Your information. Your choices.

This notice covers your Istos account, contact messages, housing conversations and requested AI calls.

Your account and housing profiles

We receive your Google account identifier, name and email to create and secure your account. We save the housing information you share, your chat messages, working drafts and reviewed renter or property profiles. This includes location preferences, practical constraints and the reasons behind your priorities so authorised Istos staff and future matching models can understand what matters to you. You may optionally share your profession or studies, employment arrangements, approximate income or funding, available evidence and references, guarantor availability and readiness to pay a deposit and initial rent. These are self-reported details; we do not verify income, documents or references. You can skip these questions. Do not upload income documents, identity documents, bank details or credit histories.

Your records are private to your account through the application. Istos Housing does not currently make matching, eligibility or referencing decisions, publish listings or share profiles with other participants.

AI conversations

OpenAI processes your chat messages and working housing profile to answer questions and prepare a structured draft. AI can misunderstand you. You can correct answers in the conversation and review the profile before confirming it for future matching. Your conversation is saved as you go so you can return later. The assistant compiles a structured draft from the conversation when it is ready for review or you ask to review it. It may use OpenAI web search for current public housing-market context; market claims link to their sources. Search instructions limit queries to public areas and home types, excluding names, income, contact details and private addresses. Only your confirmation updates the profile intended for matching. At review, you choose whether to allow future email introductions and whether income, employment and reference details may be included. These choices do not send an introduction today. Provider processing and retention are subject to their service policies.

Property photos

Property owners and authorised representatives upload photos separately from chat or calls. We store them privately in Supabase Storage and keep their references, order and optional captions in the database. Accepted images are resized and converted to WebP, with embedded metadata such as location information removed. At least three photos are required before a property can be made available for future introductions. They are currently visible only to their owner through the application and authorised Istos staff; they are not public listings. Photos can be removed or replaced. Removing a property or deleting an account also removes its photo records and files. Failed file cleanup is retained for retry.

Location preferences

We keep the areas and places you describe, why they matter, and any distance or journey limits you share. Our server sends place names or addresses to Photon, a geocoding service hosted by Komoot using OpenStreetMap data, to resolve coordinates and available area boundaries. UK postcodes are resolved through Postcodes.io using public postcode data. These lookups contain the place query, without your account details or the rest of your conversation. You can review and correct locations in your profile. Journey limits are preferences; we do not currently calculate routes.

Requested AI telephone calls

Calls happen only when you request a callback, confirm you control the number and consent to transcription and processing. The assistant identifies itself as AI. You can withdraw consent, skip a question or end the call at any time. Calls take up to ten minutes, and any remaining details can be finished in chat.

OpenAI and Twilio process your phone number, earlier housing conversation and live audio to prepare a profile draft. We do not record audio or enable stored OpenAI Live sessions. Temporary transcript fragments are encrypted before storage in a private database table, with the encryption key kept outside the database. We delete this text after processing, withdrawal of consent or account deletion, and expire it within 24 hours. Scheduled cleanup also runs independently of the call service. We keep consent, operational call identifiers, processing status, a profile snapshot, extracted drafts and one concise summary. Provider retention is governed independently by OpenAI and Twilio's policies; our deletion does not promise removal of their backups or telecommunications records. A call can update an unconfirmed working draft; it cannot overwrite a newer conversation or a confirmed profile. You review and correct it before saving. Location descriptions are resolved using the same place lookup as chat.

Contact messages

Our contact form sends your name, email and message to our inbox through Resend so we can respond. Messages are kept in the mailbox while needed for your enquiry and are not added to a mailing list or stored in the application database. Spam prevention counters use protected hashes of email and network addresses; expired counters are removed on subsequent submissions and contain no message text or raw addresses.

Services and retention

Supabase provides authentication, our database and private photo storage in London. Google provides sign-in, Vercel hosts the site, OpenAI provides chat and voice intelligence, and Twilio connects requested calls. Their subprocessors may process information outside the UK under their service and privacy terms. We keep your account, conversations and profiles while you use Istos. You can update your profile or pause participation in your housing workspace, and delete your account in account settings. Pausing retains your information. Account deletion removes linked database records, removes property photos and requests removal of temporary call text and supported Twilio call records. Independent provider backups and telecommunications records remain subject to provider retention policies.

Cookies and contact

We use essential authentication cookies to keep you signed in, without advertising cookies or analytics trackers. For access, correction, deletion or privacy questions, email hello@istoslabs.ai. You can also raise a concern with the UK Information Commissioner’s Office.