Privacy Policy

1. Who we are

Portal Scraper is operated by [company name], a company registered in England and Wales under company number [company number], whose registered office is at [registered office address]. You can contact us at [contact email].

We are the controller of the personal data described in this policy, except where section 2 says a customer is. We are registered with the Information Commissioner's Office (ICO) under number [ICO registration number]. For anything about your personal data, email [privacy email].

2. Whose data this policy covers

• Visitors to our website, including people using the free keyword search without an account.
• Customers: people with a Portal Scraper account and the businesses they represent.
• People named in planning and business information: for example applicants, agents, architects, consultants, contractors and company staff whose details appear in public planning records, on company websites or at Companies House. You may be in this group without ever having heard of us.
• Recipients of emails sent by our customers. When a customer uses Portal Scraper to email you, that customer decides to contact you and is the controller; we process your data on their behalf under our Data Processing Agreement. Contact the sender first, or us if you cannot.

3. What we collect and where it comes from

Visitors

• Technical information in server logs, such as IP address, browser and pages requested, kept for security and troubleshooting.

Customers

• Account details: name, email address, password (stored only as a secure hash), and your account identifier if you sign in with Google, Microsoft or Facebook.
• Subscription details: subscription status, invoices and payment history from Stripe. Stripe handles card details; we never receive full card numbers.
• What you put into the service: saved searches, company lists you upload, email templates, sending settings, queued and sent messages, replies received in the inbox, and connection details for email providers you link.
• Usage information: searches, exports, AI usage against your allowance, and questions you ask the help assistant.

People named in planning and business information

• From council planning registers: application details, site addresses and planning documents. These can include names, roles, business addresses, email addresses and phone numbers of applicants, agents and other professionals involved in a project.
• From company websites, Companies House and web search results: organisation details and, where published, the names, roles and work contact details of people at those organisations.
• Information we derive using automated tools and AI: for example which organisations and professionals are involved in a project, and their likely roles.

We do not seek out special category data, such as health information. If a planning document in the service contains it, tell us and we will remove it.

4. How we use personal data and our lawful bases

Where we rely on legitimate interests, we have balanced our interests against yours. We use this information only to connect businesses with planning projects, and you can object at any time (see section 9). Public availability of information does not by itself mean we may use it for anything; we assess each use.

5. AI and automated processing

We use AI models to filter and summarise planning documents, identify organisations and contacts involved in projects, and answer questions in the help assistant. The providers are listed in section 6. We do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects.

6. Who we share personal data with

• Our customers. Subscribers can see and export planning and business information, including professional contact details. When they use it for their own purposes, they are responsible for doing so lawfully.
• Service providers who process data on our behalf, under contracts requiring them to protect it and use it only on our instructions:

• Sign-in providers (Google, Microsoft, Facebook), if you choose to sign in with them. They act under their own privacy policies.
• Professional advisers, regulators, law enforcement and courts, where the law requires it or it is needed to establish or defend legal claims.
• A buyer or successor if our business, or part of it, is sold or reorganised.

7. International transfers

Some providers process data outside the UK, mainly in the United States. Where they do, we rely on UK adequacy regulations (including the UK–US data bridge where the provider is certified), or on the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Contact us for more information.

8. How long we keep personal data

• Free search counts: deleted about five weeks after the week they relate to.
• Account data and content: for as long as your account is open. When you ask us to delete your account, we delete or anonymise it within one month, except as below.
• Billing and payment records: six years after the end of the financial year they relate to, as UK tax law requires.
• Help assistant conversations: 180 days.
• Managed domains and mailboxes: removed one calendar month after access ends; records of messages already sent are kept with your account.
• Planning and business information: for as long as it is relevant to the planning projects it relates to, and reviewed periodically.
• Opt-out and objection records: kept for as long as needed to make sure we, and our customers' campaigns through the service, keep respecting them.
• Backups: overwritten on a rolling basis. Deleted data can remain in backups until they expire, and is not used in the meantime.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict how we use your data in certain circumstances;
• object to processing based on legitimate interests, including the inclusion of your details in our planning database. You can object to direct marketing at any time, and we will then stop;
• receive data you gave us in a portable format;
• withdraw consent, where we rely on it.

You do not need an account to make a request. Email [privacy email] and tell us what you are asking for and the details we should search for, such as your name, email address or company. We may ask for information to confirm your identity. We respond within one month, which can be extended by up to two further months for complex requests; we will tell you if so.

10. Complaints

If you are unhappy with how we have handled your personal data, please complain to us first at [privacy email]. We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay.

You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Security

We protect personal data with measures including encrypted connections, hashed passwords, access controls, account lockout after repeated failed sign-ins, and restricted access to production systems. No system is completely secure; if a breach is likely to put you at high risk, we will tell you.

12. Cookies

We only use cookies that are needed for the service to work. See our Cookie Policy.

13. Children

Portal Scraper is a business service and is not intended for anyone under 18.

14. Changes to this policy

We will update this policy when our processing changes. The date at the top shows when it last changed. We will tell customers about significant changes by email or in the app.