Privacy Policy
Last updated: 29 May 2026
This privacy policy explains how Metusa Property Ltd, trading as Metalyzi, collects, uses, stores, and shares your personal data when you use our website and services. We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
Metalyzi is a trading name of Metusa Property Ltd, a company registered in England and Wales under company number 15651934. Our registered address is 9D Worrall Street, Salford, Manchester, M5 4TZ.
For the purposes of the UK GDPR, Metusa Property Ltd is the data controller responsible for your personal data. If you have any questions about how we process your data, you can contact our Data Protection Officer at contact@metalyzi.co.uk.
2. What Data We Collect
We may collect and process the following categories of personal data:
- Account data: Your name, email address, and password when you create an account with us. If you choose to sign in with Google instead, we receive a limited profile (see section 6 below) rather than a password.
- Property analysis data: Property details, addresses, financial figures, and other information you input when using our property analysis tools.
- Payment data: When you subscribe to a paid plan, payment processing is handled by Stripe. We do not store your full credit or debit card details on our servers. Stripe may collect your card number, expiry date, CVC, and billing address directly. Please refer to Stripe's Privacy Policy for further information.
- Usage and analytics data: Information about how you interact with our platform, including pages visited, features used, time spent on pages, browser type, device information, IP address, and referring URLs.
- Cookies and similar technologies: We use cookies and similar tracking technologies to enhance your experience, remember your preferences, and analyse site traffic. You can manage your cookie preferences through your browser settings. For more information, please see our Cookie Policy.
3. Legal Basis for Processing
We process your personal data on the following legal bases under the UK GDPR:
- Performance of a contract (Article 6(1)(b)): We process your account data, property analysis data, and payment data as necessary to provide you with our services and fulfil the terms of your subscription.
- Legitimate interests (Article 6(1)(f)): We process usage and analytics data to improve our platform, ensure security, detect fraud, and understand how users interact with our services. We have carried out a legitimate interests assessment and concluded that these interests do not override your rights and freedoms.
- Consent (Article 6(1)(a)): Where we send you marketing communications or use non-essential cookies, we do so based on your consent. You can withdraw your consent at any time by contacting us or using the unsubscribe link in our emails.
4. How We Use Your Data
We use the personal data we collect for the following purposes:
- To provide and maintain our services: Including creating and managing your account, processing your property analyses, and delivering the results to you.
- To improve our platform: Analysing usage patterns and feedback to enhance features, fix issues, and develop new functionality.
- To communicate with you: Sending service-related notifications, responding to your enquiries, and, where you have consented, sending marketing communications about new features or updates.
- To process payments: Facilitating subscription payments through Stripe and managing your billing information.
- To ensure security and prevent fraud: Monitoring for suspicious activity and protecting the integrity of our platform.
- To comply with legal obligations: Where required by law, regulation, or legal process.
5. Who We Share Your Data With
We do not sell your personal data to any third party. We may share your data with the following trusted service providers who assist us in operating our platform:
- Stripe: Processes payments on our behalf. Stripe receives your payment card details and billing information to complete transactions securely.
- Supabase: Provides database hosting and authentication services. Your account data and property analysis data are stored on Supabase infrastructure.
- Anthropic:Provides AI-powered analysis capabilities. Property data you submit may be sent to Anthropic's API for processing and analysis. Anthropic processes this data in accordance with their data processing terms.
- Vercel: Hosts our web application. Vercel may process technical data such as IP addresses and request logs as part of delivering the service.
- Brevo (formerly Sendinblue): Handles transactional and marketing email delivery. Your email address and name may be shared with Brevo to send you service notifications and, where you have consented, marketing communications.
- Google (Sign in with Google): If you choose to authenticate with Google, Google acts as an identity provider and shares a limited profile with us (see section 6). We do not share any Metalyzi data back to Google beyond what is required to complete the OAuth sign-in flow.
We may also disclose your data if required to do so by law or in response to valid requests by public authorities, such as a court order or government agency.
6. Google User Data (Sign in with Google)
Metalyzi offers “Sign in with Google” as an optional way to create or access your account. This section sets out what Google user data we receive, how we use it, where we store it, and what we do not do with it. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6.1 Data we access from your Google account
When you sign in with Google, we request only the basic profile scopes required to identify you and create your Metalyzi account. Specifically:
- openid— a unique, stable Google account identifier (the “sub” claim) used to recognise returning users.
- email — your primary Google email address and its verified status, used as your Metalyzi account email.
- profile — your display name and (where provided) your Google profile picture URL, used to personalise the Metalyzi interface.
We do not request, access, or process any other Google user data. We do not read your Gmail, Calendar, Drive, Contacts, YouTube, Photos, or any other Google service data, and we do not request scopes that would give us that access.
6.2 How we use this data
- Authentication: the Google account identifier and email are used to create your Metalyzi account on first sign-in and to sign you back in on subsequent visits.
- Account communications: the email address is used to send you service-related notifications (e.g. receipts, security alerts) and, only with your separate consent, marketing emails.
- Personalisation: your name and profile picture are displayed to you in the navigation bar and account pages so you can confirm which account you are signed into.
6.3 How we store this data
Google profile data is stored in our authentication database operated by Supabase (see section 5), in the same record as your Metalyzi account. It is encrypted at rest by the database provider and transmitted over TLS. We do not store your Google password — that always stays with Google.
6.4 How we share this data
We do not sell, rent, or share Google user data with any third party for advertising, profiling, or other unrelated purposes. We do not use Google user data to train, develop, or improve generalised or non-personalised AI/ML models. The only processors who handle Google profile data are the same operational subprocessors listed in section 5 (Supabase for storage, Vercel for hosting, Brevo for email delivery) and they may only process it on our instructions to run the service for you.
6.5 Revoking access and deleting your data
You can revoke Metalyzi's access to your Google account at any time from your Google Account permissions page. Revoking access will prevent future sign-ins via Google but does not on its own delete your Metalyzi account. To delete your Metalyzi account and the Google profile data associated with it, email contact@metalyzi.co.uk — we will erase the data within 30 days as set out in section 7 (formerly section 6).
7. Data Retention
We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected:
- Account data: Retained for as long as your account is active. If you delete your account, we will erase your personal data within 30 days, unless we are required to retain it for legal or regulatory reasons.
- Property analysis data: Retained for as long as your account is active and deleted upon account closure, unless you request earlier deletion.
- Payment data: Transaction records are retained for up to 7 years to comply with tax and accounting obligations. Stripe retains payment card details in accordance with their own retention policies.
- Usage and analytics data: Retained in an anonymised or aggregated form for up to 24 months for analytical purposes.
- Marketing consent records: Retained for as long as necessary to demonstrate compliance with consent requirements.
8. Your Rights Under UK GDPR
Under the UK GDPR, you have the following rights in relation to your personal data:
- Right of access: You have the right to request a copy of the personal data we hold about you.
- Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data.
- Right to erasure: You have the right to request that we delete your personal data, subject to certain legal exceptions.
- Right to restrict processing: You have the right to request that we limit how we use your personal data in certain circumstances.
- Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
- Right to object: You have the right to object to processing based on legitimate interests or for direct marketing purposes.
- Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
9. How to Exercise Your Rights
To exercise any of your rights, please contact our Data Protection Officer by email at contact@metalyzi.co.uk. We will respond to your request within one month of receipt. In some cases, we may need to verify your identity before processing your request. If your request is complex or we receive a large number of requests, we may extend the response period by a further two months, in which case we will inform you of the extension and the reasons for it.
There is no fee for exercising your rights, unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.
10. International Data Transfers
Some of the third-party service providers we use (including Stripe, Supabase, Anthropic, Vercel, Brevo, and Google) may process your data outside the United Kingdom. Where personal data is transferred to a country that has not been deemed to provide an adequate level of data protection by the UK Secretary of State, we ensure that appropriate safeguards are in place to protect your data. These safeguards include the use of Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner, or the International Data Transfer Agreement (IDTA) where applicable.
You may request a copy of the relevant safeguards by contacting our Data Protection Officer at contact@metalyzi.co.uk.
11. Children's Privacy
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have collected personal data from a child under 18 without appropriate parental consent, we will take steps to delete that information as soon as possible. If you believe that we may have collected data from a child under 18, please contact us immediately at contact@metalyzi.co.uk.
12. Changes to This Privacy Policy
We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by updating the date at the top of this policy and, where appropriate, by sending you an email notification or displaying a prominent notice on our website. We encourage you to review this policy periodically to stay informed about how we are protecting your data.
13. How to Make a Complaint
If you are unhappy with how we have handled your personal data, we encourage you to contact our Data Protection Officer first at contact@metalyzi.co.uk so that we can try to resolve the issue.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO using the following details:
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
14. Contact Us
If you have any questions about this privacy policy or our data practices, please contact us: