The short version

1. Who we are

Harthing is operated by Harther Ltd, a company registered in England and Wales (company number 17075829), with its registered office at 124-128 City Road, London EC1V 2NX.

When we say "Harthing," "we," "us," or "our," we mean Harther Ltd. When we say "you" or "your," we mean you, the person or entity that has registered for an account.

You can contact us at hello@harthing.co.uk.

For data protection queries specifically: privacy@harthing.co.uk.

2. Definitions

For clarity throughout this document:

• Service means the Harthing web application at app.harthing.co.uk and any related tools, features, or functionality we provide.
• Account means your registered Harthing account.
• Content means any data, documents, images, text, or other materials you upload, enter, or store through the Service.
• Property Data means information relating to properties you manage, including addresses, compliance records, maintenance logs, financial transactions, and tenancy details.
• Tenant Data means personal data relating to your tenants that you enter into the Service, including names, contact details, and tenancy information.
• Your Own Data means personal data about you rather than about your tenants, including your account details, your National Insurance number, your HMRC connection, and bank account and transaction data you import. Section 5.7 explains why this is treated differently from Tenant Data.
• Bank Data means account and transaction information imported into the Service from a bank account you connect through open banking.
• HMRC Data means your National Insurance number, the credentials that authorise the Service to connect to HMRC on your behalf, and the figures we prepare or submit to HMRC under Making Tax Digital.
• Accountability Record means the immutable, timestamped log of activity generated by your use of the Service.
• Evidence Bundle means an exportable compilation of your Accountability Record for a given property.
• Paid Period means the subscription period you have already paid for, whether that is a month or a year.
• Read-Only Period means the twelve months following the end of your Paid Period after cancellation, during which you can sign in, view, and export but not add or change anything. Section 7.9 sets this out in full.
• Account Closure means the point at which your ability to sign in ends, at the end of the Read-Only Period.

3. Eligibility and your account

3.1 To use Harthing, you must be at least 18 years old and legally capable of entering into a binding agreement.

3.2 You must provide accurate information when creating your account. If anything changes, such as your email address or your contact details, please update your account or let us know.

3.3 You're responsible for keeping your login credentials secure. If you think someone else has accessed your account, tell us immediately at hello@harthing.co.uk.

3.4 One person, one account. You may manage multiple properties from a single account, but you may not create multiple accounts for the same person or entity.

4. What the Service does (and what it doesn't)

4.1 What Harthing does:

Harthing is a property management and compliance record-keeping tool. It helps you:

• Store and organise compliance documents (gas safety certificates, EICRs, EPCs, deposit protection records, and similar)
• Log and track property maintenance
• Record and categorise financial transactions, including HMRC-aligned categories for Making Tax Digital
• Import account and transaction data from a bank account you connect, through an authorised open banking provider (see 4.3)
• Prepare and submit quarterly updates and end-of-period information to HMRC under Making Tax Digital for Income Tax Self Assessment (see 4.4)
• Build an immutable, timestamped Accountability Record of your property management activity
• Generate Evidence Bundles, which are exportable chronological records of activity for a given property

4.2 What Harthing does not do:

This is important, so we're going to be direct about it.

4.3 Open banking. If you choose to connect a bank account, that connection is provided through Yapily Connect Ltd, which is authorised and regulated by the Financial Conduct Authority as an account information service provider. Harther Ltd is not itself authorised by the FCA and does not hold your banking credentials. You authorise the connection with your bank directly, and the consent you give is subject to the wording shown to you at the point of connection.

The connection reads account and transaction data only. You can disconnect it at any time from within the Service. Disconnecting withdraws the underlying consent and stops any further data being read. Data already imported before you disconnect remains in your records, because it forms part of your financial history and your Accountability Record. If you want that imported data removed as well, contact us and we will handle it as a privacy request.

4.4 Making Tax Digital. If you choose to connect Harthing to HMRC, you authorise us to prepare and submit information to HMRC on your behalf under Making Tax Digital for Income Tax Self Assessment. This requires us to hold your National Insurance number and the credentials HMRC issues when you authorise the connection.

While your connection is active, you can correct figures for the current period and submit again. Whether an older period can still be amended is governed by HMRC's own time limits rather than by us.

You can disconnect at any time. When you disconnect, we delete the credentials we hold, and we can no longer submit anything on your behalf, including a correction. We cannot cancel or reverse anything at HMRC's end. If you want to remove an authorisation recorded on HMRC's own systems, you do that directly with HMRC.

5. Your content and your data

5.1 You own your Content. Uploading data to Harthing does not transfer ownership to us. Your documents, records, and data remain yours.

5.2 You grant us a licence to process your Content solely for the purpose of providing the Service. This licence is limited, non-exclusive, and lasts only for as long as your Content remains on the Service. We will not use your Content for any purpose beyond operating and improving the Service for you.

5.3 You are responsible for the accuracy of your Content. We don't review, verify, or validate what you upload. If you upload an expired gas safety certificate and mark it as current, Harthing will treat it as current. The responsibility is yours.

5.4 Tenant Data. When you enter Tenant Data into Harthing, you are acting as the data controller for that data under UK GDPR. Harther Ltd processes Tenant Data on your behalf as a data processor. The terms governing this relationship are set out in the Data Processing Schedule (Schedule 1) at the end of this document.

5.5 Telling your tenants. Because you are the controller of Tenant Data, the duty under UK GDPR Article 14 to inform your tenants that their personal data is being processed is yours, not ours. You warrant that you have given, or will give, your tenants the information the law requires. We may provide templates or tools to help you do this, but using them, and the accuracy of what you send, remains your responsibility.

5.6 Data portability. You can export your data at any time while you have access to the Service, including throughout the Read-Only Period described in 7.9. If you ask us for a copy after that, we'll provide your data in a standard, machine-readable format on request. Details of our data retention periods are set out in our Privacy Policy.

5.7 Your Own Data. Some of the personal data in the Service is about you rather than about your tenants: your account details, your National Insurance number, your HMRC connection, the figures we prepare and submit to HMRC, your Bank Data, and your subscription and payment records.

For that data, Harther Ltd is the data controller, not your processor, and Schedule 1 does not apply to it. This is not a change in how we handle it. It reflects the fact that we decide certain things about that data ourselves, including how long we keep it and how we meet our own legal obligations, which a processor acting only on your instructions could not do. Our Privacy Policy sets out what we hold, why, on what lawful basis, and for how long.

6. Acceptable Use Policy

Harthing is built for property management. Use it for that.

6.1 You agree to use the Service only for lawful purposes related to the management of residential property, and in accordance with these Terms.

6.2 You must not:

• Use the Service for any purpose unrelated to property management
• Upload, store, or transmit any content that is unlawful, harmful, threatening, abusive, harassing, defamatory, obscene, or otherwise objectionable
• Use the Service to harass, intimidate, or threaten any person, including your tenants
• Impersonate any person or entity, or misrepresent your affiliation with any person or entity
• Connect a bank account you are not entitled to access, or submit information to HMRC on behalf of a person who has not authorised you to do so
• Attempt to gain unauthorised access to any part of the Service, other users' accounts, or any systems or networks connected to the Service
• Use the Service to send unsolicited communications (spam) to tenants or any other person
• Interfere with or disrupt the Service or any servers or networks connected to it
• Use automated means (bots, scrapers, crawlers) to access the Service without our written permission
• Reverse-engineer, decompile, or disassemble any part of the Service

6.3 Prohibited content, Online Safety Act 2023 compliance

Harthing is classified as a user-to-user service under the Online Safety Act 2023. You must not upload, store, or transmit through the Service any content that constitutes illegal content as defined by that Act. This includes, but is not limited to:

• Child sexual exploitation and abuse material (CSAM), meaning any content that depicts, promotes, or facilitates the sexual exploitation or abuse of children. This is an absolute prohibition with zero tolerance. Any such content will be immediately removed and reported to the National Crime Agency.
• Terrorism content, meaning any content that encourages, promotes, or glorifies terrorism or terrorist activities as defined by the Terrorism Act 2000 and the Terrorism Act 2006.
• Content constituting a criminal offence, meaning any content the upload, sharing, or possession of which constitutes a criminal offence under the laws of England and Wales, including but not limited to content that incites violence, promotes hatred on the basis of protected characteristics, or facilitates fraud or other criminal activity.

6.4 Content reporting. If you encounter any content on the Service that you believe is illegal or violates this Acceptable Use Policy, please report it immediately to report@harthing.co.uk. We will review all reports promptly and take appropriate action, which may include removing content, suspending accounts, and reporting to law enforcement where required by law.

6.5 Our enforcement rights. We reserve the right to remove any Content and suspend or terminate any Account that violates this Acceptable Use Policy, without prior notice where we reasonably believe the content is illegal or poses an immediate risk. Where we become aware of CSAM or terrorism content, we are legally required to report it to the relevant authorities and to retain relevant information securely.

7. Payment and subscription

7.1 Pricing. Harthing is a paid subscription service, priced in bands according to the number of properties you manage. Current prices and bands are published at harthing.co.uk and form part of these Terms. All prices include VAT where applicable.

7.2 Free periods. Some accounts have a period of free access, the length of which depends on when and how you signed up. Where you have been offered a free period, its length is as stated to you at the time, and it runs from the date paid pricing goes live for your account. A free period is a benefit, not a trial: nothing is evaluated and nothing is withheld during it. When it ends, your subscription begins at the price then published for your band unless we have told you otherwise.

7.3 Billing. Subscriptions are billed in advance, monthly or annually depending on the plan you choose. You authorise us to charge your chosen payment method on a recurring basis until you cancel. Payments are processed by Stripe; we do not store your card details ourselves.

7.4 Changing bands. If the number of properties in your account changes so that you fall into a different band, your subscription moves to the price published for that band. This is not a price increase and 7.5 does not apply to it: the price list has not changed, your position on it has. We will tell you before a band change takes effect, and it will take effect from your next billing date rather than immediately.

7.5 Price changes. If we increase the published price for your band, we'll give you at least 30 days' notice and the option to cancel before the new price takes effect. If you cancel in that window, 7.7 and 7.9 apply as normal and you keep everything you have paid for.

7.6 Failed payment. If a payment fails, we'll let you know and give you a reasonable period to resolve it before restricting access. We will not treat a failed payment as a cancellation without telling you first.

7.7 Cancellation. You can cancel your subscription at any time. Cancellation takes effect at the end of the Paid Period, meaning the end of the month or the year you have already paid for, not immediately and not at the end of the calendar month. You keep full access until that date and we withdraw nothing before it. We don't do exit interviews, guilt trips, or dark patterns. If you want to leave, you leave.

Cancellation cannot be reversed from within the Service. If you change your mind, contact us.

7.8 Refunds. Because cancellation takes effect only at the end of the Paid Period, and because nothing is withdrawn before then, you receive the full period you paid for and no refund arises. This applies to annual plans as well as monthly ones. If you believe you've been charged in error, contact us and we'll sort it out.

7.9 What happens after you cancel

We don't close your account the day you stop paying, and we don't delete your records. Your Accountability Record may matter to you long after you have left, and it may matter to a tenant, a tribunal, or HMRC. What follows is what actually happens, in order.

(a) Until the end of your Paid Period. Nothing changes. You have full access to everything, exactly as before.

(b) The Read-Only Period, twelve months. At the end of your Paid Period your account becomes read-only for twelve months. You can sign in, view everything, and export everything, including your full Accountability Record and Evidence Bundles. You cannot add, edit, or delete anything.

At the start of the Read-Only Period, and not at the end of it, two connections end:

• Any connected bank account is disconnected and the underlying open banking consent is withdrawn. No further transaction data is imported. We cannot restore this connection. If you return, you connect your bank again yourself.
• Any HMRC Making Tax Digital connection is disconnected and the credentials we hold are deleted. No further submissions can be made. We delete only the access we hold; we do not cancel or change anything on HMRC's own systems.

(c) Advance warning. We will email you before the Read-Only Period ends, while you can still sign in and export, to tell you that your account is due to close and by when. Please keep your email address up to date, because this is the only warning you will get and you will not be able to receive an in-app message once the account has closed.

(d) Account Closure. At the end of the twelve months, your account closes and you can no longer sign in. Your records are not deleted at this point. They are retained in line with our Privacy Policy.

(e) Recovery window, ninety days. For ninety days after Account Closure, your account can be recovered. This is not self-service: you contact us and we do it. After that window, recovery is no longer available.

(f) Deletion. Only after all of the above can anything be permanently deleted, and deletion is never automatic. It requires a person at Harther to decide on it, and it remains subject to the retention periods in our Privacy Policy, which are longer than this sequence in most cases.

Two different clocks. These are easy to confuse, so to be explicit: how long you can sign in and look at your records is twelve months from the end of your Paid Period. How long we keep your records is set out in the Privacy Policy and is generally six years. The second is much longer than the first. Losing the ability to sign in does not mean your records have gone, and it does not stop you asking us for a copy.

7.10 Updated Terms and re-acceptance. Where we make a material change to these Terms, we may require you to accept the updated version before continuing to use the Service (see 14). If you have not yet accepted an update that we have required, we will pause billing rather than charge you for a service you cannot fully use. If the update remains unaccepted after a reasonable period, we will treat the subscription as cancelled and 7.7 and 7.9 will apply, meaning you keep what you have paid for and then enter the Read-Only Period as normal.

8. Intellectual property

8.1 The Service, including its design, code, branding, text, graphics, and underlying technology, is owned by Harther Ltd and is protected by copyright, trademark, and other intellectual property laws.

8.2 These Terms grant you a limited, non-exclusive, non-transferable, revocable licence to use the Service for its intended purpose during your subscription.

8.3 You must not copy, modify, distribute, sell, or create derivative works based on any part of the Service without our written permission.

8.4 "Harthing," "Letterlea," "Harther," and associated logos and marks are trademarks of Harther Ltd. You may not use them without our prior written consent.

9. Availability and changes to the Service

9.1 We aim to keep the Service available and reliable, but we don't guarantee uninterrupted access. Maintenance, updates, and circumstances beyond our control (internet outages, infrastructure failures, acts of God) may cause temporary disruption.

9.2 We may modify, update, or discontinue features of the Service from time to time. Where changes are material, we'll give you reasonable notice. We won't remove core functionality (the Accountability Record, Evidence Bundle, compliance document storage) without at least 90 days' notice.

9.3 Some features depend on third parties, including your bank, our open banking provider, and HMRC. Where one of those is unavailable, changes its rules, or withdraws access, the corresponding feature may be interrupted or discontinued. We'll tell you if that happens, but we can't guarantee the availability of a service we don't operate.

9.4 The Service is currently in its early stages. Features will be added, refined, and occasionally retired as the product develops. We appreciate your patience and your feedback. Both help us build something better.

10. Limitation of liability

10.1 To the maximum extent permitted by law, Harther Ltd's total liability to you for any claims arising from or related to these Terms or your use of the Service is limited to the amount you have paid to us in the 12 months preceding the claim.

10.2 We are not liable for any indirect, incidental, consequential, special, or punitive damages, including but not limited to loss of profits, data, business, or goodwill, however caused.

10.3 Specifically, and without limiting the above:

• We are not liable for any loss, penalty, fine, or adverse outcome arising from your reliance on information displayed in the Service, including compliance reminders, status indicators, or the Accountability Record
• We are not liable for the accuracy, completeness, or legal sufficiency of any Content you upload or any Evidence Bundle you generate
• We are not liable for any penalty, interest, or assessment arising from information submitted to HMRC through the Service, including where transactions have been categorised incorrectly or a submission is late, incomplete, or inaccurate
• We are not liable for the availability, accuracy, or completeness of data provided by your bank or by our open banking provider
• We are not liable for any failure to meet a regulatory deadline, comply with a statutory obligation, or satisfy a legal requirement, even if you used the Service in connection with that obligation

10.4 Nothing in these Terms excludes or limits our liability for death or personal injury caused by our negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be excluded or limited by law.

11. Indemnification

You agree to indemnify and hold harmless Harther Ltd, its directors, employees, and agents from and against any claims, damages, losses, liabilities, and expenses (including reasonable legal fees) arising out of or related to:

• Your use of the Service
• Your Content, including any Tenant Data you enter
• Your breach of these Terms
• Your violation of any applicable law or regulation
• Any claim by a third party (including a tenant) arising from your use of the Service

12. Termination

12.1 By you. You may stop using Harthing at any time by cancelling your subscription. Cancellation ends billing and starts the sequence set out in 7.9: full access to the end of your Paid Period, then twelve months read-only, then Account Closure, then a ninety-day recovery window.

Account Closure ends your ability to sign in. It does not by itself delete your records, which are retained for the periods set out in our Privacy Policy. If you want your personal data erased sooner, you can make an erasure request under UK GDPR and we will consider it against the limitations described in the Privacy Policy, including those that apply to the Accountability Record.

12.2 By us. We may suspend or terminate your account if:

• You breach these Terms (including the Acceptable Use Policy)
• You fail to pay subscription fees after reasonable notice
• We are required to do so by law or regulation
• We reasonably believe your use of the Service poses a risk to other users, to us, or to third parties

12.3 Where we terminate your account, we'll provide you with a reasonable opportunity to export your data, except where we are legally prohibited from doing so (for example, where content has been reported to law enforcement).

12.4 Sections that should survive termination (limitation of liability, indemnification, intellectual property, and data processing obligations) will survive.

13. Disputes

13.1 If you have a complaint about the Service, contact us first at hello@harthing.co.uk. We'd rather sort things out directly than through lawyers.

13.2 These Terms are governed by the laws of England and Wales. Any disputes that can't be resolved informally will be subject to the exclusive jurisdiction of the courts of England and Wales.

14. Changes to these Terms

14.1 We may update these Terms from time to time. If we make material changes, we'll notify you by email or through the Service at least 30 days before they take effect.

14.2 Where a change is material, we may require you to accept the updated Terms before you can continue using the Service or particular features of it. Section 7.10 explains what happens to your billing while an update is outstanding.

14.3 Continued use of the Service after changes take effect constitutes acceptance of the updated Terms. If you don't agree, you may cancel before the changes apply.

14.4 We'll keep previous versions of these Terms available on request, and we keep a record of which version you accepted and when.

15. General

15.1 If any provision of these Terms is found to be unenforceable, the remaining provisions continue in full force and effect.

15.2 Our failure to enforce any right or provision of these Terms does not constitute a waiver of that right or provision.

15.3 These Terms, together with our Privacy Policy, Cookie Policy, the pricing published at harthing.co.uk, and the Data Processing Schedule below, constitute the entire agreement between you and Harther Ltd regarding the Service.

15.4 You may not assign or transfer your rights under these Terms without our consent. We may assign our rights and obligations to an affiliate or successor.

Schedule 1: Data Processing Agreement

This Schedule forms part of the Terms of Use and sets out the terms on which Harther Ltd processes personal data on your behalf under UK GDPR Article 28.

1. Roles and scope

1.1 For the purposes of this Schedule:

• Controller means you, the landlord or property manager who has registered for a Harthing account and enters personal data about other people into the Service.
• Processor means Harther Ltd, which processes that personal data on the Controller's behalf in connection with providing the Service.

1.2 This Schedule applies to Tenant Data and to any other personal data about identifiable individuals other than the Controller that the Controller enters into the Service.

1.3 This Schedule does not apply to Your Own Data as defined in Section 2 and described in Section 5.7 of the Terms. For that data Harther Ltd is a controller in its own right, and the Privacy Policy governs it.

1.4 The Processor's role under this Schedule applies while the Controller's account is open, including throughout the Read-Only Period. Following Account Closure, Harther Ltd retains certain tenancy-related data as an independent controller for the periods set out in the Privacy Policy. The Privacy Policy describes this change of role.

2. Details of processing

2.1 Subject matter and purpose: The processing of personal data by the Processor is necessary for the provision of the Harthing property management service. The Processor stores, organises, retrieves, and presents the Controller's data within the Service, generates notifications and reminders at the Controller's direction, and produces exports and reports as requested by the Controller.

2.2 Duration: Processing continues for the duration of the Controller's subscription, through the Read-Only Period, and thereafter for the retention periods set out in the Privacy Policy.

2.3 Types of personal data processed:

• Tenant names
• Tenant contact details (email addresses, phone numbers, postal addresses)
• Tenancy details (start and end dates, rent amounts, deposit information)
• Correspondence records between Controller and tenants logged in the Service
• Any other personal data about third parties the Controller chooses to enter or upload

2.4 Categories of data subjects:

• Tenants of properties managed by the Controller
• Guarantors (where recorded by the Controller)
• Contractors or tradespeople (where recorded by the Controller)
• Any other individuals, other than the Controller, whose personal data the Controller enters into the Service

3. Controller obligations

3.1 The Controller warrants that it has a lawful basis under UK GDPR for processing the personal data it enters into the Service, and that it has provided (or will provide) appropriate notices to data subjects as required by law.

3.2 In particular, the duty under Article 14 to inform tenants and other third parties that their personal data is being processed rests with the Controller. The Processor does not discharge that duty on the Controller's behalf. Where the Processor makes templates or tools available to help, their use and content remain the Controller's responsibility.

3.3 The Controller is responsible for the accuracy of all personal data entered into the Service and for responding to data subject rights requests in a timely manner (with our assistance as set out below).

4. Processor obligations

4.1 Instructions. The Processor will process personal data only on documented instructions from the Controller. The Controller's instructions are defined by the Controller's use of the Service (uploading data, configuring settings, requesting exports). The Processor will not process personal data for any purpose other than providing the Service unless required by law, in which case the Processor will inform the Controller before processing (unless prohibited by law from doing so).

4.2 Confidentiality. The Processor ensures that all persons authorised to process personal data are bound by appropriate confidentiality obligations.

4.3 Security measures. The Processor implements appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (TLS) and at rest
• Additional envelope encryption for the most sensitive credentials and identifiers
• Access controls limiting who can access personal data to authorised personnel only
• Regular security reviews and infrastructure monitoring
• Secure hosting on AWS infrastructure in the United Kingdom

4.4 Sub-processors. The Processor uses third-party sub-processors to provide the Service, including cloud hosting and storage, authentication, transactional email and notifications, error monitoring, and automated document analysis. A current list of sub-processors is available on request from privacy@harthing.co.uk. The Processor will notify the Controller of any new sub-processors at least 14 days before they begin processing, giving the Controller an opportunity to object. If the Controller objects and the matter cannot be resolved, the Controller may terminate the Service.

4.5 Data subject rights. The Processor will assist the Controller in responding to requests from data subjects exercising their rights under UK GDPR (access, rectification, erasure, restriction, portability, objection). Where a data subject contacts the Processor directly about data the Controller controls, the Processor will direct them to the Controller and, where it can identify the Controller, tell the Controller that the request has been made.

4.6 Data breach notification. The Processor will notify the Controller without undue delay (and in any event within 72 hours of becoming aware) of any personal data breach affecting the Controller's data, providing sufficient detail for the Controller to meet its own notification obligations to the ICO and to affected data subjects.

4.7 Data Protection Impact Assessments. The Processor will provide reasonable assistance to the Controller in conducting Data Protection Impact Assessments where required.

4.8 Audit. The Processor will make available to the Controller all information necessary to demonstrate compliance with this Schedule and will allow for and contribute to audits and inspections conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice and scope limitations.

5. International transfers

5.1 The Processor will not transfer personal data outside the United Kingdom unless adequate safeguards are in place in accordance with UK GDPR (such as an adequacy decision, standard contractual clauses, or binding corporate rules).

5.2 Where sub-processors are located outside the UK, appropriate transfer mechanisms will be documented and made available on request.

6. Return and deletion of data

6.1 Export. The Controller can export its data at any time while it has access to the Service, including throughout the Read-Only Period, which runs for twelve months after the end of the Paid Period. After Account Closure, the Processor will provide the Controller's data in a standard, machine-readable format on request.

6.2 Retention rather than deletion on closure. Account Closure does not trigger deletion. Tenancy-related personal data is retained after Account Closure for the periods set out in the Privacy Policy, which are generally six years, because both the Controller and the data subjects may need that record during the limitation period under the Limitation Act 1980. Harther Ltd retains that data as an independent controller.

6.3 Deletion. Deletion occurs at the end of the applicable retention period, or earlier where the Processor accepts an erasure request, and is subject to the limitations described in the Privacy Policy including those that apply to the Accountability Record. Deletion is a deliberate act and is never automatic.

6.4 Backups. Where data has been deleted from active systems, backup copies are placed beyond use and are removed in accordance with the Processor's standard backup rotation.

7. Liability

7.1 The liability of each party under this Schedule is subject to the limitations set out in Section 10 of the Terms of Use.