Privacy Policy

The short version

• Offrly does not require an account. Searching and a valuation's price bracket don't ask for your email address or any payment.
• If you pay for an unlock, Stripe processes the payment. We never see or store your card number, and we keep only what the purchase needs (see Payments).
• We do not use ad-tech or data-broker relationships.
• Search queries are held in memory to run the job, then discarded. To stop abuse we keep a short record of each search and valuation you start — including the first 200 characters of what you typed — against your IP address for 90 days.
• Sale valuation results (postcode, predicted price, property attributes) are kept so we can later compare them against HM Land Registry sold prices and publish an honest accuracy report.
• We use Google Analytics 4 and Microsoft Clarity, but only if you accept the cookie banner on first visit.
• We collect basic server logs (IP, user-agent, path) for abuse prevention and capacity planning.
• If you ask for a mortgage-broker introduction, we share the contact details you submit with our partner — only with your consent — and earn a referral fee. The advice stays free to you.
• We do not sell any data.

Who is responsible for your data

The data controller for offrly.co.uk is Wang Holdings Limited, trading as Offrly, a company registered in England and Wales (company number 15624241). Registered office: 80 Whitesmead Road, Stevenage, England, SG1 3JZ. Trading address: 2207 Ontario Tower, Canary Wharf, London E14 9JD. Questions about your data: email [email protected] or use the contact form.

What we collect

Data you provide

When you run a search or a valuation, you provide property details (postcode, beds, baths, brief text). For dream-home search and rental valuations these are held in memory only for the duration of the job and discarded when it finishes (or within 30 minutes if you leave without finishing) — unless you go to buy that valuation's full report, when a snapshot of it is kept (see Payments).

Separately, because every search and valuation runs paid AI calls, we record each one you start against your IP address so one address can't run up costs for everyone: the type of job, any budget you set, and the first 200 characters of the location, brief, postcode or listing link you entered. These records are kept for 90 days — longer only while that address is blocked, so the evidence is still there if you appeal. If you do appeal a block, we keep the email address and message you send with it.

Sale valuation log

For sale valuations we additionally write one record to a server-side log (not exposed to the public API): postcode, house number or name (if you entered one), predicted price, property type, tenure, bedrooms/bathrooms, garden, condition and parking labels, and the timestamp. If you supplied a public listing URL we also store that URL, the address it points to, what the listing says about the home (its type, and whether it's a shared-ownership, auction, retirement or new home) and our AI's garden and condition ratings of its photos (the listing was already public). This log is the input to our accuracy report — at the end of each calendar quarter every BUY record is frozen to an immutable snapshot, and where a house number or name was given, the valuation is matched to the HM Land Registry sale of that same home. There is no human in the loop, and the report publishes only totals and averages — never an individual home. The raw log is never shared, sold, or exposed to third parties; it lives on our hosting volume in the United Kingdom region.

Server logs

Standard web-server logs: IP address, user-agent, path, timestamp, response status. Retained for up to 30 days for security and capacity purposes.

AI crawler logs

We log which AI crawlers visit which pages (e.g. GPTBot, ClaudeBot, PerplexityBot). This is used to understand AI-engine citation behaviour, not to profile human users.

Contact form

If you email us via the contact form, we retain your message and email address so we can reply.

Payments

If you buy the full valuation report or extended AI search, the payment is processed by Stripe. Stripe handles your card or wallet details itself — Offrly never sees or stores your card number — and uses payment data to prevent fraud under its own privacy policy, for which Stripe is responsible. If you choose to save your details with Onelink, Stripe's payment wallet, Onelink's own terms and privacy policy apply to that. We keep:

• the email address you paid with — for your receipt, your report or restore link, and "Already paid? Email me my link";
• what you bought, the amount, when, the payment method type (for example "Apple Pay" or "card", never the number) and the version of the wording you agreed to when you paid;
• Stripe's reference ids for the payment and for your Stripe customer record, so a returning buyer can use a saved card if they chose to save one with Stripe;
• a keyed, one-way hash of your IP address, to spot card-testing and to limit the courtesy unlocks we grant when payments fail on our side;
• for a report, a snapshot of the valuation you paid for, so your report link keeps working after the live session ends.

Why we're allowed to. We use these details to take your payment and give you what you bought (that's necessary for our contract with you), to keep the records tax law requires (a legal obligation), and to prevent fraud and abuse (our legitimate interest in a payment system that isn't misused). Your email address is needed to buy — it's how your receipt and links reach you.

How long we keep them. Purchase records — and, for a report, its snapshot, so your link keeps working — are kept for six years after the end of the financial year the purchase falls in, because UK tax law requires purchase records for that long. Report snapshots that were never paid for are deleted after 48 hours.

Mortgage referrals

If you ask us to introduce you to a mortgage broker (via the Get a mortgage prompts or the mortgage page), we collect the details you submit — your name, email, phone, and any optional buyer or finance details you choose to add — together with the property context from the tool you were using (e.g. postcode, beds/baths, and your Offrly estimate). With your explicit consent, we share these details with our carefully selected mortgage partner so they can contact you. Offrly is an introducer, not a mortgage adviser: we don't give mortgage advice, and the broker's advice is free to you — we earn a referral fee from the partner. We keep a copy of each referral on our UK hosting volume so we can follow up and reconcile. To withdraw consent, email us via the contact form and tell the mortgage adviser directly, and we'll both stop processing your details.

What we do with it

• Run your query. The data you enter is used to produce your search or valuation result.
• Prevent abuse. IP addresses are used for rate limiting, including the daily count of free AI searches.
• Operate the service. Standard web-ops stuff.
• Publish accuracy honestly. Sale valuation records are matched against the public HM Land Registry sale of the same home so we can publish a real accuracy report rather than a marketing claim. Our lawful bases. We run your search or valuation, and supply anything you buy, because you've asked us to (contract). We keep purchase records because tax law requires it (legal obligation). We use IP addresses and logs to keep the service secure and stop abuse and fraud, and keep the sale valuation log to publish our accuracy honestly, because those are our legitimate interests and they don't override yours. We load analytics and pass your details to a mortgage broker only with your consent, which you can withdraw at any time.

We do not: - Sell data to third parties. - Use your data for advertising. - Share your data with data brokers. - Train third-party AI models on your queries.

Cookies and analytics

On your first visit a cookie banner asks for consent. Until you click Accept, no analytics tools are loaded and no analytics cookies are set. If you click Accept, we load: - Google Analytics 4 — aggregate pageviews, referrers, device class, country-level geo. IP anonymisation is enabled. No Google ads integration. - Microsoft Clarity — aggregate heatmaps and session recordings. Form fields and sensitive text are auto-masked by Clarity's defaults. Your choice is remembered in localStorage (not a cookie). You can revoke consent at any time by clearing your browser's site data for offrly.co.uk and reloading.

Strictly necessary cookies for payments. Starting a payment sets one cookie, offrly_wallet: a random identifier, signed so it can't be forged, that keeps what you bought unlocked in this browser (for up to 400 days). On the valuation and search pages, Stripe's payment code loads once you start a valuation or a search, so the payment options are ready if you choose to buy, and Stripe may set its own cookies to prevent payment fraud. We treat both as strictly necessary — the wallet cookie is how a purchase you asked for stays unlocked, and Stripe's protect the payments it processes — so they don't need consent. Neither is used for analytics or advertising.

We also log application events server-side (e.g. "valuation started", "search completed") with no personal data attached — these run regardless of cookie consent because they contain no identifiers, only aggregate counts.

Error monitoring

We use Sentry to catch server-side exceptions. Sentry receives stack traces and request metadata (URL, status code, truncated user-agent) but not query contents. Personally identifying information is disabled (send_default_pii=False).

Third-party services

Offrly uses a small number of infrastructure providers: - Fly.io — hosting. - Google Fonts — web fonts. - Google Analytics 4 — opt-in analytics (see above). - Microsoft Clarity — opt-in heatmaps (see above). - Sentry — server-side error monitoring. - Stripe — payment processing for the optional paid features, loaded only on the pages where you can pay. - Resend — delivers our emails, including receipts and report links. - CDN providers — may change over time; disclosed here when they do. These providers see the same request metadata any host does (IP, user-agent). They do not receive the content of your queries — except Stripe, which receives what it needs to take a payment, and Resend, which carries the emails we send you. Some of them are based in, or process data in, the United States; where your data leaves the UK, it's protected by UK adequacy regulations (including the UK–US data bridge) or the ICO's approved international data transfer clauses.

Your rights (UK GDPR)

Because Offrly does not require an account and discards most queries quickly, there is very little personal data to act on. If you have corresponded with us via the contact form, paid for an unlock, or ran a sale valuation that included an address (via a public listing URL), you have the usual UK GDPR rights: access, rectification, erasure. Purchase records we must keep for tax purposes can only be erased once that obligation ends. Email us via the contact form with enough detail to identify the record (e.g. the postcode and rough date) and we'll act on it. You can also complain to the Information Commissioner's Office at ico.org.uk.

Changes

If this policy changes materially, we'll update the date at the top. The live version of this page is the authoritative one.

Contact

Privacy questions or concerns: use the contact form. Last updated: 18 October 2026.