Skip to content

Privacy Policy

1. Introduction

At Kinmoot, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our property investment marketplace.

2. Information We Collect

2.1 Personal Information

  • Name and contact information
  • Profile information and preferences
  • Payment and transaction details
  • Communication history on our platform

2.2 Usage Information

  • Device and browser information
  • IP address and location data
  • Platform usage patterns
  • Cookies and similar tracking technologies
  • When you open the deal form, or save or submit a deal, we keep a record of the attempt: when it happened, whether it succeeded, and if not, which parts of the form were incomplete or what went wrong. We use it to find and fix problems with the form. It never includes what you typed or uploaded, and it is deleted after twelve months.
  • When you read a feasibility sheet or brochure through the importer (section 4.3), we keep a record of the reading: when it happened, which hub and account it was for, whether it worked, how many figures it found, and what it cost us to run. We use it to see how well the reader works over time. It never includes any of the text of your document or any photograph you uploaded, and we keep it for as long as we run the service.

3. How We Use Your Information

We use your information to:

  • Provide and improve our services
  • Process transactions and payments
  • Communicate with you about our services
  • Protect against fraudulent or illegal activity
  • Comply with legal obligations

4. Information Sharing

We may share your information with:

  • Other users as necessary for platform functionality
  • The business running the site you joined through, where that business is not Kinmoot itself — see 4.1 below
  • Service providers who assist in our operations
  • Legal authorities when required by law
  • Business partners with your consent

4.1 Sites run on Kinmoot by other businesses

Not every site built on Kinmoot is run by us. Some are run by our customers — a property educator or sourcing business with their own branded site and their own members. If you joined through one of those sites rather than through kinmoot.com, then that business, and anyone they have made an administrator of their site, can see the following about you from the dashboard we give them:

  • Your email address, whether you hold member or administrator access, whether that access is invited, active or withdrawn, the date you were added and the date you were last active on their site. Your membership record holds your email address and no other contact details.
  • For each email they send you through Kinmoot, whether it was delivered, whether it bounced, whether you opened it and which of its links you clicked. From these, and from any list-checking records your hub brings with it, we keep a grade of whether the hub may keep emailing you, so that people who no longer read its emails stop receiving them. We also check that your address can receive email: we look up your email domain ourselves, and a specialist email-verification provider acting as our processor, Bouncer (which processes it in the EU), may confirm the mailbox exists without sending you anything. We do not record your device or location.
  • Which of their lessons you have opened, and when. What they are shown is the lesson and the time, recorded against your account — not what you typed, not which pages you browsed, and not your device, IP address or location. No recording is made of your session on their site.
  • How many of their members open each part of their site, how many follow each of the links they recommend, and how long their lessons are watched for. They are shown totals across their members (how many people, how many times, how many minutes), never what you did yourself.
  • If you register interest in one of their deals: the name and email address you gave on that form, any phone number you gave on it and whether you agreed to be contacted by phone call, WhatsApp or both, how you said you intend to buy, your timescale, your buying history, how many of their deals you have registered on and when, along with a ranking we work out from those answers. They are also shown that you are one of their members.
  • If you ask to be introduced to one of the professionals they list, the name you gave with that request. If you submit a deal to them, the name and photograph on your Kinmoot profile.
  • If you set up a deal alert, joined their site or registered interest in a deal after following one of their campaign links, which of those links it was. They also see how many times each link was opened, counted without cookies and without recording who opened it.

Where your name appears in that list it is the name you gave on the form in question, not a name taken from your account — except for an introduction you ask for in the member app (section 8), which uses the name and email address on your account. What they can see is limited to their own site: they cannot see what you do on kinmoot.com, or on any other site run on Kinmoot that you belong to.

4.2 AI assistants connected to those sites

A business running a site on Kinmoot can connect an AI assistant — such as Claude, ChatGPT or a similar tool — so that they can ask questions about their own site rather than reading the dashboard themselves. Where they do:

  • The assistant can read no more about you than the information described in 4.1 above. Connecting one does not give them anything further about you.
  • The assistant can only read. It cannot change their site, contact you, or act on your record.
  • Information the assistant reads is sent to the company providing that assistant, and is handled under that company's terms and privacy policy. We do not choose which assistant a business connects, and we do not control what that company does with what it receives.
  • Access is limited to that one site, and the business can withdraw it at any time.

If you want to know whether the site you joined through has connected an AI assistant, and which one, ask the business running it. If you would rather they did not, that is a decision for them and not for us — but you can ask us to delete your data at any time under section 6 below.

4.3 Reading a feasibility sheet or brochure you upload

If you run a hub, or source deals for one, you can upload your own feasibility spreadsheet, a property brochure and photographs of the property and its paperwork, and have the figures read out of them into a draft listing. When you do, the text of the sheets you select, the text of the brochure, and the photographs themselves, are sent to Anthropic PBC in the United States, which returns the figures it found. Email addresses and telephone numbers are removed from the text before anything is sent to Anthropic. Nothing is removed from a photograph: it is made smaller and sent as it is, so anything written in it goes too.

Anthropic does not use this content to train its models, and deletes inputs and outputs within 30 days. We keep the text of the sheets and the brochure you upload — exactly as uploaded — and the photographs, together with what was read from them and what you changed while working on the draft, whether or not you go on to publish it, for twelve months, so that we can measure and improve the reader. That stored copy still includes any email addresses or telephone numbers in your original document; only the copy sent to Anthropic has them removed. A copy of each photograph is also added to the deal's own private record, with the rest of your evidence for that deal: that copy belongs to the deal and stays with it, rather than being deleted after twelve months. The extracted figures we use so that re-opening the same sheet does not need a second reading are still deleted after 30 days. Nothing read this way is published: it becomes a draft that you review, edit and submit yourself. Ask us at the address in section 12 to delete any of this sooner.

4.4 Drafting campaign posts

If you run a hub, you can have Claude, Anthropic's AI, draft the posts for a campaign. When it does, your message, where its link goes, your hub's name, your writing style note, the opening lines of up to three emails or posts you wrote yourself on your hub, and the place, type and description of any deals you pick are sent to Anthropic PBC in the United States, which returns the drafts. We do not send your members' details or the automatic emails your hub sends them, but anything you wrote in those opening lines goes as it is. The drafts are kept with your campaign for you to edit. Anthropic does not use this content to train its models, and deletes inputs and outputs within 30 days. If you choose to write the posts yourself, nothing is sent.

4.5 Analysing a deal on kinmoot.com (by invitation while we test it)

We are testing a tool on kinmoot.com that checks the figures a property sourcer has given you against market data. While we test it, only people we invite can use it. To decide who sees it, we check with PostHog whether it is switched on for your account, whatever you have chosen about analytics cookies. Our server checks before it answers any page or request of the tool, using your account identifier. Your browser checks whenever you are signed in, to show or hide its link in the menu, and sends PostHog the identity it holds for you: your account identifier and your email address.

If you use the tool:

  • What you enter. Where the property is: its postcode and, if you pick it from the list we show, its address as the energy performance register records it, or only a postcode district or sector. The property's details: its type, bedrooms, bathrooms, floor area, age, condition, outdoor space and parking. The figures you were told about the deal, such as the asking price, the cost of works, the rent and the sourcing fee, and the strategy and assumptions you choose. We also keep a record that you accepted the note shown before your first analysis, and when.
  • PropertyData. To estimate values and rents and to find sales and lets nearby, our server sends PropertyData, a UK property data provider, the postcode (or the district) and the property's details. It never sends the address you picked, your name, your email address or the figures you were told. The list of addresses to pick from also comes from PropertyData, for the postcode alone.
  • postcodes.io. To find which country of the UK a postcode or district is in, our server looks it up on postcodes.io, a free postcode service. Only the postcode or district is sent, by our server rather than your browser.
  • No recording. Session recording, heatmaps and Microsoft Clarity are off on the pages of the tool, whatever you have chosen about cookies. With your analytics consent, PostHog records which of its pages you open and when an analysis starts or finishes, with the strategy and how long it took, never the address, the postcode or any figure.
  • Private to you. Your analyses are visible only to you. No hub, sourcer or other member can see them, and nothing you enter is added to any deal listed on Kinmoot. We use what you enter to run your analyses and, while we test the tool, to see how well it works: for example, what each analysis costs us and which of our assumptions people change.

We use this information to provide the tool you have asked to use, which is necessary for our agreement with you. We check who may see it, and measure how well it works, in our legitimate interests: keeping a tool that is still being tested to the people invited, and improving it.

Your analyses, and the record that you accepted the note, are kept for as long as your account exists and are deleted with it. We also keep a dated record of each request we make to PropertyData and what it answered: the postcode or district and the property details sent, the answer, when it was made and what it cost. PropertyData's licence lets us keep these as dated records, and we keep them with no end date, to show what we asked for and paid for. When you delete your account, they no longer record who asked.

4.6 Kini, the help assistant

Where "Ask Kini" appears on a site, you can ask Kini, our help assistant, how to use it. Kini answers from our help articles and, if you are signed in, from a read-only look at your own account on that site: your role, whether your profile is complete and the sites you belong to, the deals you have registered interest in or submitted, your course progress and your booked calls, and, if you run the site or help run it, what is waiting for you there. It cannot change anything, and it gives no property or financial advice. If you are not signed in, Kini reads no account, and your conversation is stored under a random identifier rather than your name.

When you ask, your question, the conversation so far, the help articles it uses and what it reads about your own account are sent to Anthropic PBC in the United States, which writes the answer. Anthropic does not use this content to train its models, and deletes inputs and outputs within 30 days.

We keep your conversations for twelve months after your last message, and then delete them; if you delete your account sooner, they go with it. Kinmoot can read them, to see where our help falls short. The business running the site cannot: it sees only topics and unanswered questions shared by at least three people, never who asked. To improve our help articles we use anonymised rewrites of the questions Kini could not answer, never what you typed. If Kini cannot answer and you ask it to pass your question on, your question and a short summary are emailed to the business running the site, or to us on kinmoot.com, with your email address so that they can reply to you.

4.7 Booking a call with us

When you book a call on kinmoot.com, the calendar is provided by Calendly, Inc. in the United States. The name, email address and any notes you enter go to Calendly and to us, so that we can hold the call and contact you about it. If you have allowed analytics and advertising cookies, we also tell Google Analytics and Meta that a call was booked, so we know which of our adverts work; we do not send them what you entered.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

6. Your Rights

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion of your data
  • Object to data processing
  • Data portability

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint. We would appreciate the chance to address your concerns before you approach the ICO, so please do contact us first — by email at privacy@kinmoot.com or by phone on 07706 029772.

7. Cookies

We use cookies and similar tracking technologies to improve your browsing experience, analyze site traffic, and understand where our visitors come from.

7.1 What Are Cookies

Cookies are small text files that are stored on your device when you visit our website. They help us recognize your device and remember certain information about your visit.

7.2 Types of Cookies We Use

  • Essential Cookies: Required for the website to function properly. These cannot be disabled.
  • Functional Cookies: Help us remember your preferences and settings.
  • Analytics Cookies: Allow us to understand how visitors interact with our website, helping us improve our services.
  • Marketing Cookies: Used to track visitors across websites to display relevant advertisements.

7.3 Analytics and Session Recording

With your analytics consent, we use the following providers to understand how the site is used and to fix problems. Until you give that consent, none of them receive any information about your visit, with one exception. When you are signed in, your browser asks PostHog which features are switched on for your account, whatever you have chosen, and sends it your account identifier and email address to do so (section 4.5 describes one such feature). Until you consent, that is all PostHog receives: no events, page views or recordings. PostHog stores only an empty record and a note of your choice on your device — no identifier is created.

  • PostHog (EU region) — product analytics, and session recording on kinmoot.com only. On the sites described in section 4.1 there is no session recording at all: PostHog receives events and page views there and nothing else, whether or not you have given analytics consent. Where recording does apply it captures how pages are used: clicks, scrolling and navigation. Text you type into forms is masked before it leaves your browser, so we do not receive it. If you are signed in, events and any recording are linked to your account so we can help when something goes wrong.
  • Microsoft Clarity — heatmaps and session recording.
  • Google Analytics 4 — aggregate traffic and conversion reporting.
  • Vercel Analytics and Speed Insights — page performance.

We also use Sentry to record technical errors. Error reports contain the page, browser and a technical stack trace, plus your account identifier if you are signed in. They do not include your email address, and error reporting is not used to track or profile you.

7.4 Managing Cookies

You can manage your cookie preferences through the cookie banner shown on your first visit to any site run on Kinmoot, including the sites described in section 4.1. You can change your choice at any time afterwards using the Cookie settings link in the footer of any page. Withdrawing analytics consent stops event collection immediately, and stops session recording wherever it applied.

7.5 Advertising Tags on Hub Sites

A business running its own site on Kinmoot (see section 4.1) may add its own advertising and analytics tags, such as a Meta pixel, Google Analytics or Google Ads. These are set and controlled by that business, which decides how the information is used, and they load only if you accept marketing cookies (for advertising tags) or analytics cookies (for Google Analytics). The cookie settings on that site name the tools it uses. They record that a page was viewed, a quiz was completed or a call was booked; we do not send them your name, email address or answers.

7.6 Measuring Our Own Adverts When You Open a Hub

Kinmoot advertises on Meta (Facebook and Instagram) and Google. The step on kinmoot.com where you set up your hub has a box that says “Let Kinmoot measure which ad brought you here”. It is unticked unless you tick it, and your hub works the same either way.

If you tick it, we tell Meta that you opened a hub and, if you later take a paid plan, which plan and what it cost; and we tell Google Analytics that you opened a hub. We do this so we can tell which of our adverts work, and we do it on the basis of the consent you give by ticking the box, even if you declined marketing or analytics cookies. That consent covers these messages only: ticking the box does not change your cookie choices, sets no advertising cookies and does not load Meta’s pixel.

Meta receives your email address and account identifier, each scrambled (hashed) on our servers before it is sent, so that Meta can only match them to an account it already holds; your IP address and browser details; and Meta’s own cookie identifiers if you have accepted marketing cookies. Google Analytics receives that a hub was opened, without your name or email address. Meta and Google handle what they receive under their own privacy policies.

We keep a record of when you ticked the box, for which hub, and the exact wording you saw, and it is included when you download your data. You can withdraw your consent at any time by emailing privacy@kinmoot.com; we then send nothing more on the strength of it. Withdrawing cannot recall what has already been sent.

8. The Member App

Members of a hub run on Kinmoot may be given a mobile app carrying their own organisation’s name. The app is a second way into the same hub, it holds no separate account, and this policy covers it as it covers the website. It has no cookies, so section 7 does not apply to it; what follows does instead.

8.1 What the App Collects

  • Your email address, to send the six-digit code you sign in with.
  • Your name and email address when you register interest in a deal, book a call, or ask to be introduced to one of the professionals your organisation lists. The interest and booking forms fill these in from your account and you can change them; an introduction request uses the name and email address on your account.
  • Your answers when you register interest in a deal: how you intend to buy (cash, mortgage or bridging) and, where your organisation asks, your timescale and how many properties you already own. Where the deal’s sourcer offers contact by phone or WhatsApp, the form also asks for your phone number and which of the two you agree to, and we keep the wording you agreed to. The number is optional unless your organisation requires one for its deals.
  • What you enter when you book a call: the time you chose, anything you write in the notes box, and your answers to any questions your organisation asks before a call. These, with your name and email address, are added to an event in your organisation’s Google Calendar, and Google emails you the invitation (see section 9.2).
  • A notification token for your device, if you allow notifications, so we can tell you when your organisation adds a deal. It is issued through Expo, by Apple on an iPhone and by Google’s Firebase Cloud Messaging on Android. It is stored with your account, your organisation, the device type and your notification preferences. We delete it when you sign out (if the app can reach us at the time) and when you delete your account. Uninstalling the app cannot delete it by itself: we delete it the next time we try to send a notification to it and Expo reports that the app is no longer registered on that device.
  • Your progress through lessons — how far into a video you watched and which lessons you have finished — so you can pick a course back up where you left it.

What you send through the interest, booking and introduction forms goes to the business running your organisation’s hub, as described in section 4.1.

The app has nothing to buy in it and asks for no payment details. It does not use your location, your contacts, your photos, your microphone or your camera.

8.2 Services the App Uses

Besides Sentry and PostHog (sections 8.3 and 8.4), the app relies on the following services, and each receives the information described:

  • Supabase — hosts the database and the sign-in service that hold your account and everything listed in section 8.1.
  • Expo — delivers updates to the app, and passes each notification we send, with the notification token, on to Apple or Google for delivery.
  • Apple Push Notification service (on an iPhone) and Firebase Cloud Messaging, part of Google (on Android) — deliver notifications to your device.
  • hCaptcha — the check you complete when you ask for a sign-in code and when you book a call, which stops automated abuse. To tell a person from a program, hCaptcha receives your IP address and information about your device and the way you interact with the check.
  • Bunny — streams lesson videos to the app, and so receives the IP address of the device playing them.
  • Postmark — sends the emails the app causes, such as your sign-in code and the messages sent when you register interest in a deal.
  • Google Calendar — holds the event for a call you book, as described above and in section 9.2.

8.3 Crash Reports

The app sends crash and error reports to Sentry so that a fault reaches us without you having to report it. Crash reporting is always on and has no setting in the app. A report carries the error, the device model and operating system version, and your Kinmoot account identifier — never your email address, and never a screenshot or recording of your screen. For a sample of sessions the app also sends Sentry performance measurements, such as how long the app took to start and to load information.

8.4 App Analytics Are Off Unless You Turn Them On

Product analytics in the app go to PostHog (EU region), the same provider named in section 7.3, and they are switched off until you switch them on. A fresh install sends nothing. If you turn on “Help improve the app” in Settings, we record a fixed set of named events: for example that you signed in, that a notification arrived or was opened, that you viewed a deal or registered interest in one (and which deal), that you started or finished a lesson (and which lesson), or that you booked a call. We also record when the app is installed, opened, updated or moved to the background, with basic information about your device and the app version. We do not record every screen you open or everything you tap. These events are linked to your Kinmoot account identifier and to your organisation, the same identifier the hub’s website uses. You can turn analytics off again in the same place at any time, and collection stops immediately.

The app never records your screen. Session replay and screenshot capture are both disabled in the app deliberately and permanently, because the screens in it show live deal details and an organisation’s own course video. There are no advertising or ad-measurement services in the app, and nothing it collects is shared with a data broker or used to track you across other companies’ apps and websites.

8.5 Deleting Your Account

You can delete your account in the app, from Settings, then Delete account, or on the web at /account/delete on the site you joined through. Your other rights over your data are set out in section 6.

9. Connecting Your Google Calendar

If you run a hub on Kinmoot, you can connect your Google Calendar so that members can book a call with you at a time you are genuinely free. This section applies only to the person who connects the calendar. Members who book a call never connect one, and nothing here applies to them.

9.1 What We Access, and What We Do Not

We ask for two permissions and no others:

  • See when you are busy (calendar.freebusy). This returns the start and end times of the things in your calendar, and nothing else. We use it to remove times you are already busy from the slots your members are offered.
  • Create and remove the bookings members make (calendar.events). We add a booking to your calendar when someone books, and remove it if the call is cancelled.

We never read the contents of your calendar. Not the title of a meeting, not its description, not its location, not who else is attending. The narrower permission above returns busy periods only, which is why we ask for it instead of full calendar access. Events we did not create are, to us, an anonymous block of time.

9.2 What We Store

  • An access token and a refresh token issued by Google, so that we can keep checking your availability without asking you to sign in again. These are held in a table that is unreachable by any browser and readable only by our own servers.
  • The email address of the Google account you connected, so we can show you which calendar is attached.
  • The bookings themselves, which are ours rather than Google’s: the member’s name, email address, the time, anything they wrote when booking, and the identifier of the calendar event we created.

We do not copy, mirror or store your calendar. Your availability is fetched from Google at the moment a member looks at your booking page and is not retained afterwards.

9.3 How to Disconnect

You can disconnect at any time from Book a call in your hub dashboard, which stops all access immediately. You can also revoke it directly from your Google Account under Security, Third-party apps with account access. Disconnecting does not delete bookings already made, so that neither you nor your members lose a record of them.

9.4 Limited Use

Kinmoot’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not transfer it to anyone except as needed to provide the booking feature, and no human reads it except where you ask us to help with a specific problem or where the law requires it.

10. Children’s Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect or maintain information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

12. Contact Us

The data controller for the personal data described in this policy is Kinmoot Ltd, a company registered in England and Wales under company number 17381326, whose registered office is 66 Paul Street, London, EC2A 4NA.

Kinmoot Ltd is registered with the Information Commissioner's Office under registration reference ZC223910.

If you have any questions about this Privacy Policy, please contact us at privacy@kinmoot.com or on 07706 029772.

Last updated: October 2026