Privacy Policy
Last updated: 7 May 2026.
Who we are
The WRENN Report is operated by Sulis Minerva LLP, a Limited Liability Partnership registered in England & Wales under company number OC451628, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Sulis Minerva LLP is the data controller for any personal data processed through this website.
For privacy enquiries, subject access requests, or to exercise your rights under UK GDPR, please contact [email protected].
What personal data we collect
If you create an account
Account sign-up records the email address you provide and a securely-hashed password. Authentication is handled on our behalf by Supabase, which holds the credential record and the email-verification state. We use this data only to authenticate you and to provide the gated content of the site (detailed building attributes, matched applications, energy and price data).
If you accept analytics cookies
Anonymous usage analytics are provided by PostHog. PostHog records pageviews, clicks, scroll depth, and basic device information (browser, screen size, country) keyed to a randomly-generated identifier stored in your browser. If you are signed in, PostHog associates these events with your account email so we can debug issues and understand how the product is used. No data is shared with advertisers, and we do not use PostHog's cross-site tracking features.
Analytics are opt-in: the cookie banner asks you to choose. If you decline, no analytics events are sent. You can change your choice by clearing this site's storage in your browser.
If you contact us
Email correspondence is held only as long as needed to handle your enquiry.
What we don't collect
- We do not run third-party advertising networks or behavioural advertising of any kind.
- We do not sell, rent, or share personal data with marketing partners.
- We do not track you across other websites.
- We do not collect special-category data (health, biometrics, political views, etc.).
Cookies and similar storage
| Storage item | Purpose | Set by | Lifetime |
|---|---|---|---|
wrenn_cookies |
Records your accept/decline choice on the cookie banner. | thewrennreport.co.uk | Until you clear it. |
| Supabase auth tokens | Keeps you signed in between visits. | Supabase | Until you sign out or the token expires. |
| PostHog analytics ID | Anonymous usage analytics. Only set if you accept analytics. | PostHog (via reverse-proxy on our domain) | One year. |
Where data is stored and processed
Account credentials and analytics data are processed on infrastructure inside the European Economic Area:
- Authentication (Supabase): EU region.
- Analytics (PostHog): EU region (
eu.posthog.com). - Application database and website: Hetzner Online GmbH (Germany).
- CDN and DNS: Cloudflare. Static pages may be cached on Cloudflare edge servers worldwide; no personal data is included in those cached pages.
Legal basis for processing
Under UK GDPR Article 6:
- Contract / pre-contract — for handling your account, authentication, and providing requested gated content.
- Consent — for analytics cookies. You can withdraw at any time.
- Legitimate interests — for limited error-logging and abuse prevention. These never involve cross-site tracking or marketing.
Your rights
You have the right under UK GDPR to:
- Access the personal data we hold about you;
- Request correction of inaccurate data;
- Request deletion of your account and associated personal data;
- Object to or restrict processing in certain circumstances;
- Receive a copy of the personal data you have provided in a portable format;
- Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) at any time.
To exercise any of these rights, email [email protected]. We aim to respond within one calendar month.
Data retention
- Account records (email, hashed password, sign-in history) are retained until you delete your account or after 24 months of inactivity.
- Analytics events are retained for 12 months and then aggregated.
- Server access logs are retained for up to 30 days for security and abuse prevention.
About the data on this website
The substantive content of this site — listed buildings, planning applications, energy certificates, sale prices, environmental risk — is sourced from public datasets published under the Open Government Licence and equivalent licences. Those datasets describe properties, not the personal lives of their occupants. Property addresses, sale prices, and Energy Performance Certificates are publicly published under those licences. If you believe a specific record contains personal data that should be removed, please get in touch and we will review it.
Changes to this policy
We will update this page when our processing changes. The "Last updated" date at the top reflects the most recent revision.