Privacy Policy
Version 1.1 · November 2026. This policy explains how Wildstone Enterprises Ltd (company number 17090475), trading as Deal Foundry by Wild Stone, uses personal data, under UK GDPR and the Data Protection Act 2018. It covers this website and the Deal Foundry platform.
1. Who we are
For the data described in section 2, we are the controller. Contact us at office@wsdealfoundry.co.uk or 78 Glasshouse Lane, Exeter, EX2 7BZ. ICO registration number: ZC254209.
Data that sourcers put on the platform about their own investors and contacts is different. For that, the sourcer is the controller and we process it on their behalf under our Data Processing Agreement. If you are an investor with questions about that data, contact the sourcer who added you first.
This includes the leads a sourcer keeps about estate agents and property owners, their viewing notes, and the progress updates they send investors. When you enquire about a deal or message a sourcer as an investor, we pass your name, email, phone number (if you gave it) and investment criteria to that sourcer, and they become a controller of that information too.
2. What we collect and why
| Data | Examples | Why we use it | Lawful basis |
|---|---|---|---|
| Account details | Name, email, phone, password (stored securely, never in plain text), role | To create and run your account | Contract |
| Billing details | Billing name and address, subscription status. Card details are held by our payment provider, not us | To take payment and keep tax records | Contract, legal obligation |
| Agreement records | Which version of our terms you accepted and when | To prove what was agreed | Legitimate interests, legal obligation |
| Investor profile and statement | For Marketplace Investors: name, phone, company, areas, strategies, budget and funding; which investor statement you confirmed (high net worth or self-certified sophisticated) and when | To show you deals on the wall that suit you, and to keep a record that the wall is shown only to investors who have confirmed a statement | Contract, legal obligation, legitimate interests |
| Enquiries, messages and alerts | Messages between investors and sourcers, when they were read, and the emails we send about them; new-deal alerts you asked for | To deliver messages, tell you about replies, and send the alerts you chose. You can turn alerts off in your investor profile | Contract |
| Property searches | Postcodes, addresses and filters you search with Find deals, sold prices and EPC lookups; how many searches you have used | To get the results from our data providers and keep count of your search allowance | Contract |
| Security and usage data | Sign-in times, IP address, device and browser, actions in your account | To keep accounts secure, prevent fraud and fix problems | Legitimate interests |
| Support messages | Emails and messages you send us | To help you | Contract, legitimate interests |
| Marketing preferences | Whether you opted in to product emails | To send updates you asked for | Consent, which you can withdraw any time |
| Cookies | See the Cookie Policy | To run and improve the site | Necessary use, or consent |
If you visit this website without signing in, we collect nothing except standard server logs kept by our web host for security. The stamp duty calculator runs entirely in your browser.
If you open a deal page from a sourcer's share link, we count the visit for the sourcer, but we do not record who you are.
We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell personal data.
3. Who we share it with
We share personal data only with suppliers who help us run Deal Foundry, under contracts that require them to protect it:
- hosting, database, logins and file storage: Supabase, with data stored in London (AWS eu-west-2)
- payments: Stripe
- email delivery and website hosting: IONOS
- e-signing: built into Deal Foundry, with no third-party provider
- identity and AML checks, where a sourcer uses them: Credas
- property data lookups: PropertyData, HM Land Registry and the government's energy performance certificate register. We send them only property details, such as a postcode or address, never your name or contact details
We also share data between users where you ask us to: when you enquire about a deal or message a sourcer, they see your name, contact details and criteria; when a sourcer shares a deal or sends an update, the investors they chose see it.
We may also share data where the law requires it, for example with HMRC, the police or a court, or to protect our rights. If Deal Foundry is sold or restructured, data may pass to the new owner under this policy.
4. Where your data is stored
We store data in the UK or the European Economic Area. If a supplier transfers data elsewhere, we make sure it is protected by UK adequacy regulations or approved contract terms, such as the UK International Data Transfer Agreement or Addendum.
5. How long we keep it
| Data | Kept for |
|---|---|
| Account and content | While your account is open, then 30 days for export, then deleted |
| Billing and tax records | 6 years after the financial year they relate to |
| Agreement records | 6 years after your account closes |
| Security logs | 12 months |
| Investor statement records | 6 years after the statement was given |
| Messages | While both accounts in the conversation are open, then deleted with the account that closes |
| Saved search results | Up to 30 days |
| Marketing preferences | Until you withdraw consent or close your account |
6. Your rights
You have the right to:
- ask for a copy of your data,
- ask us to correct it,
- ask us to delete it,
- ask us to restrict how we use it,
- object to us using it for legitimate interests or marketing,
- ask for your data in a portable format,
- withdraw consent at any time, where we rely on consent.
Email office@wsdealfoundry.co.uk. We will reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to sort it out first.
7. Security
We protect data with encryption in transit and at rest, strict separation between accounts enforced in the database, hashed passwords, access logs, daily backups and regular security reviews. No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the ICO as the law requires.
8. Children
Deal Foundry is not for anyone under 18, and we do not knowingly collect their data.
9. Changes
We will post updates here and email you about important changes.