Privacy Policy

1. The short version

We collect the minimum we need to give you a planning constraint check and a usable account. We don't sell your data. We don't run third-party advertising trackers. We use Stripe for payment and Postmark for transactional email, and that's most of the third-party picture.

2. Who we are

Planning Consult is operated by Freestart plc (company number 03855529, registered in England and Wales), trading as Planning Handbook — the publisher behind planninghandbook.com.

For the purposes of UK GDPR, Freestart plc is the data controller for personal data processed through Planning Consult. Our contact details are at the bottom of this page.

3. What we collect

Information you give us

Information collected automatically

• Usage logs — pages visited, checks run, timestamps, browser, IP. Used for service operation, fraud detection, and aggregate analytics.
• Strictly-necessary cookies — sign-in session, CSRF protection, your saved preferences. See the Cookies Policy.

We do not use Google Analytics, advertising trackers, heatmap tools, or session-replay software.

4. How we use it

• Run the constraint check, generate the PDF report, and draft the planning statement you asked for.
• Maintain your account, save your sites, and show your dashboard history.
• Send transactional email — receipts, sign-in magic-links, important account notices.
• Improve the service — debug failed runs, measure aggregate accuracy, understand which constraint layers are most useful.
• Detect abuse — rate-limit suspicious traffic, prevent fraudulent payments.
• Meet legal obligations — tax records, accounting, lawful requests.

We do not use your project descriptions or report inputs to train third-party AI models. Our drafting models run under contracts that prohibit upstream training on customer content.

5. Lawful basis (UK GDPR Art. 6)

6. Who we share with

We use a small set of carefully-selected processors. Each is contractually bound to UK GDPR-equivalent terms.

We will also disclose information if required by law, valid court order, or to protect the rights, property, or safety of others.

7. How long we keep it

• Account data — for as long as your account is active, plus 90 days after deletion to handle reversals.
• Generated reports & statements — kept in your dashboard while the account is active. You can delete any individual record at any time.
• Billing records — 6 years from the end of the relevant tax year, as required by HMRC.
• Server logs (IP, user-agent) — 30 days, then aggregated.

8. International transfers

Most processing happens in the UK and EU. Where data is transferred outside the UK (notably for transactional email and AI drafting), we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, plus a transfer risk assessment for each processor.

9. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct it if it's inaccurate.
• Delete it, subject to retention obligations above.
• Port it — receive a machine-readable copy.
• Object to processing on the basis of legitimate interests.
• Restrict processing while a query is resolved.
• Withdraw consent for anything we process on the basis of consent.

Email [email protected]. We aim to respond within 7 days and complete the request within 30.

10. Security

We encrypt data in transit (TLS 1.3) and at rest (AES-256). Production access is limited to named engineers, scoped through SSO with hardware-key 2FA, and logged. Backups are encrypted and tested. We disclose material breaches to the ICO within 72 hours and to affected users without undue delay.

11. Children

The service is not directed at people under 18 and we don't knowingly collect data from them. If you believe a child has signed up, email [email protected] and we'll remove the account.

12. Contact & complaints

If you have a privacy question or complaint, email [email protected]. We'd like the chance to put it right first.

You also have the right to complain directly to the UK supervisory authority — the Information Commissioner's Office (ICO) — at ico.org.uk or 0303 123 1113.