Privacy Policy
Last updated: 20 October 2026
This policy explains how TakeFlight Digital Ltd (“TakeFlight”, “we”, “us”) uses personal data when you visit our website, contact us, or use TakeFlight. It replaces the policy dated 16 July 2026.
The short version
- We are TakeFlight Digital Ltd. We make software for UK property professionals.
- If you visit our website, contact us, or use TakeFlight as a customer, we decide how your data is used, and this policy explains it.
- If your details are in TakeFlight because a property professional put them there, that business decides how your data is used, not us. Please ask them. See section 3.
- We do not sell your data. We do not use your data, or anything our customers upload, to train artificial intelligence models.
- Our website and our app use no advertising or analytics cookies. (Our earlier service is different, see section 15.)
- You can contact us about any of this at support@takeflight.digital, and you can complain to us or to the Information Commission, the UK’s data protection regulator. See section 14.
1. Who we are
TakeFlight Digital Ltd, a company registered in England and Wales, company number 16001896, registered office 2 Orchard Place, Nottingham Business Park, Nottingham, NG8 6PX.
We are registered with the Information Commission (formerly the Information Commissioner’s Office), registration number ZC204129.
We have not appointed a Data Protection Officer, because we are not required to. Privacy questions go to support@takeflight.digital.
2. The two different roles we play
This decides who you should speak to.
We are the controller (we decide what happens to your data) when you visit our website, contact us, enquire about TakeFlight or become our customer. The same applies to the account, sign-in and security records of everyone who uses a customer’s workspace. Sections 4 to 11 cover this, and section 15 covers our earlier service.
We are the processor (we act only on someone else’s instructions) for everything our customers put into their workspace about their own clients and contacts. That includes the emails and texts a workspace sends to its contacts, and the workspace’s own activity log, which its owners and admins can read. Section 3 covers this.
3. If your details are in TakeFlight because a property professional put them there
If you have dealt with a property sourcer, deal packager, agent or investor who uses TakeFlight, they may hold your details in it. That can include your name and contact details, notes about your dealings with them, emails and texts they have sent you and your replies, and documents you gave them. This can include identity documents such as a passport, driving licence or proof of address, which they may be legally required to collect and keep.
That business, not TakeFlight, decides why your data is held and what is done with it. They are the controller. We only store and process it on their instructions, under a written contract that meets Article 28 of the UK GDPR.
To see, correct or delete that data, contact the business directly. We cannot act on your request ourselves, because it is not our data to decide about. If you contact us, we will pass your request to them promptly and help them respond.
To stop messages from that business: every text sent through TakeFlight lets you reply STOP. Emails about new deals, or news and updates, carry an unsubscribe link that stops that kind straight away, plus an “Email preferences” link. A personal email written to you by someone at the business carries the “Email preferences” link instead, unless it’s a reply to a message you sent them in the last 90 days. On the preferences page you can stop one kind of email, or stop all emails, texts, calls and WhatsApp messages from that business through TakeFlight. All of these work at once. You can also ask the business directly.
We do not use anything our customers upload for our own purposes. We do not sell it, share it for marketing, or use it to train artificial intelligence models.
If you do not know which business holds your data, or they will not respond, contact us at support@takeflight.digital and we will help you find who to approach where we can. You can also complain to the Information Commission (section 14).
4. What we collect, why, and on what legal basis
You have to give us your name, email address and billing details to open and pay for an account. Without them we cannot provide the service. Everything else is optional.
4.1 Running your TakeFlight account
Data: your name, work email address, telephone number, business name and address, what kind of business you run (which you tell us when you sign up), your role, your profile picture if you add one, your sign-in and two-factor authentication records, and your settings.
Why: to give you the service, keep your account secure, and support you.
Legal basis: performance of a contract with you, or steps you asked us to take before entering one. Where you are a colleague of our customer rather than the person who signed up, our basis is legitimate interests: our interest in providing the service our customer has asked us to provide to its team.
Where it comes from: mostly from you. If a colleague invited you, we received your email address and the role they gave you from them. If you choose to sign in with Google or Microsoft, they send us your name, your email address and whether it is verified, an identifier for your account with them and, where you have one, a link to your profile picture.
If you are a sole trader registering a phone number in TakeFlight, Twilio collects your photo ID directly to register the number. We do not keep it.
4.2 Taking payment
Data: your billing name and address, the business’s VAT details, subscription and invoice records, and a reference to your payment method. We never see or store your full card number. Stripe handles card details.
Why: to bill you and keep proper financial records.
Legal basis: performance of a contract, and legal obligation for the accounting and tax records we must keep.
4.3 Supporting you
Data: your messages to us, our replies, and anything you choose to include.
Why: to answer you and improve the service.
Legal basis: performance of a contract, and legitimate interests: our interest in keeping a record of what was asked and answered.
4.4 Enquiries and marketing
Data: your name, work email address, phone number, business name, and what you told us you were interested in, for example through a form on our website.
Why: to reply to you, and to tell you about TakeFlight.
Legal basis: legitimate interests (our interest in marketing our own business software to businesses likely to want it), or consent where you gave it. See section 5. You can object to direct marketing at any time and we will stop.
4.5 Keeping the service secure and working
Data: technical logs, including IP address, browser and device information, pages accessed, error reports, and records of sign-in attempts, emailed sign-in codes and two-factor authentication changes.
When you sign in or sign up, a bot check (Cloudflare Turnstile, see section 7) looks at your IP address and basic browser information to tell people from automated attacks. When you set a password, we check it against lists of passwords exposed in other organisations’ breaches. Only the first five characters of a scrambled (hashed) form of your password leave our systems, which cannot reveal the password or identify you.
Why: to detect and prevent fraud, abuse and unauthorised access, to fix faults, and to keep the service available.
Legal basis: legitimate interests: our interest, and our customers’ interest, in a secure, working service.
4.6 Understanding how the service and website are used
On our website we count visits with Cloudflare Web Analytics. It uses no cookies, doesn’t follow you across other sites and doesn’t identify you. The app uses no analytics tools.
Legal basis: legitimate interests, for statistics that identify nobody. If we ever add analytics that use cookies, we will update this policy and ask for your agreement first.
4.7 Meeting our own legal obligations
Data: whatever the obligation requires, typically financial records and correspondence.
Legal basis: legal obligation.
4.8 Automated decision-making
We do not make decisions about you by automated means that have legal effects on you or affect you in a similarly significant way. TakeFlight produces automated analysis of properties and deals, which is not a decision about a person.
4.9 Our legitimate interests
Where we rely on legitimate interests, we have assessed whether our interest is outweighed by your rights, and written the assessment down. You can ask us for a summary at support@takeflight.digital.
4.10 Connecting your own Gmail or Outlook account
A member of a workspace can connect their own Google (Gmail or Google Workspace) or Microsoft (Outlook or Microsoft 365) email account. Emails they send from TakeFlight then go out from their own address and appear in their own Sent folder. Connecting is optional, each person chooses it for themselves, and disconnecting is one click in Settings.
What we get from Google or Microsoft: the email address of the account, and a pair of access keys (called tokens) that let TakeFlight send email as that person. The permission we ask for is only to send email (Google’s “send email on your behalf” permission, and Microsoft’s Mail.Send). We do not ask to read, search, change or delete anything in the mailbox, and we do not read your inbox. If we later offer to show your replies inside TakeFlight, we will update this section, and ask for your permission, before that is switched on.
What we do with it: we use the access keys only to send the emails that the person writes in TakeFlight, at the moment they send them. We keep a record of each send (which contact, when, from which connected account, and whether it went) as part of the workspace’s data. We also keep a copy of each email (its subject and words) in the workspace’s Messages inbox, so the team can follow the conversation. That copy is part of the workspace’s data (section 3) and is deleted with it.
How we protect it: the access keys are stored encrypted, with the key to decrypt them kept outside our database. They are never shown on screen or written to our logs, our staff cannot read them, and only our servers use them, only to send.
Who we share it with: nobody. We do not sell it, use it for advertising, or use it to train artificial intelligence models. No one at TakeFlight reads it unless you ask us for support and agree to it, or the law requires it.
How long we keep it: the access keys are deleted when the person disconnects, when their access to the workspace ends, and when the workspace is deleted. When the person disconnects in Settings, we also ask Google to cancel the permission. In the other cases our copy of the keys is deleted, but the permission stays on the person’s own Google or Microsoft account until they remove it, which they can do at any time from their Google Account’s security page or their Microsoft account’s app permissions page. The connected account’s email address stays in the workspace’s record of the connection, without any key, until the workspace is deleted, so the workspace can see who connected what.
Legal basis: performance of the contract with the workspace, and the person’s own choice to connect.
Google user data. TakeFlight’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google user data is used only inside the TakeFlight platform. It is never sent to HighLevel, our earlier service, or any other provider, except to Google itself to send the email.
5. Marketing emails
If you are an individual, a sole trader, or a partnership that is not a limited liability partnership, we only send you marketing emails if you have agreed to them, or if you bought from us or talked to us about buying and we are telling you about similar things, having given you the chance to say no.
If you are a limited company, a limited liability partnership or a public body, we may send you marketing emails about our software without your agreement.
Every marketing email we send says who we are and gives you a way to stop them, and we act on it at once. You can also email support@takeflight.digital.
Stopping marketing does not stop service messages, such as a password reset, a billing notice or a notice that your subscription is ending.
6. Cookies and similar technologies
In the TakeFlight app
The app only uses what is strictly necessary for the service you have asked for, so it does not ask for consent:
| What | What it does | How long it lasts |
|---|---|---|
Sign-in cookies (names beginning sb-) | Keep you signed in and your session secure | Until you sign out, or up to 400 days if you stay signed in |
| The bot check on the sign-in and sign-up pages (Cloudflare Turnstile) | Tells people from automated attacks | For the check only |
| Your appearance choice, kept in your browser’s storage | Remembers light or dark mode, if you pick one | Until you change it or clear your browser |
| Your progress through sign-up, kept in your browser’s storage | Stops a refresh losing your answers. Your password is only held encrypted | Until you close the tab |
| The screen you opened a property from, kept in your browser’s storage | Lets the back button return you there | Until you close the tab |
On our website
Our website sets no analytics or advertising cookies. Our hosting provider, Cloudflare, may set a strictly necessary cookie to protect the site from attacks. If you start a chat on our support page, Featurebase, our support tool, stores what it needs in your browser to keep your conversation together. Our Cookie Policy has the details.
7. Who we share your data with
We share personal data with the providers we rely on to run TakeFlight. Each is bound by a written contract that limits them to acting on our instructions, except where this section says a provider also acts for itself.
| Who | What they do | Where they process data |
|---|---|---|
| Supabase | Our database, sign-in and file storage | European Union |
| Vercel | Hosting the app | United States |
| Cloudflare | Hosting our website, and the bot check on our sign-in and sign-up pages | Global network (a US company) |
| Resend | Sending our own emails (sign-up confirmations, sign-in codes, password resets, security alerts and team invitations). Separately, sending the emails our customers write to their own contacts, where we act for the customer | United States |
| Twilio | Sending and receiving the texts our customers exchange with their own contacts, where we act for the customer, and registering the business behind each phone number | United States |
| Google and Microsoft | Only when a member connects their own email account: sending the emails they write from their own address (section 4.10) | Global networks (US companies) |
| Stripe | Payments and subscriptions | United States and its group |
| HighLevel (LeadConnector) | Receiving the enquiries sent through our website’s forms, and running our earlier service (section 15) | United States |
| Featurebase | Our support chat, help pages and feedback boards | European Union |
| Property data suppliers | Receive property addresses, postcodes and areas so we can show property information. Never names or contact details | United Kingdom |
The tools we run the company with. We also use Google Workspace (email and documents), Xero (accounting), Notion, Slack and Atlassian (team workspace and planning), GitHub (our code), Anthropic’s Claude (an AI assistant our team works with), Ahrefs (how our website appears in search), and Redis and Inngest (background processing). These hold personal data only as part of running the business, for example our own email, invoices or a support conversation. They are based in or process data in the UK, the European Union, the United States or, for Ahrefs, Singapore.
Cloudflare acts for us when it runs the bot check, and separately in its own right when it uses that information to improve the bot check. Its Turnstile Privacy Addendum explains this: cloudflare.com/turnstile-privacy-policy.
Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal obligations, under its own privacy policy.
OpenFreeMap is not our provider. Your browser loads the map on our sign-in page directly from it, in the European Union, so it receives your IP address, as any website you visit does. It says it keeps no IP addresses in its normal logs and uses no cookies.
If you sign in with Google or Microsoft, they are not our providers. You have your own account with them, they send us the details in section 4.1, and their own privacy policies cover what they do.
We may also share data with our professional advisers, with a buyer if we sell the business, and with a regulator, court or law enforcement where the law requires it.
We do not sell personal data, and we do not share it for anyone else’s marketing.
8. Sending data outside the UK
Our database is stored in the European Union, which UK law recognises as protecting personal data adequately. Some of our providers process data elsewhere, mainly in the United States. When that happens, we make sure one of the safeguards UK law recognises protects it: UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework where the provider is certified; the International Data Transfer Agreement; or the EU Standard Contractual Clauses with the UK Addendum.
You can ask us which applies to a particular provider, and for a copy, at support@takeflight.digital.
9. How long we keep things
| What | How long | Why |
|---|---|---|
| Your account and profile | While your subscription is active, then deleted 90 days after it ends | The same period as your workspace’s data, so you can restart |
| Data your business put into TakeFlight | Read-only for 90 days after the subscription ends, so it can be viewed and exported, then deleted | Our Terms |
| Billing and invoice records | 6 years from the end of the financial year they relate to | Tax and accounting law |
| Emailed sign-in codes | 10 minutes, and unusable after five wrong tries | Security |
| Access keys for a connected Gmail or Outlook account | Until the person disconnects, their access to the workspace ends, or the workspace is deleted | They exist only to send the person’s emails |
| The address of a connected Gmail or Outlook account | With the workspace’s data, until the workspace is deleted | So the workspace can see who connected which mailbox |
| Our own record of security events on accounts, such as our support team resetting two-factor authentication | Reviewed at least once a year, and deleted once older than 3 years | To investigate misuse of an account |
| Support conversations | Reviewed at least once a year, and deleted once 3 years have passed since the last contact | To keep a usable record of what was asked and answered |
| Complaints about how we use personal data, and their outcome | Reviewed at least once a year, and deleted once 3 years have passed since the complaint closed | The law requires a record of complaints |
| Website enquiries and marketing contacts | Until you opt out. Otherwise reviewed at least once a year, and deleted after 3 years without contact | So we do not hold data we are not using |
| Security and access logs | Up to 12 months | Long enough to investigate an incident |
| Backups | Overwritten on the normal backup cycle | Technical necessity |
A workspace’s own activity log is part of the business’s data (section 3) and is deleted with it.
Where we must keep something longer to comply with the law, defend a legal claim or meet a regulator’s requirement, we will.
10. Your rights
You have the right to:
- be told how your data is used (this policy);
- get a copy of the data we hold about you;
- have it corrected if it is wrong or incomplete;
- have it deleted, in certain circumstances;
- restrict how we use it, in certain circumstances;
- receive it in a portable form, or have it sent to another provider, where we use it based on consent or a contract and by automated means;
- object to our use of it based on legitimate interests, on grounds relating to your situation, and object to direct marketing at any time;
- not be subject to a decision based solely on automated processing that significantly affects you; and
- complain to us and to the Information Commission (section 14).
Where we rely on your consent, you can withdraw it at any time, as easily as you gave it. That does not affect what we did before.
To use any of these rights, email support@takeflight.digital. We will respond within one month. If we need to confirm who you are, or need more detail to find what you asked for, the month starts when we have it. If your request is complex, or you have made several, we may extend this by up to two further months, and we will tell you within the first month if so.
There is no charge, unless a request is clearly unfounded or excessive.
If your data is in TakeFlight because one of our customers put it there, these requests go to them, not us. See section 3.
11. Security
We protect personal data with measures including encryption in transit and at rest; separation between customers enforced by the database itself; role-based access; two-factor authentication, which workspace owners and admins must use and anyone can switch on; a fresh two-factor check before sensitive changes, such as removing a team member; a bot check and attempt limits on sign-in; screening of new passwords against known breaches; least-privilege access for our own staff; and confidentiality obligations on everyone who works on TakeFlight. Documents uploaded to TakeFlight are held in private storage that cannot be reached publicly.
No system is completely secure. If a breach happens that is likely to put your rights at risk, we will tell you and the Information Commission as the law requires.
12. Children
TakeFlight is business software and is not meant for anyone under 18. We do not knowingly collect data about children. If you think we have, tell us and we will delete it.
13. Changes to this policy
We may update this policy. If a change materially affects how we use your data, we will tell customers by email and update the date at the top.
14. Contact and complaints
Email: support@takeflight.digital
Post: TakeFlight Digital Ltd, 2 Orchard Place, Nottingham Business Park, Nottingham, NG8 6PX
Complaints to us. If you are unhappy with how we have used your personal data, tell us at support@takeflight.digital. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you informed, and tell you what we decide.
Complaints to the regulator. You can also complain at any time to the Information Commission, the UK’s data protection regulator, which replaced the Information Commissioner’s Office on 30 September 2026: ico.org.uk or 0303 123 1113.
15. Our earlier service
Until every customer has moved to our new platform, TakeFlight’s earlier service keeps running on a platform provided by HighLevel (also known as LeadConnector), a US company, which stores that service’s data for us. It collects similar account, billing and support information, for the same purposes and on the same legal bases as sections 4 and 5 describe. For what customers put into it, the roles in sections 2 and 3 are the same.
The earlier service runs on HighLevel’s own pages, which set HighLevel’s own cookies to keep you signed in and the service working. Providers it uses include HighLevel, Stripe, Google, Twilio and WhatsApp, and integrations a customer chooses to connect are governed by those providers’ own terms. Data sent to HighLevel in the United States is protected by one of the safeguards in section 8.
We keep the earlier service’s data while you are a customer of it. When your account moves to the new platform, we copy across what you need and delete the earlier service’s copy within 90 days of the move. If you leave without moving, we delete it within 90 days of your account ending.