Last updated 13 October 2026
Privacy notice
Your lease and service charge documents are personal. This explains exactly what we do with them, who else touches them, and how to make us delete them.
Who is responsible for your data
Origin Collective Limited (company number 16566341, 124-128 City Road, London, EC1V 2NX) runs Overcharged and is the controller of your personal data. Contact us about anything in this notice at hello@servicechargecheck.co.uk.
What we collect
- Your account: your email address, and either a securely hashed password or, if you sign in with Google, your Google account ID. We never see your Google password.
- Your documents: the files you upload (leases, demands, budgets, accounts, notices, letters), the text we read from them, and the facts we extract, such as your name, flat address, managing agent and charges.
- What you tell us: answers to our questions, such as which services you don't use, and any details you correct.
- Contributions: if you choose to contribute, Stripe handles your card. We receive the amount and a payment reference, never your card number.
- Feedback: your rating and comments, whether we may publish them, and the first name and area you choose to show with them, if any.
- Basic technical data: the minimum our hosting needs to run the site and keep it secure, such as IP addresses used for rate limits and error logs.
- Visit statistics: Cloudflare Web Analytics counts page views, the page you came from, your browser type and your country. It sets no cookies, doesn't store your IP address and doesn't follow you across other sites.
Only upload what's needed. If a document contains other people's details, they're processed only as part of reading the document.
Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Run your account, read your documents, produce your assessment, plan and letters | Performing our contract with you |
| Publish your feedback on our website | Your consent, given with the tick box. Withdraw it any time by emailing us |
| Take contributions and keep records of them | Contract, and our legal obligations (tax and accounting records) |
| Keep the service secure, stop abuse, fix errors | Our legitimate interest in running a safe, working service |
| Send sign-in links and password resets | Contract (you asked for them) |
We don't sell your data, use it for advertising, or train AI models on it.
How your documents are read
Our software reads your documents with AI models through OpenRouter, routed only to hosting providers that don't keep or train on what they process (zero data retention): DeepInfra, Novita, Crusoe, Parasail, CoreWeave and DigitalOcean, which are US companies running servers in the US. We never send documents to the AI makers' own services in China. Fixed rules, not the AI, decide the verdicts in your assessment.
The assessment is produced automatically, but it's information for you to consider: it doesn't make any decision about you with legal or similarly significant effects.
Who else processes your data
| Provider | What for | Where |
|---|---|---|
| Cloudflare | Hosting the site; storing your documents and account (database and file storage); sending sign-in emails | Files and records stored in the EU; served through Cloudflare's global network |
| OpenRouter and the hosts listed above | Reading your documents, with zero data retention | US |
| Stripe | Taking contributions | UK, EU and US |
| Only if you choose "Continue with Google" to sign in | US and elsewhere |
Where data goes outside the UK, we rely on the UK government's adequacy regulations (including the UK-US data bridge for certified US companies) or approved contract clauses, such as the International Data Transfer Addendum, to keep it protected to UK standards.
How long we keep it
- Documents, extracted facts and assessments: six months from when you add the property, then deleted automatically. You can delete a property, or your whole account, at any time and it's removed straight away.
- Temporary copies of AI replies: deleted automatically within two days. They let us retry if reading a document is interrupted.
- Feedback: until you delete the property or your account, or ask us to remove it. Feedback you let us publish stays up after the property itself is deleted at six months, unless you ask us to take it down.
- Your account: until you delete it.
- Payment records: Stripe keeps transaction records, and we keep what tax law requires (normally six years). These don't include your documents.
Cookies
We use one essential cookie to keep you signed in, and short-lived cookies during Google sign-in for security. We don't use advertising or tracking cookies, and our visit statistics (Cloudflare Web Analytics) don't use cookies at all, so there's no cookie banner to click through.
Your rights
You can ask to see the data we hold about you, correct it, delete it, restrict or object to how we use it, or get a copy to take elsewhere. Deleting is instant from My properties; for anything else, email hello@servicechargecheck.co.uk and we'll respond within one month.
If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113.
Security
Everything travels over encrypted connections. Passwords are stored only as salted hashes, sessions and sign-in links are stored only as hashes, and each property is visible only to the account that owns it.
Children
Overcharged is for adults. We don't knowingly collect data from anyone under 18.
Changes
If we change how we use your data, we'll update this page and, for significant changes, tell you before they apply.