Last updated: 12 March 2026
LandVale ("we", "our", "us") operates the website www.imperialestateai.uk (the "Service"). This page explains how we collect, use, and protect your personal data when you use our Service.
When you create an account and use the Service, we may collect the following:
Account information: your name and email address used to register.
Google account data: if you connect your Google account, we access your Gmail inbox and Google Calendar. For Gmail, we only read emails from senders that you have explicitly added to your list of trusted certificate providers — we never scan or access any other emails in your inbox. For Calendar, we only create and manage certificate expiry reminders.
Uploaded documents: PDF certificates and invoices you upload to the platform.
Bank account data: if you choose to connect a bank account via TrueLayer, we collect and store transaction data (amounts, dates, merchant names, categories) from that account. This requires your explicit consent and two-factor authentication before connecting, and is currently limited to TrueLayer's Sandbox test environment.
Property address searches: when you use the address finder to locate a property, the text you type is sent to LocationIQ (an address-lookup service) to find matching real addresses. If you pick a match, we store its coordinates so the property can be shown on a map — you can also just type your own address instead, which is never sent to LocationIQ.
Usage data: basic server logs (IP address, browser type, pages visited) for security and debugging purposes.
To provide the certificate management features of the Service.
To monitor your connected Gmail inbox for incoming property certificate emails and automatically extract certificate information on your behalf.
To create Google Calendar events reminding you of upcoming certificate expiry dates.
To send reminder emails to you or your tenants/contractors about certificate renewals, using your connected Gmail account.
To improve and maintain the Service.
If you connect your Google account, we request the following permissions:
gmail.modify: to read incoming emails from your trusted certificate providers and mark them as processed. We only access emails from senders you have explicitly added — never your full inbox.
gmail.compose: to send reminder emails on your behalf.
calendar.events: to create and manage certificate expiry reminders in your calendar.
userinfo.email: to identify which Google account is connected.
Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell, rent, or share your personal data with third parties, except:
Google APIs: to provide Gmail and Calendar integration (governed by Google's own privacy policy).
Google Cloud: we use Google Cloud infrastructure (Cloud Run, Cloud SQL, Cloud Storage) to host and store data securely within the EU (europe-west1 region).
Google Gemini AI: uploaded certificate PDFs are processed by Google Gemini AI to extract data. No personally identifiable information is used to train models.
TrueLayer: if you connect a bank account, TrueLayer facilitates that connection and the retrieval of transaction data on our behalf, governed by TrueLayer's own privacy policy.
LocationIQ: if you use the property address finder, the text you type is sent to LocationIQ to find matching addresses, governed by LocationIQ's own privacy policy.
Your data is retained for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us at the email below. Bank transaction data specifically is retained for a maximum of 24 months and is automatically deleted after that; disconnecting a bank account deletes its transaction data immediately. This retention policy is reviewed at least annually, and whenever we add a new data source or new category of sensitive data.
All data is stored on Google Cloud infrastructure within the EU. Passwords are hashed and never stored in plain text. All connections use HTTPS. Google OAuth tokens are stored securely and never exposed to the frontend. Bank account access tokens and transaction details are encrypted at rest, and connecting a bank account requires two-factor authentication in addition to your regular login.
Under UK GDPR, you have the right to access, correct, or delete your personal data. You can disconnect your Google account at any time from the Integrations page, which revokes our access to your Gmail and Calendar.
For any privacy-related questions or data requests, please contact: victor.melatti01@gmail.com
© 2026 LandVale. All rights reserved.