Effective 26 September 2026 · Version 2026-09-26-v3
Town Planner Pro Ltd (company number 17225647, registered office The Oakley, Kidderminster Road, Droitwich, WR9 9AY), registered in England and Wales, is the data controller for personal data processed through the Town Planner Pro service. We are registered with the Information Commissioner's Office, reference ZC235527. You can contact us at hello@townplannerpro.co.uk.
We use Vercel Web Analytics, a cookieless, privacy-preserving service that records aggregate page views only — no cookies, no cross-site tracking, no personal profiles. We do not use marketing or advertising cookies.
Public appeal record. The appeal decisions we index are published by the Planning Inspectorate under the Open Government Licence with personal data redacted at source. As published, they may still name the Inspector and the professional representatives who appeared, and we show those names as they appear in the decision. We add no personal data of our own. If you are named in a published decision and have a concern, contact us and we will consider it alongside the Inspectorate's own publication.
The free appeal search and authority record on townplannerpro.co.uk keep a log of each search: the words searched (up to 200 characters), the filters chosen, how many results were shown and the time. The visitor's internet address is not stored: we keep a one-way code made from it together with the date and a secret key, so the same visitor gets a different code each day and cannot be followed from one day to the next. No account, cookie or name is involved. We use the log to understand how the search is used and to stop abuse, and delete each entry after 90 days.
Town Planner Pro offers AI-assisted features powered by third-party providers (currently including Anthropic, OpenAI and Google). The data flow depends on which access mode is active in Settings:
Included AI mode. During the free trial, and when your subscription bundles AI access, AI calls are routed through Town Planner Pro's servers to a provider we manage on your behalf. Your prompts and the AI's responses transit our infrastructure. We log token counts per call for billing and fair-use enforcement; prompt and response contents are not intentionally stored in our persistent databases and are retained only to the extent technically necessary to deliver the response. Where we change the underlying provider and the change involves a sub-processor not already listed, we give at least 14 days' notice via our sub-processor page and by email. The relevant downstream AI provider is a sub-processor for the duration of each call and is bound by its own data-processing terms.
BYOK mode. When you supply your own API key for a supported provider, your key is stored only in this browser's local storage and is sent directly from your browser to your chosen AI provider. Your key never reaches our servers, and we do not receive or store the content of those prompts and responses; your relationship with the AI provider governs that processing.
You can switch between modes in Settings at any time. The decision affects only how AI calls are routed; subscription tier is set independently.
Service data is stored in Supabase (Postgres + Storage) hosted in the UK (AWS London region, eu-west-2). Payment data is processed by Stripe. Transactional email is sent via Resend. Application hosting is by Vercel. Error reports (what failed, on which screen and device, and the account id, with email addresses and any API key removed before sending) go to Sentry, hosted in the EU. On the Included AI tier, which includes the free trial, prompts are routed to our managed AI provider (currently Anthropic, Claude). When you search the appeal record by meaning, in the app or on the free public search, the words you type are sent to Voyage AI (US) to be turned into a search vector; nothing else about you is sent with them. A current list of our sub-processors, with their locations and roles, is published at townplannerpro.co.uk/sub-processors.
Maps load imagery directly from Google (aerial) and OpenStreetMap (street), and a site plan drawn on the aerial base loads its imagery from Esri. Your browser requests those tiles itself, so those providers receive your IP address and the area being viewed, under their own privacy terms. Constraint and boundary checks query the Environment Agency, Natural England, Historic England, the Office for National Statistics and planning.data.gov.uk from your browser in the same way.
Some sub-processors (notably Stripe and certain Vercel edge regions) may process data outside the UK/EEA. Where they do, transfers are governed by the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, supplemented by the sub-processor's own safeguards.
We retain account and service data for the duration of your subscription and, after cancellation or the end of a trial, in read-only form so you can re-activate. Cancelling your subscription does not by itself delete your data. An account with no paid subscription and no sign-in for 24 months may be deleted after 30 days' notice to the account email address. When you request account deletion, your service data is hard-deleted within 30 days. Billing and accounting records are retained for the period required by UK tax and accounting law (currently 6 years). For the Included AI tier, usage records (token counts, status, and error codes only, never prompt or response content) are retained for up to 13 months to resolve billing disputes, then purged.
Waiting-list entries are kept until launch and for six months afterwards, then deleted, unless you have opened an account by then. Product-news sign-ups are kept for as long as you stay subscribed. When you unsubscribe we keep only the fact that you asked not to be emailed, so that we honour it.
The free appeal search log described in section 2 is deleted after 90 days.
Security. Data is encrypted in transit and at rest. Each account's data is isolated by database row-level security, so one account cannot read another's. Accounts are limited to a small number of registered devices, staff access to service data is limited to what support and operation require, and administrative access is restricted to named accounts. If we become aware of a personal data breach that is likely to put your rights at risk we will notify the ICO within 72 hours and tell you without undue delay.
Under UK GDPR you have the right to: access your personal data, rectify inaccurate data, request erasure, restrict processing, object to processing, and data portability. To exercise any of these rights, email hello@townplannerpro.co.uk.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
We use only strictly necessary and functional cookies and local storage for authentication, session management and your own preferences (including, in BYOK mode, your AI key, which is stored only on your device). Usage analytics are cookieless and aggregate only (Vercel Web Analytics); we do not use advertising or third-party tracking cookies.
We may update this Privacy Policy from time to time. The effective date and version above will change when we do. Where the change is material we will notify you by email or at next sign-in.
See also our Terms of Use. © Town Planner Pro Ltd · 26 September 2026