Effective date: 10 September 2026
This Privacy Policy explains how Synthetic Technology Ltd handles personal information when it operates Orchard. It applies to visitors, manager account holders, invited tenants and people who contact us. It should be read with the Terms & Conditions, Cookie Policy, Data Processing Addendum, Sub-processor Register and Security and Audit Statement.
1. Who we are and our roles
Synthetic Technology Ltd, registered in England and Wales, company number 17364806, registered office: 66 Paul Street, London, EC2A 4NA is the controller for account registration, platform security, billing administration, support, legal compliance and our own business operations. Email: privacy@orchardpms.com.
A property manager is normally the controller for property, tenancy, rent, maintenance and document records it decides to enter. For that Customer Data, Orchard normally acts as processor and the manager's privacy information also applies. Tenant users do not purchase Orchard subscriptions; their access is invited under the manager's Customer account. The Data Processing Addendum governs processor activity.
2. Information we collect
- Account and contact data: name, email, telephone number, password hash, role, company or profile information, country, jurisdiction, timezone, verification and consent records.
- Customer Data: property, tenancy, lease, rent-record, arrears, maintenance, inspection, communication, document, Orchard ID and tenant-history information entered by authorised users.
- Billing data: plan, subscription, invoice, tax, payment status and Stripe identifiers. Orchard does not store full card numbers or security codes.
- Compliance data: legal entity name, business jurisdiction, declared beneficial owners or controllers, sanctions attestations, screening evidence, review decisions and account restrictions.
- Orchard AI data: manager questions, generated answers, source-record links, token and credit usage, tool names, latency and provider status. Orchard AI is read-only, excludes uploaded file contents and screening scores, and keeps chat content for up to 30 days.
- Support and communications: enquiries, tickets, notices, email-dispatch records and responses.
- Review invitations: manager name, email address, subscription tier, recent account activity, qualification status, review-invitation exclusions, an opaque experience reference and invitation-delivery status.
- Technical and security data: IP address, browser and device details, session identifiers, timestamps, authentication events, audit activity and cookie choices.
- Bot-protection data: Cloudflare Turnstile may process IP address, user agent, TLS and browser signals, Orchard's site key and origin, and challenge results to distinguish legitimate submissions from automated abuse.
Orchard does not require identity documents, special-category data, criminal-offence data, health information, bank details or full card data and prohibits their upload through general file fields. If such information is submitted contrary to instructions, access may be restricted and the material may be securely removed, subject to legal preservation duties.
3. Sources
We receive information directly from you, from the manager who invites or manages a tenant record, from other authorised users in the same portfolio, from Stripe for subscription events, from IONOS operational infrastructure, from OpenAI when a manager requests an Orchard AI answer, and from Google services when a user requests map or place functionality. Orchard ID information is generated from profile and activity recorded in Orchard; it is not obtained from a credit-reference agency.
4. Purposes and lawful bases
- Provide accounts and the Service: contract, steps requested before contract, and our legitimate interest in delivering tenant access requested by a manager.
- Provide Orchard AI answers: contract and, for Customer Data, the manager's documented instruction to process a question and relevant manager-scoped records.
- Security, fraud prevention, audit and service reliability: our legitimate interests in protecting users, data and the Service, including invisible bot detection on abuse-sensitive public forms, and legal obligations where applicable.
- Billing, tax and accounting: contract and legal obligation.
- Support and operational messages: contract and legitimate interests in responding and administering the Service.
- Neutral service-review invitations: our legitimate interests in understanding and improving Orchard and helping prospective customers assess the Service. We use objective product-experience criteria, invite Free and paid managers fairly, do not condition invitations on satisfaction and honour objections. Where applicable law requires consent for an invitation, consent is the basis instead.
- Legal claims and regulatory compliance: legal obligation and legitimate interests in establishing, exercising or defending legal rights.
- Sanctions and restricted-territory controls: legal obligations and our legitimate interests in preventing prohibited supply, protecting Orchard and its providers, and evidencing proportionate due diligence.
- Optional cookies or future marketing: consent where required. Consent can be withdrawn at any time.
Our legitimate interests include operating a secure property-management service, preventing abuse, maintaining business records, supporting customers, improving reliability and requesting honest feedback after a manager has had a meaningful Orchard experience. We balance those interests against individual rights and expectations. We do not currently use personal data for targeted advertising, sell personal data, use Customer Data to train AI models, or make solely automated decisions producing legal or similarly significant effects.
5. Orchard ID and informational scoring
Orchard ID consolidates a tenant's profile and Orchard activity so the tenant can review their history and control supported sharing. Internal indicators may summarise completeness or recorded tenancy performance. They are informational only, are not credit scores or references, are not reported to credit agencies, and must not be used as the sole basis for a housing or other significant decision. A user may request correction and human review through the privacy rights request form.
6. Sharing
We share information only as needed with authorised users in the relevant account or tenancy; IONOS for hosting, database, backup, content delivery, server logging and transactional email; Trustpilot for neutral service-review invitations; Cloudflare for Turnstile website and form protection; Stripe for subscription billing, tax and payment administration; OpenAI for manager-requested, read-only Orchard AI answers; Google for requested Maps and Places functionality; professional advisers appointed when required; regulators, courts or public authorities where legally required; and a buyer or successor subject to appropriate confidentiality and notice. Orchard serves its interface fonts directly and does not send font requests to Google. Roles, purposes and provider links appear in the Sub-processor Register.
Cloudflare's processing for Turnstile is described in its Turnstile Privacy Addendum.
7. International transfers
Primary hosting, database, backup and email processing are configured in the European Union. Trustpilot A/S is based in Denmark and its service providers may process invitation data in other documented locations. Providers such as Trustpilot, Cloudflare, Stripe, OpenAI and Google operate internationally, so limited data may be processed outside the UK or EEA. Where UK transfer rules apply, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses, together with the required data-protection assessment and supplementary measures. EU transfers use an adequacy decision or EU Standard Contractual Clauses where required.
8. Retention
We keep personal information only for the period reasonably necessary for the stated purpose. Account and Customer Data are kept while the account is active and then deleted, anonymised, returned or restricted under customer instructions and the DPA. Orchard AI chat content is normally deleted after 30 days; content-free AI billing and operational metrics are normally kept for up to 24 months. Core contract, billing, tax, legal-acceptance and dispute records are normally kept for six years after the relevant accounting or contractual period and may therefore be removed during the following scheduled cycle. Cookie-preference evidence, security and routine audit records are normally kept for up to 24 months unless an investigation requires longer. Support records are normally kept for up to three years. Review-invitation and email-delivery logs are normally kept for up to 12 months. An active review-invitation exclusion is kept while the account remains active so the preference continues to be respected, then removed during account anonymisation. Export files expire after 72 hours. Backups are removed through scheduled expiry and remain isolated from ordinary use. A legal hold, customer instruction or applicable property-law duty may justify a different period.
9. Security
We use HTTPS, password hashing, secure session controls, CSRF protection, role-based access, email verification, upload restrictions, audit logging, encrypted provider backups and incident procedures. No online service is risk-free. More information is in the Security and Audit Statement; security concerns can be sent to notifications@orchardpms.com.
10. Cookies and browser storage
We use a necessary session cookie and local browser storage for consent, interface state and guided tours. Optional analytics or marketing storage is not currently deployed and will not be enabled without an appropriate choice. See the Cookie Policy and use its Cookie settings link to revisit a choice.
11. Your rights
Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability, or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. Direct-marketing objections are absolute. Rights can be limited by exemptions and do not always require deletion.
Submit the privacy rights request form or email privacy@orchardpms.com. We normally respond without undue delay and within one calendar month after receiving any information reasonably needed to verify identity or authority. Complex or multiple requests may take longer where law permits, and we will explain any extension. Do not send identity documents through the public form. If Orchard acts only as processor, we may refer the request to the relevant property manager and assist them.
12. Complaints
Please contact privacy@orchardpms.com first so we can investigate. You may also complain to the UK Information Commissioner's Office through its complaints service, or to another competent supervisory authority. Internal resolution does not restrict that right.
13. Children
Orchard accounts are for people aged 18 or over. We do not knowingly offer accounts to children. Contact us if you believe a child has created or been given an account.
14. Changes
We may update this policy to reflect changes in law, providers or the Service. Material changes will be notified by email or prominent in-Service notice at least 30 days in advance where practicable, unless an urgent legal or security change requires earlier effect. The effective date above identifies the current version.