always shows the current version. If we make a material change, we will tell client agencies by email or through the product before it takes effect.
Data protection: hello@qreach.ai
Anything else: hello@qreach.ai
Post: 42-46 Cheapside, Luton, LU1 2HN
