Privacy policy

We collect what we need to run a property portal and nothing more. We do not sell your personal data, we do not share it with advertisers, and there are no advertising or analytics cookies on this site. Sellers and buyers talk through Bybricks rather than by handing out phone numbers. The emails we send are the ones you switched on, and every one of them has an off switch.

The rest of this page is the detail the law requires, and we have tried to write it in language that is actually readable.

Bybricks is operated by the operator named below, trading as Bybricks. We are the data controller for the personal data described here, which means we are the ones responsible for it and the ones you can hold to account.

Trading name

Bybricks

Operator

[TO BE CONFIRMED]

Address for correspondence

[TO BE CONFIRMED]

Privacy contact

privacy@bybricks.co.uk

General contact

hello@bybricks.co.uk

Almost all of it is data you type in yourself. Grouped by why it exists:

• Account and sign-in. Your email address and a password, which is stored hashed and which we cannot read. Our login provider also records the IP address and browser of each sign-in, to spot suspicious access.
• Profile. A display name, and a phone number if you choose to add one. Your phone number is never shown to other users. Contact stays in-platform.
• Listings. The property address, its details, the price, your key features and description, the EPC declaration, and the photos you upload. A live listing is public, along with your display name.
• Messages. What you write to a buyer or seller, who sent it, when, and whether it has been read. Only the two of you and, where we have to investigate a report, an administrator, can see a conversation.
• Saved homes and searches. The homes you hearted and the searches you saved, so we can show them to you and alert you.
• Verification. The outcome of identity and ownership checks on anyone listing a property, plus the provider’s reference for the check. We do not receive or store your identity documents.
• Reports and moderation. If you report a listing, the reason and details you give. For every listing, the results of our automated checks and any decision an administrator made.
• Agency data. If you register an agency: its name, company number, redress scheme and membership number, branch details and contact details, and credentials for the feed from your CRM.
• Technical data. Bybricks itself does not run any tracking, and our own application code does not log your IP address. Our hosting and database providers keep short-lived technical logs, which include IP addresses, so the service can run and stay secure.

We do not ask for, and do not want, special category data such as health or ethnicity. We collect nothing about crime at the property level and deliberately do not display crime statistics on listings.

UK GDPR requires us to name a lawful basis for each purpose. Where a purpose could honestly be argued either way, we have chosen the basis that leaves you with more control.

Your account and profile

For as long as your account is open. If you ask us to delete it, within 30 days.

Draft listings you never submitted

Deleted 12 months after you last touched them.

Listings that went live, and their photos

While the listing is on the site, then 12 months after it comes off, so that price history and sold records stay honest. Photos are deleted at the same point.

Messages

While the conversation matters to either side, then 24 months after the last message. Kept as a record, which is the point of in-platform messaging.

Saved homes and saved searches

Until you delete them, or your account closes.

Identity and ownership check results

6 years, as fraud-prevention records. We hold the outcome and a reference, never your documents.

Reports about listings, and moderation decisions

3 years after the report is closed.

Technical and login logs

Short-lived, and controlled by our hosting and database providers. Typically days to a few weeks.

Records we must keep by law, for example tax records

For as long as the relevant law requires.

We do not sell your data and we do not share it for advertising. We do use a small number of suppliers to run the service. Each one only gets what it needs, and each is bound by a contract that limits it to acting on our instructions. This is the full list, checked against our own code on 29 July 2026.

Beyond that list, we will share data where the law requires it, for example with the police or a regulator responding to a valid request, or with our professional advisers where we need advice on a dispute. If Bybricks were ever sold or transferred, your data would move with it, and we would tell you first.

Your account, listings, photos and messages are stored in London. Some of our suppliers are US companies, or serve the site from outside the UK, so some data does leave the country. Where it does, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which contractually binds the supplier to UK-equivalent protection. The table above says which suppliers this applies to. You can ask us for a copy of the safeguards we rely on.

There are no advertising cookies and no analytics cookies on Bybricks today. Nothing on this site tracks you across the web, and nothing profiles you.

The only cookies we set are the ones that keep you signed in. They are set by our login provider when you sign in, they identify your session, and without them the site cannot tell that it is you. Under the Privacy and Electronic Communications Regulations these are strictly necessary for a service you have asked for, so they do not need your consent. You can clear them in your browser at any time, which signs you out.

Two things load from other companies and are worth naming even though they set no cookies: the site’s typefaces come from Google Fonts, and map backgrounds come from CARTO on pages where you open a map. In both cases your browser fetches the files directly, so those companies see your IP address. Nothing else is sent.

If we ever add analytics, we will ask for your consent first, and we will update this section before it goes anywhere near the site.

When you submit a listing, automated checks run on it: whether the address resolves, whether the price looks sane against sold-price data, whether it duplicates an existing listing, whether an EPC has been declared, and how complete it is. Those checks can publish a listing, hold it for a person to review, or reject it. When one is rejected we tell you why in plain English, and "Fix and resubmit" on your account page puts it back in front of us. You can always ask a person to look at a decision.

UK GDPR gives you the following rights over your data. To use any of them, email privacy@bybricks.co.uk. We will respond within one month, and we will not charge you.

Get a copy of your data

We will give you a copy of the personal data we hold about you, free of charge.

Correct it

Most of it you can fix yourself on your account page. Ask us for anything you cannot reach.

Delete it

We will close your account and delete your data, except the narrow parts we are required to keep, for example fraud-prevention records and anything a live legal dispute concerns. We will tell you if that applies to you.

Take it elsewhere

Where we hold data on the basis of your consent or our contract with you, we will provide it in a structured, machine-readable format.

Object, or ask us to pause

You can object to anything we do on the basis of legitimate interests, and ask us to restrict processing while a complaint is being sorted out.

Withdraw consent

The alert emails run on consent. Switch any of them off on your account page, or use the link in the footer of any email. It takes effect immediately.

Not be subject to automated decisions

Our moderation checks are partly automated and can reject a listing. You can ask a person to look at it, and "Fix and resubmit" puts it back in front of us with the reason we gave.

Access to data is enforced in the database itself, row by row, rather than only in the website code, so a bug in a page cannot expose someone else’s drafts or messages. Listing photos sit in private storage and are served through short-lived links. Passwords are hashed by our login provider and are not readable by us. Traffic is encrypted in transit. No system is perfect, and if a breach ever put you at risk we would tell you and the ICO, as the law requires.

Bybricks is for adults. You need to be 18 or over to hold an account, and we do not knowingly collect data about children. If you believe a child has created an account, tell us and we will remove it.

If you are unhappy with how we have handled your data, please tell us first, at privacy@bybricks.co.uk, and we will try to put it right. You also have the right to complain to the UK’s data protection regulator, and you do not have to come to us first.

If we change how we use your data we will update this page and change the date at the top. Where a change matters to you, for example a new supplier receiving your data or a new purpose, we will tell you directly rather than relying on you noticing.