Privacy policy

Acorn is an AI-native customer relationship management service for UK estate and lettings agencies, covering England, Wales and Scotland. The controller is Acorn Software Ltd, registered in England & Wales (company number to follow), of Witney Business & Innovation Centre, Windrush Park Road, Witney, Oxfordshire, OX29 7DX. Current company particulars are kept on our legal page.

For anything in this policy, contact privacy@acorncrm.co.uk. We reply within one working day.

When you browse this website, enquire about a demo, or deal with us as an agency customer, we decide how that information is used, so we are the controller.

When an agency runs its book inside Acorn, the records belong to the agency: its applicants, vendors, landlords, tenants, contractors and staff. The agency is the controller of that information and we process it only on the agency’s documented instructions, under a data processing agreement. If your details are held by an agency that uses Acorn, your first port of call for questions or rights requests is that agency; we help them respond.

Very little. This website sets no cookies, runs no analytics and has no tracking pixels. Fonts are served from our own hosting, not from a third-party font service.

The contact form composes an email in your own mail application; nothing you type is stored by the website itself. When you email us, we receive what you choose to send: typically your name, email address, agency name and message, and we use it only to reply and to arrange anything you have asked for, such as a demo.

As controller, for agencies that use Acorn:

account and staff details (names, work email addresses, roles, sign-in records), billing contacts, and support correspondence.

As processor, on the agency’s instructions:

the agency’s working records, which can include contact details of applicants, vendors, landlords, tenants, contractors and solicitors, property and tenancy records, viewing notes, messages drafted and sent through Acorn, statutory compliance records such as certificate dates, maintenance reports, and financial records such as rent and deposit entries. Every action taken in Acorn, by staff or by its AI agents, is written to an audit trail.

Acorn’s agents do real work: qualifying enquiries, chasing certificates, drafting arrears letters. To do that, relevant records are sent to large language model providers acting as our sub-processors. Anything consequential an agent wants to do waits in a human approval queue before it happens, and every run is recorded step by step.

We use these providers through their business APIs, under terms that do not permit them to train their models on your data. We do not sell personal information, and we do not use agency records to train models of our own.

Where we are the controller, we rely on:

Where we are the processor, the agency chooses its own lawful bases; ours is the contract with the agency.

We do not sell personal information and we do not share it with advertisers. We use a small number of sub-processors to run the service:

The current list is kept on our legal page; agency customers are notified of changes under their data processing agreement. We may also disclose information where the law requires it, or as part of a reorganisation or sale of the business, with protections carried over.

Some of our sub-processors process data in the United States or other countries outside the UK. Where that happens, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on a UK adequacy decision where one applies, so the information keeps equivalent protection wherever it is processed.

Website and enquiry correspondence: for as long as we are dealing with each other, then as long as needed to keep a record of what was agreed.

Agency records inside Acorn: for the term of the agency’s agreement. When an agreement ends, the agency can export its book; we then delete or return the records on the agency’s instruction, after a short wind-down period for backups to cycle out. Account and billing records are kept as long as tax law requires.

Under UK GDPR you can ask for access to your personal information, correction, erasure, restriction, portability, and you can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time.

To exercise a right against us as controller, email privacy@acorncrm.co.uk; we respond within one month. If your information is held by an agency inside Acorn, direct the request to that agency and we will help it respond.

Information is encrypted in transit, access is controlled per staff account, and consequential actions in Acorn, whether taken by a person or an AI agent, are permission-gated and recorded in an audit trail. No internet service can promise perfect security, so we describe our practices honestly rather than certifying perfection, and we will notify affected agencies and regulators of any breach as the law requires.

This website and the Acorn service are for estate agency professionals and are not directed at children. We do not knowingly collect information from anyone under 13.

If you are unhappy with how we have handled your information, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

When we change this policy we update the date at the top, and for significant changes we tell agency customers directly. The current version always lives at this address.