Privacy notice

The planning lookup (signed-in tool)

The tool is for signed-in users. This is what it collects about you.

Your account: your name, email address, organisation (if you give one) and password. The password is stored only in a scrambled (hashed) form. We also note when you asked for access and when you were approved.
A sign-in cookie called "session", so you stay signed in. The tool cannot work without it.
Security records. Our server log notes your email address when you ask for access, when you are approved and when a sign-in fails, and the internet (IP) address of a failed sign-in. After repeated failed sign-ins, the email and IP address are locked out for 15 minutes. That lock is held in memory only.
A record each time you open an agent's or case officer's details: your email address, your organisation and the planning application's reference. It never holds the contact details themselves.

The tool also shows details of other people: the agent's name, email and phone, and the case officer's name, where the council's planning record includes them. They are fetched only when you open that house. The tool never reads the applicant's name or address.

Why we use it, and the lawful basis

Your account and the sign-in cookie: to decide whether to give you access, let you sign in and tell you when your account is ready. Basis: providing the service you asked for (contract).
Security records and the record of contact views: to keep the service secure and see who looked at whose details. Basis: our legitimate interests.
Agent and case officer details: so our users can contact the professionals named in public planning records. Basis: our legitimate interests and those of our users.

How long we keep it

Sign-in cookie: 30 days, or until you sign out.
Agent and case officer details: 90 days after we fetch them, then deleted automatically.
Your account, including a request we have not approved: until you ask us to delete it.
Server logs: 24 hours, then deleted.
Records of contact views: until you ask us to delete them.

Who else handles it

Our web and server hosting providers, and the provider that sends our account emails. Your access request is emailed to our team. The addresses you search are sent to address, planning record and energy certificate services to find the results. Planning application wording, not your details, is sent to an AI provider to write the plain-English summaries.

How to ask us to delete it