Effective 1st September 2026 · Version 1.1
Harthing is a record-keeping tool for private landlords. You use it to organise your compliance documents, log maintenance, track finances, and build a timestamped record of how you manage your properties. We store what you give us, keep it safe, and make it useful.
The full terms follow below, covering the same ground in the detail the law requires.
Harthing is operated by Harther Ltd, a company registered in England and Wales (company number 17075829), with its registered office at 124-128 City Road, London EC1V 2NX.
When we say "Harthing," "we," "us," or "our," we mean Harther Ltd. When we say "you" or "your," we mean you, the person or entity that has registered for an account.
You can contact us at [email protected].
For data protection queries specifically: [email protected].
For clarity throughout this document:
3.1 To use Harthing, you must be at least 18 years old and legally capable of entering into a binding agreement.
3.2 You must provide accurate information when creating your account. If anything changes, such as your email address or your contact details, please update your account or let us know.
3.3 You're responsible for keeping your login credentials secure. If you think someone else has accessed your account, tell us immediately at [email protected].
3.4 One person, one account. You may manage multiple properties from a single account, but you may not create multiple accounts for the same person or entity.
4.1 What Harthing does:
Harthing is a property management and compliance record-keeping tool. It helps you:
4.2 What Harthing does not do:
This is important, so we're going to be direct about it.
Harthing is an organisational tool, not a compliance service. We help you keep your records in order. We do not verify, validate, audit, or certify any of the information you enter. We do not check whether your gas safety certificate is genuine, whether your maintenance response times meet legal requirements, or whether your financial records are accurate for HMRC purposes.
Harthing does not provide legal, tax, financial, or regulatory advice. Nothing in the Service, including reminders, status indicators, dashboards, categorisation of transactions, or any automated feature, constitutes professional advice of any kind. If a compliance deadline appears on your dashboard, that's because you entered the data that generated it. If the underlying data is wrong, the reminder will be wrong too.
Harthing does not move money. Our open banking connection reads account and transaction information only. It cannot make payments, transfers, or any other instruction on your account.
Submitting to HMRC does not mean your return is correct. You remain responsible for the accuracy and completeness of everything submitted under your HMRC credentials, including how transactions have been categorised. A successful submission means HMRC accepted the file, not that the figures were right.
Expiry reminders and compliance alerts are courtesy notifications based on the data you provide. They are not guarantees of compliance. You remain solely responsible for meeting your legal obligations as a landlord.
The Accountability Record documents what you did; it does not confirm that what you did was sufficient. A timestamped record showing you uploaded a gas safety certificate does not mean the certificate is valid, current, or compliant. It means you uploaded it at that time. The evidential value of the record depends on the accuracy of the underlying data.
If you need legal advice, speak to a solicitor. If you need tax advice, speak to an accountant. If you need compliance verification, engage a qualified professional. We'd love to be all things to all landlords, but we'd rather be honest about what we are.
4.3 Open banking. If you choose to connect a bank account, that connection is provided through Yapily Connect Ltd, which is authorised and regulated by the Financial Conduct Authority as an account information service provider. Harther Ltd is not itself authorised by the FCA and does not hold your banking credentials. You authorise the connection with your bank directly, and the consent you give is subject to the wording shown to you at the point of connection.
The connection reads account and transaction data only. You can disconnect it at any time from within the Service. Disconnecting withdraws the underlying consent and stops any further data being read. Data already imported before you disconnect remains in your records, because it forms part of your financial history and your Accountability Record. If you want that imported data removed as well, contact us and we will handle it as a privacy request.
4.4 Making Tax Digital. If you choose to connect Harthing to HMRC, you authorise us to prepare and submit information to HMRC on your behalf under Making Tax Digital for Income Tax Self Assessment. This requires us to hold your National Insurance number and the credentials HMRC issues when you authorise the connection.
While your connection is active, you can correct figures for the current period and submit again. Whether an older period can still be amended is governed by HMRC's own time limits rather than by us.
You can disconnect at any time. When you disconnect, we delete the credentials we hold, and we can no longer submit anything on your behalf, including a correction. We cannot cancel or reverse anything at HMRC's end. If you want to remove an authorisation recorded on HMRC's own systems, you do that directly with HMRC.
5.1 You own your Content. Uploading data to Harthing does not transfer ownership to us. Your documents, records, and data remain yours.
5.2 You grant us a licence to process your Content solely for the purpose of providing the Service. This licence is limited, non-exclusive, and lasts only for as long as your Content remains on the Service. We will not use your Content for any purpose beyond operating and improving the Service for you.
5.3 You are responsible for the accuracy of your Content. We don't review, verify, or validate what you upload. If you upload an expired gas safety certificate and mark it as current, Harthing will treat it as current. The responsibility is yours.
5.4 Tenant Data. When you enter Tenant Data into Harthing, you are acting as the data controller for that data under UK GDPR. Harther Ltd processes Tenant Data on your behalf as a data processor. The terms governing this relationship are set out in the Data Processing Schedule (Schedule 1) at the end of this document.
5.5 Telling your tenants. Because you are the controller of Tenant Data, the duty under UK GDPR Article 14 to inform your tenants that their personal data is being processed is yours, not ours. You warrant that you have given, or will give, your tenants the information the law requires. We may provide templates or tools to help you do this, but using them, and the accuracy of what you send, remains your responsibility.
5.6 Data portability. You can export your data at any time while you have access to the Service, including throughout the Read-Only Period described in 7.9. If you ask us for a copy after that, we'll provide your data in a standard, machine-readable format on request. Details of our data retention periods are set out in our Privacy Policy.
5.7 Your Own Data. Some of the personal data in the Service is about you rather than about your tenants: your account details, your National Insurance number, your HMRC connection, the figures we prepare and submit to HMRC, your Bank Data, and your subscription and payment records.
For that data, Harther Ltd is the data controller, not your processor, and Schedule 1 does not apply to it. This is not a change in how we handle it. It reflects the fact that we decide certain things about that data ourselves, including how long we keep it and how we meet our own legal obligations, which a processor acting only on your instructions could not do. Our Privacy Policy sets out what we hold, why, on what lawful basis, and for how long.
Harthing is built for property management. Use it for that.
6.1 You agree to use the Service only for lawful purposes related to the management of residential property, and in accordance with these Terms.
6.2 You must not:
6.3 Prohibited content, Online Safety Act 2023 compliance
Harthing is classified as a user-to-user service under the Online Safety Act 2023. You must not upload, store, or transmit through the Service any content that constitutes illegal content as defined by that Act. This includes, but is not limited to:
6.4 Content reporting. If you encounter any content on the Service that you believe is illegal or violates this Acceptable Use Policy, please report it immediately to [email protected]. We will review all reports promptly and take appropriate action, which may include removing content, suspending accounts, and reporting to law enforcement where required by law.
6.5 Our enforcement rights. We reserve the right to remove any Content and suspend or terminate any Account that violates this Acceptable Use Policy, without prior notice where we reasonably believe the content is illegal or poses an immediate risk. Where we become aware of CSAM or terrorism content, we are legally required to report it to the relevant authorities and to retain relevant information securely.
7.1 Pricing. Harthing is a paid subscription service, priced in bands according to the number of properties you manage. Current prices and bands are published at harthing.co.uk and form part of these Terms. All prices include VAT where applicable.
7.2 Free periods. Some accounts have a period of free access, the length of which depends on when and how you signed up. Where you have been offered a free period, its length is as stated to you at the time, and it runs from the date paid pricing goes live for your account. A free period is a benefit, not a trial: nothing is evaluated and nothing is withheld during it. When it ends, your subscription begins at the price then published for your band unless we have told you otherwise.
7.3 Billing. Subscriptions are billed in advance, monthly or annually depending on the plan you choose. You authorise us to charge your chosen payment method on a recurring basis until you cancel. Payments are processed by Stripe; we do not store your card details ourselves.
7.4 Changing bands. If the number of properties in your account changes so that you fall into a different band, your subscription moves to the price published for that band. This is not a price increase and 7.5 does not apply to it: the price list has not changed, your position on it has. We will tell you before a band change takes effect, and it will take effect from your next billing date rather than immediately.
7.5 Price changes. If we increase the published price for your band, we'll give you at least 30 days' notice and the option to cancel before the new price takes effect. If you cancel in that window, 7.7 and 7.9 apply as normal and you keep everything you have paid for.
7.6 Failed payment. If a payment fails, we'll let you know and give you a reasonable period to resolve it before restricting access. We will not treat a failed payment as a cancellation without telling you first.
7.7 Cancellation. You can cancel your subscription at any time. Cancellation takes effect at the end of the Paid Period, meaning the end of the month or the year you have already paid for, not immediately and not at the end of the calendar month. You keep full access until that date and we withdraw nothing before it. We don't do exit interviews, guilt trips, or dark patterns. If you want to leave, you leave.
Cancellation cannot be reversed from within the Service. If you change your mind, contact us.
7.8 Refunds. Because cancellation takes effect only at the end of the Paid Period, and because nothing is withdrawn before then, you receive the full period you paid for and no refund arises. This applies to annual plans as well as monthly ones. If you believe you've been charged in error, contact us and we'll sort it out.
We don't close your account the day you stop paying, and we don't delete your records. Your Accountability Record may matter to you long after you have left, and it may matter to a tenant, a tribunal, or HMRC. What follows is what actually happens, in order.
(a) Until the end of your Paid Period. Nothing changes. You have full access to everything, exactly as before.
(b) The Read-Only Period, twelve months. At the end of your Paid Period your account becomes read-only for twelve months. You can sign in, view everything, and export everything, including your full Accountability Record and Evidence Bundles. You cannot add, edit, or delete anything.
At the start of the Read-Only Period, and not at the end of it, two connections end:
(c) Advance warning. We will email you before the Read-Only Period ends, while you can still sign in and export, to tell you that your account is due to close and by when. Please keep your email address up to date, because this is the only warning you will get and you will not be able to receive an in-app message once the account has closed.
(d) Account Closure. At the end of the twelve months, your account closes and you can no longer sign in. Your records are not deleted at this point. They are retained in line with our Privacy Policy.
(e) Recovery window, ninety days. For ninety days after Account Closure, your account can be recovered. This is not self-service: you contact us and we do it. After that window, recovery is no longer available.
(f) Deletion. Only after all of the above can anything be permanently deleted, and deletion is never automatic. It requires a person at Harther to decide on it, and it remains subject to the retention periods in our Privacy Policy, which are longer than this sequence in most cases.
Two different clocks. These are easy to confuse, so to be explicit: how long you can sign in and look at your records is twelve months from the end of your Paid Period. How long we keep your records is set out in the Privacy Policy and is generally six years. The second is much longer than the first. Losing the ability to sign in does not mean your records have gone, and it does not stop you asking us for a copy.
7.10 Updated Terms and re-acceptance. Where we make a material change to these Terms, we may require you to accept the updated version before continuing to use the Service (see 14). If you have not yet accepted an update that we have required, we will pause billing rather than charge you for a service you cannot fully use. If the update remains unaccepted after a reasonable period, we will treat the subscription as cancelled and 7.7 and 7.9 will apply, meaning you keep what you have paid for and then enter the Read-Only Period as normal.
8.1 The Service, including its design, code, branding, text, graphics, and underlying technology, is owned by Harther Ltd and is protected by copyright, trademark, and other intellectual property laws.
8.2 These Terms grant you a limited, non-exclusive, non-transferable, revocable licence to use the Service for its intended purpose during your subscription.
8.3 You must not copy, modify, distribute, sell, or create derivative works based on any part of the Service without our written permission.
8.4 "Harthing," "Letterlea," "Harther," and associated logos and marks are trademarks of Harther Ltd. You may not use them without our prior written consent.
9.1 We aim to keep the Service available and reliable, but we don't guarantee uninterrupted access. Maintenance, updates, and circumstances beyond our control (internet outages, infrastructure failures, acts of God) may cause temporary disruption.
9.2 We may modify, update, or discontinue features of the Service from time to time. Where changes are material, we'll give you reasonable notice. We won't remove core functionality (the Accountability Record, Evidence Bundle, compliance document storage) without at least 90 days' notice.
9.3 Some features depend on third parties, including your bank, our open banking provider, and HMRC. Where one of those is unavailable, changes its rules, or withdraws access, the corresponding feature may be interrupted or discontinued. We'll tell you if that happens, but we can't guarantee the availability of a service we don't operate.
9.4 The Service is currently in its early stages. Features will be added, refined, and occasionally retired as the product develops. We appreciate your patience and your feedback. Both help us build something better.
10.1 To the maximum extent permitted by law, Harther Ltd's total liability to you for any claims arising from or related to these Terms or your use of the Service is limited to the amount you have paid to us in the 12 months preceding the claim.
10.2 We are not liable for any indirect, incidental, consequential, special, or punitive damages, including but not limited to loss of profits, data, business, or goodwill, however caused.
10.3 Specifically, and without limiting the above:
10.4 Nothing in these Terms excludes or limits our liability for death or personal injury caused by our negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be excluded or limited by law.
You agree to indemnify and hold harmless Harther Ltd, its directors, employees, and agents from and against any claims, damages, losses, liabilities, and expenses (including reasonable legal fees) arising out of or related to:
12.1 By you. You may stop using Harthing at any time by cancelling your subscription. Cancellation ends billing and starts the sequence set out in 7.9: full access to the end of your Paid Period, then twelve months read-only, then Account Closure, then a ninety-day recovery window.
Account Closure ends your ability to sign in. It does not by itself delete your records, which are retained for the periods set out in our Privacy Policy. If you want your personal data erased sooner, you can make an erasure request under UK GDPR and we will consider it against the limitations described in the Privacy Policy, including those that apply to the Accountability Record.
12.2 By us. We may suspend or terminate your account if:
12.3 Where we terminate your account, we'll provide you with a reasonable opportunity to export your data, except where we are legally prohibited from doing so (for example, where content has been reported to law enforcement).
12.4 Sections that should survive termination (limitation of liability, indemnification, intellectual property, and data processing obligations) will survive.
13.1 If you have a complaint about the Service, contact us first at [email protected]. We'd rather sort things out directly than through lawyers.
13.2 These Terms are governed by the laws of England and Wales. Any disputes that can't be resolved informally will be subject to the exclusive jurisdiction of the courts of England and Wales.
14.1 We may update these Terms from time to time. If we make material changes, we'll notify you by email or through the Service at least 30 days before they take effect.
14.2 Where a change is material, we may require you to accept the updated Terms before you can continue using the Service or particular features of it. Section 7.10 explains what happens to your billing while an update is outstanding.
14.3 Continued use of the Service after changes take effect constitutes acceptance of the updated Terms. If you don't agree, you may cancel before the changes apply.
14.4 We'll keep previous versions of these Terms available on request, and we keep a record of which version you accepted and when.
15.1 If any provision of these Terms is found to be unenforceable, the remaining provisions continue in full force and effect.
15.2 Our failure to enforce any right or provision of these Terms does not constitute a waiver of that right or provision.
15.3 These Terms, together with our Privacy Policy, Cookie Policy, the pricing published at harthing.co.uk, and the Data Processing Schedule below, constitute the entire agreement between you and Harther Ltd regarding the Service.
15.4 You may not assign or transfer your rights under these Terms without our consent. We may assign our rights and obligations to an affiliate or successor.
This Schedule forms part of the Terms of Use and sets out the terms on which Harther Ltd processes personal data on your behalf under UK GDPR Article 28.
1.1 For the purposes of this Schedule:
1.2 This Schedule applies to Tenant Data and to any other personal data about identifiable individuals other than the Controller that the Controller enters into the Service.
1.3 This Schedule does not apply to Your Own Data as defined in Section 2 and described in Section 5.7 of the Terms. For that data Harther Ltd is a controller in its own right, and the Privacy Policy governs it.
1.4 The Processor's role under this Schedule applies while the Controller's account is open, including throughout the Read-Only Period. Following Account Closure, Harther Ltd retains certain tenancy-related data as an independent controller for the periods set out in the Privacy Policy. The Privacy Policy describes this change of role.
2.1 Subject matter and purpose: The processing of personal data by the Processor is necessary for the provision of the Harthing property management service. The Processor stores, organises, retrieves, and presents the Controller's data within the Service, generates notifications and reminders at the Controller's direction, and produces exports and reports as requested by the Controller.
2.2 Duration: Processing continues for the duration of the Controller's subscription, through the Read-Only Period, and thereafter for the retention periods set out in the Privacy Policy.
2.3 Types of personal data processed:
2.4 Categories of data subjects:
3.1 The Controller warrants that it has a lawful basis under UK GDPR for processing the personal data it enters into the Service, and that it has provided (or will provide) appropriate notices to data subjects as required by law.
3.2 In particular, the duty under Article 14 to inform tenants and other third parties that their personal data is being processed rests with the Controller. The Processor does not discharge that duty on the Controller's behalf. Where the Processor makes templates or tools available to help, their use and content remain the Controller's responsibility.
3.3 The Controller is responsible for the accuracy of all personal data entered into the Service and for responding to data subject rights requests in a timely manner (with our assistance as set out below).
4.1 Instructions. The Processor will process personal data only on documented instructions from the Controller. The Controller's instructions are defined by the Controller's use of the Service (uploading data, configuring settings, requesting exports). The Processor will not process personal data for any purpose other than providing the Service unless required by law, in which case the Processor will inform the Controller before processing (unless prohibited by law from doing so).
4.2 Confidentiality. The Processor ensures that all persons authorised to process personal data are bound by appropriate confidentiality obligations.
4.3 Security measures. The Processor implements appropriate technical and organisational measures to protect personal data, including:
4.4 Sub-processors. The Processor uses third-party sub-processors to provide the Service, including cloud hosting and storage, authentication, transactional email and notifications, error monitoring, and automated document analysis. A current list of sub-processors is available on request from [email protected]. The Processor will notify the Controller of any new sub-processors at least 14 days before they begin processing, giving the Controller an opportunity to object. If the Controller objects and the matter cannot be resolved, the Controller may terminate the Service.
4.5 Data subject rights. The Processor will assist the Controller in responding to requests from data subjects exercising their rights under UK GDPR (access, rectification, erasure, restriction, portability, objection). Where a data subject contacts the Processor directly about data the Controller controls, the Processor will direct them to the Controller and, where it can identify the Controller, tell the Controller that the request has been made.
4.6 Data breach notification. The Processor will notify the Controller without undue delay (and in any event within 72 hours of becoming aware) of any personal data breach affecting the Controller's data, providing sufficient detail for the Controller to meet its own notification obligations to the ICO and to affected data subjects.
4.7 Data Protection Impact Assessments. The Processor will provide reasonable assistance to the Controller in conducting Data Protection Impact Assessments where required.
4.8 Audit. The Processor will make available to the Controller all information necessary to demonstrate compliance with this Schedule and will allow for and contribute to audits and inspections conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice and scope limitations.
5.1 The Processor will not transfer personal data outside the United Kingdom unless adequate safeguards are in place in accordance with UK GDPR (such as an adequacy decision, standard contractual clauses, or binding corporate rules).
5.2 Where sub-processors are located outside the UK, appropriate transfer mechanisms will be documented and made available on request.
6.1 Export. The Controller can export its data at any time while it has access to the Service, including throughout the Read-Only Period, which runs for twelve months after the end of the Paid Period. After Account Closure, the Processor will provide the Controller's data in a standard, machine-readable format on request.
6.2 Retention rather than deletion on closure. Account Closure does not trigger deletion. Tenancy-related personal data is retained after Account Closure for the periods set out in the Privacy Policy, which are generally six years, because both the Controller and the data subjects may need that record during the limitation period under the Limitation Act 1980. Harther Ltd retains that data as an independent controller.
6.3 Deletion. Deletion occurs at the end of the applicable retention period, or earlier where the Processor accepts an erasure request, and is subject to the limitations described in the Privacy Policy including those that apply to the Accountability Record. Deletion is a deliberate act and is never automatic.
6.4 Backups. Where data has been deleted from active systems, backup copies are placed beyond use and are removed in accordance with the Processor's standard backup rotation.
7.1 The liability of each party under this Schedule is subject to the limitations set out in Section 10 of the Terms of Use.