Privacy policy

Oscar is a property search service that starts with a brief you own. For the purposes of UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Oscar is the controller of the personal information described in this policy. That means we decide how and why it is used, and we are responsible for looking after it.

This policy covers our website, the Oscar conversation and search experience, your account and any emails we send you. It does not cover the websites of estate agents or other businesses you reach through Oscar. They have their own privacy policies.

Information you give us

• Your brief and conversations. What you tell Oscar about the home you are looking for, such as the area, budget, size, timing, must-haves and anything else you choose to mention, along with Oscar’s replies.
• The structured brief Oscar builds from it. For example the type of property, location, number of bedrooms, price range, features you need, deal breakers and timeline.
• Account details. Your email address and, if you give it, your first and last name.
• Messages to us. Anything you send when you contact us.

Please only share what is needed to describe your search. You do not need to tell Oscar about your health, religion, ethnicity or other sensitive matters, and we ask that you don’t.

Information created when you use Oscar

• Identifiers. A random account identifier, created the first time you visit so your search can be saved before you sign in.
• Sign-in information. One-time codes we email to you, and when you last signed in.
• Approximate location. We use your IP address to estimate your town or city, country, time zone and rough coordinates, so Oscar can make sensible suggestions. We do not ask for your precise location and we do not save this estimate to your account.
• Technical and security information. Your IP address and request details, which our systems record briefly in logs to keep the service running and secure.
• Aggregate usage. Page views and referrers counted by our privacy-first analytics provider, which does not use cookies or build a profile of you.

Information from others

If you sign in through our identity provider, we receive your email address and name from it. In future, when an agent responds to an introduction you asked for, we will record that response so you can see it.

We use your information to:

• Understand your brief, read it back to you and keep it up to date as your plans change.
• Find and explain homes that match your brief, including where a home falls short.
• Create and secure your account, and let you pick up your search on another device.
• Send the emails you need, such as sign-in codes.
• Keep Oscar safe, prevent misuse and fix problems.
• Understand, in aggregate, how the service is used so we can improve it.
• Meet our legal and regulatory obligations.

We do not use your information for advertising, and we do not let anyone pay to change where a home appears in your matches.

UK data protection law requires us to have a lawful basis for each use of your information. We rely on:

• Contract. To provide the service you asked for: building your brief, finding matches and running your account.
• Legitimate interests. To keep Oscar secure, prevent fraud and misuse, estimate your approximate location, and measure how the service is used in aggregate. We only rely on this where our interests are not outweighed by your rights.
• Consent. To share your details with an agent, and to send marketing emails if we ever offer them. You can withdraw consent at any time, without affecting anything we did before.
• Legal obligation. Where the law requires us to keep or disclose information.

Oscar uses AI models to hold a conversation with you, turn what you say into a structured brief, suggest questions and explain why a home does or doesn’t fit. Your conversation, first name if you have given it, and approximate location are sent to our AI provider to produce each reply. If you ask Oscar to read a reply aloud, the text of that reply is sent to create the audio.

AI can misunderstand or get things wrong. Please check the brief Oscar reads back to you and correct anything that isn’t right.

Oscar does not make decisions about you that have legal or similarly significant effects. Whether an agent offers you a viewing, and whether a seller accepts an offer, is always decided by people.

Agents do not have access to your account, your conversations or your contact details. Oscar does not currently pass any of your personal information to agents.

When we introduce the ability to reach agents through Oscar, it will work like this:

• Nothing about you is shared until you ask for an introduction to a specific home.
• Before anything is sent, you will see exactly what the agent will receive and who they are.
• Agents first receive only what they need to judge whether the home suits you, such as the parts of your brief that matter to it. Your name and contact details follow only with your agreement.
• Sharing with one agent is never permission to share with others or to add you to marketing lists.
• Once an agent has your details, they use them as an independent controller under their own privacy policy.

We use carefully chosen providers to run Oscar. They act on our instructions, under written contracts, and may only use your information to provide their service to us.

• OpenAI, for Oscar’s conversations, brief building and read-aloud audio. Under OpenAI’s terms for business customers, the content we send is not used to train its models by default.
• Fly.io, which hosts the Oscar application in London.
• Turso, our database provider, which stores your account, brief and conversations.
• Logto, our identity provider, if you sign in through it.
• Resend, which sends our emails, including sign-in codes.
• ipapi.co, which estimates an approximate location from your IP address.
• Simple Analytics, which counts visits without cookies or personal profiles.
• Unsplash, which serves some example photos, so it receives your IP address when your browser loads them.

We may also share information with professional advisers, with authorities where the law requires it, or with a buyer or successor if Oscar’s business is reorganised or sold. In that last case your information would remain protected by this policy. We never sell your personal information.

Some of our providers, including OpenAI, process information outside the UK, mainly in the United States. Where that happens we make sure an appropriate safeguard is in place, such as the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement or Addendum, or an adequacy decision by the UK government. You can ask us for more detail about these safeguards.

We keep personal information only for as long as we need it for the purposes in this policy.

• Sign-in codes expire after 10 minutes and are deleted once used.
• Your sign-in session lasts up to 30 days, or until you sign out.
• Your account, brief and conversations are kept while you use Oscar, so you can return to them. You can ask us to delete them at any time.
• Searches started without signing in are not linked to your name or email. We plan to delete inactive ones automatically.
• System logs are kept for a short period for security and troubleshooting.
• We may keep some information for longer where the law requires it or to resolve a dispute.

We only use cookies and browser storage that are needed to run Oscar. We do not use advertising or tracking cookies.

• auth-token: keeps your session and saved brief connected to your browser. It lasts up to 30 days.
• Identity provider session: set by Logto when you sign in through it, so you stay signed in.
• sidebar_state: remembers whether you left the conversation sidebar open. It lasts 7 days.
• Location estimate: your approximate location, and the IP address used to find it, is kept in your browser’s session storage for up to an hour, so we do not have to look it up again on every page.

Because these are strictly necessary for the service, they do not need your consent. You can still block or delete them in your browser settings, but Oscar may not be able to keep your brief.

We protect your information with measures that suit the risk, including encryption in transit and limiting who can reach personal data to the people and providers who need it. No service can promise perfect security. If a breach is likely to put your rights at risk, we will tell you and the Information Commissioner’s Office as the law requires.

Under UK data protection law you have the right to:

• Access the personal information we hold about you and get a copy of it.
• Correct information that is wrong or incomplete.
• Delete your information, where we no longer have a good reason to keep it.
• Restrict how we use it while a concern is looked into.
• Object to uses based on our legitimate interests, and to direct marketing at any time.
• Port your information, receiving it in a common, machine-readable format.
• Withdraw consent where we rely on it.
• Not be subject to decisions based solely on automated processing that significantly affect you.

To use any of these rights, contact us as set out below. We will not charge you, and we will reply within one month. We may need to confirm your identity first, usually by asking you to use the email address on your account.

Oscar is for adults looking for property and is not intended for anyone under 18. We do not knowingly collect information about children. If you think a child has used Oscar, please contact us and we will delete their information.

We will update this policy as Oscar develops, for example when agent introductions launch. The date at the top shows when it last changed. If we make a significant change, we will tell you by email or in the service before it takes effect.

If you have a question about your information or want to use your rights, please get in touch. A dedicated privacy contact address will be published on this page shortly.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.