Privacy Policy

ChallengeMyRates uses personal data when you search for a property, upload a bill, create an account, ask for monitoring, buy a council letter, reserve a VOA service, appoint an agent, contact us or use the website. We are not part of, approved by or endorsed by the Valuation Office Agency (VOA), HMRC or a local council.

• Identity and contact data, including your user ID, email address and communications.
• Property and rating data, including address, postcode, UARN, rateable values, floor area, classification, comparables and information from a bill or document you provide.
• Service records, including answers, evidence, monitoring choices, council-letter orders, reservation terms and pricing versions, appointment readiness and status, manual-review outcomes and service emails.
• Payment records. Stripe receives card details. We store Stripe customer, SetupIntent and payment-method identifiers, not the full card number or security code.
• Security and technical data, such as IP address, coarse device type, browser, timestamps, referral source and records used to prevent abuse and diagnose failures.
• Optional analytics data only after you opt in. Browser analytics does not intentionally receive your raw email address, property address, scanned bill or appointment reminder token.

• Contract or steps you ask us to take: provide results, monitoring, orders, reservations, appointments, reviews and customer support.
• Legitimate interests: secure the service, prevent fraud, keep an auditable operational record, reconcile service events and improve the journey without overriding your rights.
• Consent: optional PostHog and Google Analytics, and marketing messages where consent is required. You can withdraw either choice.
• Legal obligation: keep records required for tax, accounting, disputes and regulatory compliance.

A correct council bill does not establish that a rateable value is correct. We use evidence to decide whether manual review, monitoring, a council letter or a possible VOA route is appropriate. Automated presentation does not guarantee a reduction and does not submit a VOA Check or Challenge.

The early-access validation ledger deduplicates a customer-and-property journey, records its source, evidence strength, accepted pricing and terms, coarse device category and the canonical reservation, appointment and review stages. It uses a one-way HMAC identifier for optional analytics; it is not a reversible email or address.

This private ledger is necessary to operate the limited cohort, prevent double counting, close it at the declared threshold and reconcile customer contact. It is not sent to PostHog without a separately stored analytics opt-in. Incomplete and excluded validation records are deleted 90 days after the cohort window; counted conversions are retained for 365 days after the cohort window for contact and reconciliation. The scheduled purge affects the validation ledger only.

• Supabase and Vercel: application hosting, database, authentication and operational performance.
• Stripe: payment processing and no-charge payment-method verification.
• Brevo: service and consented marketing email delivery.
• Google Gemini: bill/document extraction and support-chat processing when you use those features.
• PostHog (EU host) and Google Analytics: optional website/product analytics after opt-in.
• VOA and billing authorities: only where the service scope and your authority require it. An appointment is made by you in the official VOA service; we never ask for your Government Gateway credentials.
• Professional advisers, regulators, courts or law enforcement where necessary or required by law.

We do not sell personal data. Provider processing may involve transfers outside the UK. We require an applicable transfer safeguard, such as UK adequacy regulations or an approved contractual mechanism, where one is needed.

We keep operational customer, payment, appointment, review and communication records only for as long as needed for the service, security, disputes and applicable tax or legal duties. Marketing contact data is kept until you unsubscribe or it is no longer needed. Optional analytics follows the provider settings described in our Cookie Policy.

Some exact operational retention periods depend on the record and applicable legal duty. They must be approved in the launch retention schedule before this service is enabled; this policy does not create an indefinite retention right.

You may ask for access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent. These rights can be limited by applicable law. You can change cookie consent from the footer, unsubscribe from marketing, withdraw in the appointment journey, ask us to remove a saved payment method, and remove the agent in your VOA account to revoke external authority.

Email privacy@challengemyrates.co.uk. You may also complain to the Information Commissioner's Office.

Essential storage supports authentication, security, flow continuity, Stripe returns and private appointment resumption. Optional analytics is disabled until opt-in and stops after withdrawal. See our Cookie Policy.

We use access controls, signed flow sessions, short-lived private resume tokens, rate limits, server-side authority checks and encrypted transport. No internet service can promise absolute security. We will update this notice when the service or legal requirements materially change.

Email: privacy@challengemyrates.co.uk
Address: ChallengeMyRates, Farthing Corner, West Tytherley, Salisbury, SP5 1NR