Privacy Policy

AI Office is a private operations dashboard operated by Chris Stallard for managing rental property cases, correspondence, and related administrative tasks. It is not a public product — access is restricted to registered users Chris has explicitly invited.

You can reach the data controller using the contact form at the bottom of this page.

We process two broad categories of personal data:

• Third-party contact data — names, email addresses, phone numbers, organisations, and roles of people referenced in property cases (tenants, letting agents, contractors, ombudsman officers, and similar), together with the correspondence and case notes that mention them.
• Registered user account data — for people who log in to the dashboard: name, email address, passkey/password credentials, session metadata (IP address, user agent, device label, login timestamps), and an audit trail of actions taken in the system.

Incoming email is read by an AI system. It sorts new messages into groups, matches each one to a property, case or contact, notes its key points and any attached documents, and proposes what should be done with it.

Nothing is processed until a registered user approves the AI’s proposed plan. Once it is approved, the AI records the agreed updates, for example a status change, a deadline, or a link between an email and a case. Every update is listed in a processing log, where it can be checked and corrected. The AI may also write draft replies. Drafts are saved for a registered user to review, edit and send. The system never sends email on anyone’s behalf without that review step.

• To track and resolve property management cases and correspondence on the property owner’s behalf.
• To draft and route replies for human review, and to flag deadlines, overdue payments, and escalations.
• To authenticate registered users and keep the dashboard secure (passkeys, session and lockout tracking, audit logging).
• To improve the accuracy of the AI triage and drafting process over time.

Where UK/EU data protection law applies, third-party contact data referenced in correspondence is processed under legitimate interests — managing rental properties and resolving disputes or service issues with the people involved, in a way that is proportionate and does not override those individuals’ own rights and interests. Registered user account data is processed under legitimate interests (running a secure, auditable internal tool) and, for authentication credentials, as necessary to provide the account itself.

Information is shared only with the following categories of service providers, strictly to operate the system:

• Email provider — receives and stores the email in the mailbox the system reads, and holds draft replies until they are sent.
• Anthropic (AI service provider) — processes the content of emails, attachments and case records to interpret correspondence and write drafts. Under its commercial terms, Anthropic does not use this content to train its models.
• Amazon Web Services (cloud hosting provider) — hosts the application server and database, including the stored key points and attachments of emails.
• Printing and postal service — receives the text, name and address of letters the system posts.

Appropriate technical and organisational measures are in place to protect stored data against unauthorised access. Access is restricted to registered users Chris has explicitly invited.

Case and correspondence data is retained for as long as it remains operationally relevant to managing the properties and cases involved, consistent with the underlying legal and contractual matters it documents. Account details (name, email address, sign-in credentials) are kept for as long as the person has access. Security records are deleted automatically once they are older than:

• sign-in session records (device, IP address, times): 90 days after the session ended;
• password-reset links: 30 days;
• invitations: 30 days after they expired;
• records of AI connector calls (which tool, when, from which IP address; never content): 180 days;
• test passkey approvals: 90 days after they closed;
• the security audit log (who did what, from which IP address): 2 years.

If UK/EU data protection law applies to you, you have the right to request access to, correction of, or erasure of your personal data, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority (in the UK, the Information Commissioner’s Office). To exercise any of these rights, contact us using the details below.

We may update this policy as the system changes. Material changes will be reflected in the “Last updated” date at the top of this page.

Questions or requests regarding this policy or your personal data can be sent using the form below.