Privacy Policy
Version 2026-06-03-v1 · For the VLP broker portal at vlp.london.
This policy explains how Vita Libertas Proprietas Ltd (“VLP”, “we”) collects and uses personal data in connection with the broker portal at vlp.london. We act as a data controller for VLP user accounts and the platform itself, and as a data processor on behalf of participating brokerages in respect of the lead data they register through the Service.
1. What data we collect
We hold the following categories of personal data:
- Account data. Your name, work email, work phone number, the brokerage you work for, role (broker / company admin / VLP admin), profile status (active / pending / suspended), account creation and approval timestamps, and the version of the Terms you accepted.
- Authentication data. Password hashes (we never see your password in clear) and session cookies, managed by our authentication provider Supabase.
- Lead data you submit.When you register a client through the Service, we hold the client’s first and last name, email, phone number, and any notes you add.
- Activity data. Holds you place, reservation forms you create, notifications you receive, signed-search alerts you opt into.
- Technical data. IP address, browser type, and access logs needed to operate the platform securely.
2. Where the data comes from
Most of the data we hold about you comes from you directly — when you accept an invite, create an account, or use the Service. Account-creation may also surface data provided by your brokerage’s admin (e.g. your email on an invite). Lead data is supplied by the broker who registered the client, not the client themselves.
3. Why we use it (lawful basis)
- Legitimate interest in operating a B2B platform — providing accounts, holds, lead deconfliction, transactional email notifications, security, anti-abuse, and analytics on aggregate platform usage.
- Contract performance where we provide paid subscriptions to brokerages.
- Consentfor optional features such as saved-search email alerts (you can pause or delete those at any time from the “Saved searches” page).
- Legal obligation for matters such as audit logs, anti-money-laundering record-keeping where applicable, and retention of transaction records.
4. Who we share it with
We use the following sub-processors to operate the Service. Personal data is only shared with them as necessary to deliver the Service, under written terms requiring confidentiality and appropriate security:
- Supabase — database, authentication, file storage. Data is stored in their EU region.
- Vercel — application hosting and edge delivery. Vercel is a US company; international transfers are covered by Standard Contractual Clauses.
- Resend — transactional email delivery (notifications, invites, alerts). Resend is a US company; international transfers are covered by Standard Contractual Clauses.
Lead data is shared with the broker who registered it, with that broker’s company admin (where applicable), and with VLP admins for support and dispute resolution. It is not shared with other brokerages or with developments.
We may also share data where required by law, or to investigate suspected fraud or abuse of the Service.
5. How long we keep it
- Account data: while your account is active, plus up to 12 months after termination for audit and dispute purposes.
- Lead data: while your brokerage is an active customer, plus up to 6 years where retention is necessary for UK anti-money-laundering or tax purposes.
- Reservation records: 6 years from the date of the reservation, in line with UK accounting / AML practice.
- Email and notification metadata: 12 months.
- Application and access logs: 30 days.
6. Your rights under UK GDPR
You have the right to:
- Access the personal data we hold about you;
- Correct data that is inaccurate or incomplete;
- Erase your data where there is no compelling reason for us to keep it;
- Restrict our processing of your data in certain circumstances;
- Object to processing based on legitimate interest;
- Port your data to another service in a machine-readable format;
- Withdraw consent for processing based on consent (e.g. saved-search alerts).
To exercise any of these rights, email hello@vlp.london. We aim to respond within 30 days. If you’re unhappy with how we handle your data you can complain to the UK Information Commissioner’s Office at ico.org.uk.
7. Cookies and similar technologies
The Service uses a small number of strictly-necessary cookies for authentication and session security. We do not use third-party analytics or advertising cookies. You can clear these cookies at any time from your browser settings; doing so will sign you out.
8. International transfers
Where personal data is transferred outside the UK to our sub-processors (Vercel, Resend — both US-based), we rely on Standard Contractual Clauses approved under UK GDPR.
9. Children
The Service is for professional users only and not intended for anyone under 18. We do not knowingly collect personal data from children.
10. Changes to this Policy
We may update this Policy from time to time. Material changes will require re-acceptance on next sign-in. The version of the Policy you accepted is recorded against your account.
11. About VLP
Vita Libertas Proprietas Ltd is a company registered in England and Wales. For postal correspondence please email hello@vlp.london for the current registered address.