We collect as little as we can. We don't use advertising trackers, and we never sell personal data.
Who we are
The Million Dollar Flat is run by Decode & Grow Ltd, Cardiff, Wales. We are a company registered in England and Wales. We are the data controller, registered with the Information Commissioner's Office (ICO) under number ZC120811.
Contact us about privacy at decodengrow.com.
What we collect and why
| Who you are | What we collect | Why | Lawful basis (UK GDPR) | How long we keep it |
|---|---|---|---|---|
| Waitlist sign-up | Email address, the room you chose, sign-up date | To email you when that room opens | Consent | Until you unsubscribe or the last room opens |
| Brand tenant | Email, brand name, tagline, website, uploaded image, Stripe customer and subscription IDs, payment history | To run your placement, bill you and send renewal reminders | Contract; legal obligation (accounting) | Length of tenancy + 6 years |
| Anyone who chats with Natasha | Your messages and her replies, linked to a random per-tab ID (no name or email) | To generate replies, enforce message limits and improve her answers | Legitimate interests | 90 days |
| Anyone using the chat, waitlist or report form | A keyed hash of your IP address (a pseudonymous code, not the IP itself), with the time | To stop spam and abuse | Legitimate interests | 7 days |
| Anyone who reports a placement | Your email, the placement and your description | To deal with the report and reply to you | Legitimate interests; legal obligation | 2 years |
| All visitors | Page visited, referring website, phone or not, which placements you opened or clicked, a random per-tab ID | To publish the public numbers on our stats page and give tenants their monthly report | Legitimate interests | 2 years |
We don't store IP addresses, names or browser fingerprints for visit statistics. You can switch them off; see Your rights.
Please don't put personal information in the chat. Messages are sent to an AI model to generate replies (see Who we share it with).
Who we share it with
We use these service providers, who process data only on our instructions:
| Provider | What they do for us | Data involved |
|---|---|---|
| Lovable | Hosts the site and runs the AI gateway that connects Natasha to her model | Everything above |
| Supabase | Database behind the site | Everything above |
| Stripe | Payments, subscriptions and the billing portal | Brand tenants' payment and billing details |
| Google (Gemini) | The AI model that writes Natasha's chat replies and diary | Chat messages |
Stripe may also use payment data as an independent controller, for example for fraud prevention and its legal duties. Its own privacy policy covers that.
We may also share data if the law requires it, or to protect our rights.
International transfers. Some providers process data outside the UK, including in the US and the EU. When they do, we rely on UK adequacy regulations (EU), the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
Your rights
You can ask us to:
- give you a copy of your data
- correct or delete it
- restrict how we use it, or object to our use of it
- send it to you or another organisation in a portable format
You can withdraw consent at any time, for example by using the unsubscribe link in any waitlist email. Email decodengrow.com to use any of these rights. We reply within one month.
Turning off visit statistics. Use the "Don't count my visits" switch on this page. We also stop counting automatically if your browser sends Global Privacy Control or Do Not Track. Our Cookie Policy lists what we store in your browser.
Children. The site is for adults aged 18 and over. We don't knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.
Automated decisions. Natasha's replies are generated automatically, but no decision with legal or similarly significant effects is made about you by automated means.
Changes. We will post any changes here and update the date at the top. If a change materially affects tenants or waitlist members, we will also email them.
Complaints. If you're unhappy with how we handle your data, please tell us first. You can also complain to the ICO at ico.org.uk/make-a-complaint.