A rental application assembles close to a complete identity kit, passed through a referencing chain you didn't choose. What the check produced never expires: reports can be kept anonymised indefinitely, and your rent can end up on your credit file.
Identity plus finances, widely shared. Keep the record.
Tenancy and anti-money-laundering checks are kept for years.
Renting or buying requires ID, proof of funds, and often a credit and reference check.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
A tenancy file holds your income, your bank details, your guarantor and why a landlord said no. Leaked, it gives a stranger the means to pose as you and the reasons a future landlord may refuse you.
Close to a complete identity kit
A rental application takes passport, bank statements, salary, guarantors, and the guarantor's file too. Referencing is a credit-reporting business: applications are scored by credit-bureau arms and partners, and applicants are often added, unasked, to fraud databases used across industries.
What they made never expires
The law does set minimums: right-to-rent checks kept for the tenancy plus about a year in the UK, anti-money-laundering records about five years, a bad result can follow you for years in the US. Around them sits the favourite move: anonymise instead of delete, keeping what they made from it forever.
Looking is collected too
The searches, saved homes and enquiries you make on a property site are gathered long before any application. Policies here claim a broad interest in monetising what they hold, and at least one portal says outright that this feeds the property databases and automated valuation tools it sells on to agents. You were the input, not the customer.
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Proof of funds and affordability checks reveal it.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the company grants itself.
Financial regulators require advice, suitability, and transaction records.
Money-laundering rules require ID and transaction records after an account closes.
Tax and company law makes them keep billing and payment records.
They can keep records to defend a live or possible legal claim.
Here the data brokers are part of the process, not later buyers. Referencing arms of credit bureaus assemble the reports, property sites build pricing tools from your enquiries, and rental data has been used to train commercial pricing software, says a US competition case.
Applicant data is shared with agents, referencing firms, and landlords.
Affordability and risk scoring models use your file.
Anonymised is their word. A tenancy file names you, your address, and your date of birth, and fifteen attributes of that kind re-identify 99.98% of people (Rocher et al., Nature Communications, 2019).
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four time-and-place points single out 95% of people in mobility data (de Montjoye et al., Scientific Reports, 2013).
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the Crowd: The privacy bounds of human mobility (Scientific Reports 3, 1376, 2013)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation, and increasingly AI training can all ride under it. When they want to do something new with your data, this sentence usually already covers it.
THE MOVE An objection draws the line: use your data to run the service, not to improve, target, or train on it.
“we do not sell your personal information”
Often technically true, and still misleading. It usually means no cash changes hands. Data can still flow to ad networks, analytics firms, and partners: on their definition, sharing is not selling.
THE MOVE Flip the do-not-sell switch where one exists. The written objection on top of it goes on your record.
“service providers, partners, and affiliates”
How data leaves the building with no name attached. Recipients are listed by what they do, never who they are. You cannot send a request to a company you cannot name, which is the point.
THE MOVE An access request can ask for the recipients by name, not just the categories. UK and EU law put that choice with you. The reply, or the silence, goes on your record.
“aggregated or de-identified information”
Stripping the name does not strip the pattern, and the pattern often still points at you. Policies grant themselves free, indefinite use of this data because in their telling it is no longer about you.
THE MOVE If a deletion comes back as 'anonymised', keep the reply. It is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for: legal duties, tax rules, fraud prevention, possible lawsuits, their own business reasons. None of them carries a firm end date. Deletion becomes a negotiation, not an event.
THE MOVE Which reasons apply to you, and how long each runs, is a request of its own. Their reply goes on your record.
“you grant us a licence to use your content”
A contract term, not a data setting, so a privacy request cannot undo it. The careful version ends with your account. The broad version can be passed on, never expires, and survives deletion.
THE MOVE Whether the licence ends with the account is written in their terms, not yours. Closing the account goes on your record.
“your information may be shared with, and used by, a number of third parties in the referencing process”
The file can go anywhere in the sector: recipients are named by type, and the list usually says "for example", so it is not a limit. Any company that fits a type can get it.
THE MOVE The agent and the referencing firm are each responsible for your data, and the same access request works on both. Each reply goes on your record.
“once the purpose has ended, we will anonymise your personal information and may use it indefinitely”
When the purpose ends, they strip the name and keep the rest forever; you never hear of it again.
THE MOVE Their reply goes on your record: anonymised is a claim about a legal standard they have to meet, not a fact you can check.
“your track record as a tenant will be supplied to a credit reference agency”
Rent payments become part of a credit file, where the agency's own terms let it assess your finances, chase debts, confirm your identity for other companies and screen marketing lists.
THE MOVE The agency answers for its own copy, so the same request works there as well as on the agent. Each reply goes on your record.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →