Part A: terms for everyone using Stega
1. Who provides Stega
Stega is provided by Stega Limited, registered in England and Wales with company number 17455608 ("Stega", "we", "us"). Our registered office and postal address is 27 Old Gloucester Street, London, WC1N 3AX. Contact us at help@stega.uk for service, billing, cancellation or privacy enquiries.
2. These terms and your account
These terms apply to your use of Stega. A landlord also agrees to Part B and Schedule 1. A tenant agrees to Part A and does not take on the landlord's subscription charges or controller obligations simply by using a tenant account.
Your agreement starts when, after being given access to these terms, you accept them and we enable your account. For a business customer, the person accepting must have authority to act for the business identified in the account or order. A paid subscription starts only when we accept your express order for the stated paid plan and confirm it to you. We will provide a copy of the applicable terms and order confirmation that you can keep.
Accounts are for people aged 18 or over. You must provide accurate account information, keep it up to date and use only an account you are authorised to operate. Do not share passwords or sign-in links. Notify help@stega.uk promptly if you believe someone has accessed your account without permission.
The Privacy Notice explains personal-data processing. Acknowledging that notice is not consent to marketing or unrelated use of your data. The order identifies the purchased plan and price. These terms govern its general operation. Schedule 1 takes priority for a conflict about landlord-controlled personal data. Mandatory legal rights always take priority.
3. What the service does
Stega provides tools for authorised landlords and tenants to organise property and tenancy information, share documents, exchange messages and coordinate repairs. The functions available are those described for your current plan and release. A roadmap, prototype or discussion of a future feature is not a promise that it is included.
We provide the service with reasonable care and skill. We aim to keep it available, but maintenance, faults and circumstances outside our reasonable control may interrupt it. We will take reasonable steps to minimise disruption and explain a material interruption when practicable. No particular uptime percentage or response time is promised unless expressly agreed in writing.
Stega is not your landlord, letting agent, contractor, insurer or legal adviser. We do not inspect properties, certify legal compliance or guarantee a repair, a contractor's work or a legal outcome. Uploading a certificate does not mean we have checked its validity or will monitor its expiry. These limits describe the service. They do not excuse our failure to provide the functions we have agreed to supply with reasonable care and skill.
4. Repairs, communications and emergencies
The landlord remains responsible for their housing and repair duties. Contractors remain responsible for their work and qualifications. The tenant's rights under their tenancy and applicable law are not changed by these terms.
Stega is not an emergency response service and messages are not continuously monitored. For immediate danger, use the appropriate emergency service. For an urgent property problem, also use the landlord's supplied emergency contact or another appropriate route. Do not wait for a Stega notification before taking necessary action.
A saved report, delivery status or read indicator records a software event. It is not proof that the landlord has accepted liability, that a contractor will attend, or that a legal notice has been validly served. Use any legally required method separately where necessary. A landlord must not use Stega's availability or account rules to avoid accepting a repair report through another appropriate route.
5. Fair use and records
You must use Stega lawfully and only for properties, tenancies and records you are entitled to manage or access. Do not impersonate anyone, harass another user, upload unlawful material, introduce malicious code, bypass access controls, scrape private records or deliberately disrupt the service. Security limits may restrict repeated submissions. Report suspected vulnerabilities privately to help@stega.uk without accessing another person's information or causing damage.
Take reasonable care over information you submit and correct mistakes through the available process. Do not upload unnecessary sensitive information or images of unrelated people. You must have the necessary authority to share documents and third-party information. These responsibilities do not transfer our own data-protection obligations to you.
Sharing settings determine who can view a record. A recipient may retain a copy they have legitimately downloaded. Ending access or deleting an application record cannot recall every copy already lawfully provided to a recipient. We remain responsible for handling copies under our control in accordance with the Privacy Notice and Schedule 1.
An audit history can retain an original event and add a correction rather than silently overwrite it. Statutory correction, restriction and erasure requests remain available. Archive and account sign-out are not permanent deletion.
6. Your content and our software
You retain any intellectual-property rights you hold in the material you submit. You permit us to store, reproduce, transmit and display it only as necessary to provide, secure and support the agreed service and carry out lawful instructions. That permission ends when the relevant processing ends, subject to lawful retention. It does not give us a right to sell your private content or train AI models on it.
Stega and its licensors retain rights in the software, branding and other materials we provide. You may use them through the service for its intended purpose. You may not resell the service, copy its software or misuse its branding except where the law permits or we agree in writing. Feedback is voluntary. Do not include confidential third-party information in it.
7. Tenant access and tenancy changes
Tenant use of Stega is free under these terms. Tenants do not become liable for a landlord's unpaid Stega fees.
Access is tied to your authorised tenancy and role. While the landlord's Stega account remains open, scoped read-only access to records you remain entitled to see may continue through the sixth anniversary of the recorded tenancy end date, subject to earlier lawful deletion. This is an access ceiling, not a guarantee that every item is retained, and gives no access to a new tenant's records or private landlord documents.
If your landlord closes their Stega account, we delete their tenancy records within 30 days of the closure date. You can read and download the records you are entitled to see until the access-end date shown in Stega, 30 days after closure. There is no archive service after that date. Deletion takes priority over the six-year access ceiling. Each tenancy is treated separately; we remove your login only when no other tenancy uses it.
Keep your own copies of important records before access ends. Contact your landlord directly for anything you need after deletion, and help@stega.uk about inaccurate tenancy dates, loss of access or a personal-data request. Tenant account closure does not automatically erase records that the landlord must lawfully retain. Section 9 and Schedule 1 explain landlord account closure and return or deletion instructions.
8. Suspending access
We may restrict the affected account or function where reasonably necessary to address a serious terms breach, suspected unauthorised access, unlawful activity or a security risk, or where law requires it. Restrictions should be proportionate. We will normally explain the reason and allow a reasonable opportunity to resolve it, unless doing so would compromise safety, security or a legal restriction.
We will not punish a tenant for raising a repair or privacy complaint. Where full account access must be restricted, we will consider a secure alternative for obtaining records or exercising rights. Suspension does not cancel the landlord's repair obligations or extinguish statutory rights.
9. Ending use, service closure and records
You may stop using Stega at any time. Landlords can cancel a subscription or trial, or close their account, themselves from the Account page, without giving a reason. You can also email help@stega.uk. For paid landlords, cancellation of renewal and early termination are governed by Part B. Cancelling a trial of Core or Portfolio before its first payment stops that payment and leaves trial access until its end date. It does not delete your records. We will distinguish stopping charges, removing access and deleting records rather than treating them as the same request. If you enter a card in Stripe but do not finish creating your Stega account, we will send one setup reminder and cancel that unclaimed trial seven days before its first payment, without charging you.
Closing the pilot to new invitations does not shorten access already granted. Free access runs until the end date recorded on your account, subject to the suspension grounds in section 8 and service closure described here. We may discontinue the service on at least 30 days' notice where reasonably practicable. Earlier action may be necessary for a serious unresolved breach, legal requirement or immediate security risk. We will give affected users reasonable information about how to obtain records they are entitled to receive. We will not disclose other users' private information in an export.
For a business landlord's records, Schedule 1 governs return and deletion. It is not overridden by a general archive period in the Privacy Notice. Our own necessary contract and accounting records may be retained separately on the basis explained in that notice. We will not retain or withhold personal-data rights responses simply to pressure someone into paying a disputed bill.
10. Responsibility and limits
Nothing in these terms excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or anything else that cannot lawfully be excluded or limited. Nothing removes an individual's statutory data-protection rights or a regulator's powers.
If you are a consumer, we are responsible for loss or damage you suffer that is a foreseeable result of our breach or failure to use reasonable care and skill, subject to applicable law. We do not exclude your statutory remedies. The business-only limits below do not apply to you. A tenant is not treated as a business customer just because their landlord is one.
For business customers only, subject to the preceding paragraphs and the law on reasonable exclusions:
- We are not liable for indirect or consequential losses, or loss of profit, revenue, anticipated savings, business opportunity or goodwill. This does not exclude reasonable direct costs of restoring data where we are otherwise liable for its loss.
- Our total liability for ordinary claims arising in a contract year is limited to the greater of £1,000 and the fees paid or payable for the service for that contract year. A contract year runs from the start of the agreement and each anniversary.
- Instead of that ordinary cap, our total liability for claims arising from our breach of confidentiality or data-protection obligations in a contract year is limited to the greater of £5,000 and twice those fees. Amounts paid under the ordinary cap count towards this higher cap, so the two caps do not stack. Related claims count in the year of the first event giving rise to them.
These caps govern contractual allocation between us and a business customer only. They do not cap a data subject's statutory compensation claim against a party or bind an authority. There is no general obligation for a tenant to indemnify Stega for other people's losses.
11. Changes, complaints and governing law
We may change these terms for legal, security or operational reasons, or to reflect an agreed service change. We will identify a material adverse change and normally give at least 30 days' notice. Necessary legal or security changes may require shorter notice. A change will not retrospectively remove an accrued right or increase an already-paid price.
If a change materially disadvantages a paid customer during an already-paid period, the customer may end the affected service before the change takes effect and receive a proportionate refund for the unused prepaid period. New optional paid functions require an express order. We will keep dated versions of the terms.
Send complaints to help@stega.uk with enough information for us to investigate. We aim to acknowledge within five working days and provide a substantive response within 15 working days, or explain when further investigation is needed. This does not extend a statutory deadline or require you to delay seeking a remedy.
English law governs these terms. Business disputes are subject to the courts of England and Wales. A consumer retains any mandatory protection and right to bring proceedings in their home courts that the law provides. These terms do not change the law governing the tenancy itself.
We may transfer the agreement as part of a genuine business transfer if the successor can perform it and the transfer does not reduce your rights. We will notify you. Otherwise neither party transfers its contractual responsibilities without the other's reasonable agreement. If a provision cannot lawfully be enforced, the remainder continues so far as it can. Delaying enforcement is not a waiver. Third parties have no right to enforce these terms under the Contracts (Rights of Third Parties) Act 1999, without affecting rights arising independently under law.
Part B: landlord subscriptions and service orders
12. Landlord responsibilities
You must have authority to manage the properties and invite the people whose records you put into Stega. Keep tenancy dates, sharing permissions and contact arrangements accurate. You are responsible for selecting and instructing trades and for the underlying rent, deposit, repairs, inspections and other landlord duties.
If you instruct a contractor, the work contract and its price are between you and that contractor unless a separate service order expressly says otherwise. Stega's initial subscription does not include holding rent, deposits or contractor payments, vetting a trades marketplace, acting as an agent or offering a repair guarantee.
13. Free trials, invited access and paid plans
Where public signup is available, there are two ways to start. The standard free trial lasts 30 days from account creation, includes up to 5 active properties and needs no card. Choosing Core or Portfolio instead opens Stripe's hosted Checkout first. You enter your card and email there for a 30-day free trial of that plan, with that plan's property allowance. After Stripe confirms the trial, we ask you to verify the Checkout email and finish creating your account; the Checkout return page alone gives no account access. An accepted invitation grants 90 days from account creation, includes up to 5 active properties and replaces either trial; the periods do not add together. Completing repairs does not shorten free access. Your account shows the actual end date, including any extension already granted.
A free trial without a card, or an invited pilot, does not automatically become a paid subscription. You must place a paid order before we charge you. If that free access ends without a subscription, your landlord workspace is paused and billing remains available. Tenants can still report repairs and send messages; you should contact them directly about anything outstanding. Expiry does not itself delete your records or provide continued access to the landlord workspace. Section 9 and Schedule 1 govern requests for records and deletion.
A trial of Core or Portfolio becomes a paid subscription automatically when it ends, unless you cancel before then. We do not charge for the trial period. At checkout we show the plan, the recurring price, the billing period and the date of the first payment, and you agree to that recurring payment then. Stripe may check your card when you add it, and your bank may briefly show this as a pending amount. That check is not a charge. We email you before the first payment, stating the price, the date and how to cancel. You can cancel in Billing at any time during the trial: you keep access until the trial ends and you are not charged. Each landlord can have one free trial or invitation. If you already have free access when you choose a plan, your first payment is on the date that free access ends, and no free days are added to it.
Before a paid order, we will show the plan's included features, property allowance, billing period, total price and applicable VAT, any additional-property charge, start date and renewal or cancellation arrangements. We will identify whether a recurring renewal is being authorised. There is no requirement in these terms to buy an annual plan, and no annual or multi-year commitment is inferred from trial use.
The agreed order controls the specific price. We will not impose an unannounced overage charge or charge for an upgrade without showing the effect and obtaining your agreement. VAT is charged only where applicable and will be stated clearly.
14. Payment and renewal
When the payment integration is released, Stripe will process payments using the methods offered at checkout. Providing a payment method authorises only the charges and recurring schedule clearly agreed in the order. We do not receive your complete card number through the standard hosted payment flow. Our Privacy Notice explains relevant billing information and Stripe's role.
A monthly or annual subscription renews only on the recurring terms expressly accepted at purchase. We will send a reminder before an annual renewal, normally at least 30 days beforehand, stating the price and how to stop renewal. Any additional reminder or cooling-off obligations required by law also apply. We will not change the price during an already-paid period. A future price increase requires at least 30 days' notice and an opportunity to stop renewal before the increased price applies.
If payment fails, we will notify you and give at least seven days to resolve it before suspending paid functions for non-payment, unless fraud or a legal restriction requires earlier action. You may raise a good-faith billing dispute at help@stega.uk. Tenant fees will not be introduced to recover unpaid landlord charges.
15. Cancellation, refunds and consumer protection
You may stop the next renewal at any time before it is due with Cancel subscription on your Account page, or by emailing help@stega.uk from the registered contact. We will use the time your request reaches us, not when we happen to process it, and confirm cancellation. You do not have to call us or explain why. A charge made because we failed to action a timely cancellation will be refunded.
For all new paying landlords, we provide a 14-day first-subscription refund guarantee. Cancel by the end of the 14th day after entering your first paid subscription, using Cancel and get a refund on the cancellation page or by emailing us, and we will end that subscription and refund its initial payment in full, including where you have used the service. A free pilot does not use up this guarantee, and neither does a free trial, with or without a card: the 14 days start from your first payment. We will make that refund within 14 days of your cancellation notice, using the original payment method unless another method is agreed without additional cost.
After that guarantee period, cancelling renewal normally leaves the subscription available until the end of the paid period, without a refund for the unused portion where you simply change your mind. This does not affect statutory rights, a refund promised in your order, a material adverse change under section 11, or our failure to supply the agreed service. If we end a paid service early without your fault, we will refund the unused prepaid portion.
Where you contract as a consumer, any statutory cancellation rights apply independently, including an applicable 14-day distance-contract period. Your status depends on the actual circumstances, not a label in the signup form. We will provide required pre-contract information and confirmation. If you request immediate service during a statutory cancellation period, we will obtain the necessary express request. The first-subscription guarantee above means we do not deduct an early-use charge from that refund. We do not ask you to waive a statutory right just by signing in. If the law gives a longer period or further renewal rights, those rights prevail.
You may use the following wording, but any clear cancellation statement is sufficient:
To Stega Limited, help@stega.uk, 27 Old Gloucester Street, London, WC1N 3AX: I give notice that I cancel my Stega subscription. Ordered on: [date]. Name: [name]. Account email: [email]. Address: [address, where needed to identify the order]. Date: [date]. Signature: [only if sent on paper].
Schedule 1: landlord data processing terms
D1. Scope, parties and processing details
This schedule is the data processing agreement (DPA) between the landlord customer as controller and Stega Limited (17455608) as processor for personal data processed on the landlord's behalf. It applies when the landlord accepts the terms and uses the service for that processing. It does not cover Stega's separate controller purposes described in the Privacy Notice.
"Data protection law" means the UK GDPR, Data Protection Act 2018 and other applicable UK personal-data legislation, as amended. Controller, processor, personal data, processing and personal data breach have their meanings in that law.
- Subject matter: hosting and operating the landlord's property and tenancy records, communications, documents and repairs.
- Purposes and operations: receive, organise, store, display, transmit, retrieve, export, correct, restrict and delete records; authenticate authorised users; provide instructed support and limited service-event evidence.
- Duration: during the service and any expressly authorised archive or return period, followed by return or deletion under D8.
- People concerned: landlords and their contacts, tenants and household members, contractors, reporters and people necessarily identified in uploaded records.
- Data types: names and contact details; property and tenancy facts, dates, rent and deposit records; invitations and access identifiers; messages, documents, photographs, repair and appointment information and minimised activity records.
- Sensitive data: not routinely requested. Necessary special-category or criminal-offence data requires the controller's documented lawful condition and appropriate handling instructions. Incidental content still requires assessment.
- Controller rights and duties: set lawful purposes and instructions, provide notices, identify lawful bases and conditions, minimise data, manage access and exercise instruction, audit and return or deletion rights.
D2. Instructions and confidentiality
We will process landlord-controlled data only on documented instructions, including these terms, authorised use of the service and verified written requests, and only for the specified purposes. International processing is also subject to D7. If domestic law requires other processing, we will tell the landlord beforehand unless legally prohibited. If we believe an instruction infringes data protection law, we will inform the landlord immediately and pause the affected instruction while it is resolved.
We will restrict access to personnel who need it and ensure those personnel are bound by confidentiality. We will not use landlord-controlled records for our own advertising, sale of data or model training under this schedule.
D3. Security
We will maintain technical and organisational measures appropriate to the risks, meeting Article 32. These include authenticated and role-scoped access; tenancy isolation; private document and photo storage; protection of data in transit; restricted administrative access; confidential credential handling; separation of production from test data; security-event handling; and periodic testing of access boundaries and restoration procedures. We will use appropriate encryption or equivalent protection for stored data and backups according to risk and the provider service.
We will keep a record of current measures, assess material changes and avoid materially weakening protection. No unsupported uptime, zero-data-loss guarantee or fixed backup lifespan is implied.
D4. Assistance and personal-data breaches
We will provide appropriate assistance with individuals' rights requests and the landlord's obligations concerning security, breach assessment and notification, DPIAs and consultation with the ICO, taking account of the processing and information available to us. We will promptly forward a request relating to landlord-controlled data and will not decide it for the landlord unless instructed or required by law.
We will notify the landlord without undue delay after becoming aware of a personal data breach affecting their data. We will provide available information about the nature and likely consequences, affected data and people, mitigation and a contact point, adding information as it becomes available. We will assist containment and investigation. We will not wait for a complete investigation before an initial notice. The landlord decides any controller notifications, without removing our own legal duties.
Routine assistance and information demonstrating compliance are included in the service. Unusually extensive additional work may be charged only if reasonable charges are agreed in advance and do not obstruct legal rights or duties. We will not charge the landlord for correcting our own breach of this schedule.
D5. Subprocessors
The landlord gives general written authorisation for the subprocessors identified below. Before any new or replacement subprocessor receives landlord-controlled data, we will notify the landlord, ordinarily at least 30 days in advance, stating its role and relevant processing locations, so the landlord can object on reasonable data-protection grounds.
We will consider a timely objection and seek a reasonable alternative. If it cannot be resolved before the proposed processing, either party may end the affected service, with a proportionate refund of unused prepaid fees. An emergency replacement may use a shorter period only with the landlord's specific written authorisation or another lawful route. It does not remove the prior-authorisation requirement.
We will impose data-protection obligations equivalent to those applicable to that processing on each subprocessor by a binding agreement and remain responsible to the landlord for its performance. Supplier websites alone do not constitute our notice of a change.
The approved initial subprocessors are:
- Supabase: database, authentication, document and image storage. The application databases use the London project region, with contractual safeguards for relevant overseas support and onward processing.
- Vercel: application hosting and server processing, with contractual safeguards for relevant execution, support and international processing.
- Resend, Plus Five Five, Inc.: authentication and transactional email, including contractual provisions for UK restricted transfers to US processing.
- Zoho Mail: support correspondence containing landlord-controlled data where necessary, subject to the applicable account-region and transfer arrangements.
Stripe is active as Stega's business account but is not yet connected to the application. Subscription billing ordinarily concerns Stega's controller relationship with the paying customer. No tenant-content sharing with Stripe is authorised merely by its mention here. Before enabling it, we will document the exact data flows and Stripe's roles.
D6. Demonstrating compliance and audit
We will make available information necessary to demonstrate compliance with this schedule and allow and contribute to audits, including inspections, by the landlord or a suitably qualified auditor they appoint. Normally, the parties will first use relevant documentation or reports and agree reasonable notice, scope, confidentiality and safeguards for other customers' data.
Those arrangements must not prevent an audit where legally required, following a relevant breach or where available evidence is insufficient. Audit costs and any exceptional assistance charges must be reasonable and agreed. They cannot be used to frustrate Article 28 rights. Each party remains responsible for its own compliance.
D7. International transfers
We will make a restricted transfer of landlord-controlled data only on documented instructions and with an applicable lawful transfer mechanism, including relevant UK adequacy provisions or appropriate safeguards, together with any required transfer assessment. We will provide relevant information about the actual route on request. A London database does not imply that all support, email and downstream processing stays in the UK. This schedule is not itself an international transfer agreement.
D8. Return, deletion and archive instructions
The landlord must download the records they need before their account closes. The closure date ends the processing service and the landlord can no longer sign in. We delete landlord-controlled properties, tenancies, repairs and photos, messages, documents, contractor records and their Storage objects from ordinary live systems within 30 days of that closure date, or earlier where a valid instruction requires it. Tenants retain only their authorised reading and downloading access until closure plus 30 days, when their access ends. There is no continuing archive service, and no tenant access outlives the landlord's deletion.
We delete the landlord's ordinary Stega profile and Auth user 90 days after closure, and the Stripe customer record where Stripe allows. The Auth user is deleted last. A tenant's login is removed only when no other tenancy uses it. This does not promise erasure of records Stripe or another processor must retain under its own verified supplier or legal requirements.
Protected backups expire under the documented supplier schedule, remain unavailable for ordinary use and are deleted at the earliest applicable expiry. If a backup is restored, outstanding deletions and restrictions must be reapplied before normal use. We will give the landlord the relevant backup schedule before processing begins and evidence of completed return or deletion on reasonable request.
The six-year former-tenant access model is a ceiling for open landlord accounts only. On landlord account closure, D8 prevails over longer general retention periods. Necessary records that Stega holds separately as controller are identified and minimised under the Privacy Notice: invoices and payment records, contract and terms evidence, the account-closure record, repeat-introduction evidence and content-free customer events. Their periods run from the applicable trigger stated in that notice; they do not authorise retention of landlord-controlled messages or documents.
D9. Priority and responsibility
This schedule takes priority over inconsistent general service terms for processing of landlord-controlled data. Each party remains responsible for its obligations under data protection law. Section 10 governs contractual business liability only to the extent lawful. It does not restrict data subjects' statutory rights or our responsibility for subprocessor performance.