Privacy notice

This policy applies when you:

• Visit transportplanai.co.uk or transportplanai.com (or any associated subdomain).
• Sign up for an account.
• Use the TransportPlanAI service to generate transport assessments.
• Receive transactional emails from us (signup, billing, account).
• Work at a planning or transport practice that we contact about TransportPlanAI (section 2.9).

It does not cover third-party websites you might reach via a link from ours - they have their own policies.

We collect only what the service needs to operate. The categories are:

2.1 Account data

Your email address and the username you choose when you sign up. Your country, picked at signup, to provide market-specific behaviour. Email verification status. Your email preferences: whether you have chosen to receive product news by email, when and how you changed that choice, and which version of the opt-in wording you saw.

2.2 Authentication and security data

Sign-in events (success / failure with reason), session metadata (device, approximate location via IP - see §3.6 below), audit events (account changes, password resets, deletions). IP addresses associated with sign-in attempts are stored for security purposes.

2.3 Project content

Anything you create in the service: site coordinates, project descriptions, uploaded planning documents, generated transport assessments and configuration choices. Project documents have an optional control to use a document as project evidence. You can uncheck it later without deleting the source document. Unchecking stops that use in future work; it does not change reports already generated.

2.4 AI conversation data

When the service generates portions of an assessment using AI, we record the prompt-template version, input-context size, generated output, model, token counts, latency, warnings and request ID. Generated outputs and generation diagnostics are retained for up to 90 days; aggregated non-personal metrics may be kept longer. We do not retain reusable authentication secrets or the model provider's internal instructions in these records. We minimise the personal data sent to the AI to the fields the generation actually needs.

2.5 Subscription and billing data

When you subscribe, Stripe (our payment processor) collects your card details and billing address - these never reach our systems. We receive only the metadata needed to mirror your subscription state: the plan you're on, status, renewal date, country.

2.6 Usage data

Token consumption (tokens used per period, per action). Rate-limit counters. No content payloads - just counts and timestamps.

2.7 Cookies and analytics

We use a minimal set of essential cookies for authentication. Non-essential cookies (analytics) only fire after you consent. See our Cookie Policy for the full list.

2.8 Free-trial eligibility record

To give each person one free trial, we record that a free trial has been given to your email address. We do not store the address for this: we store a keyed hash, a one-way code produced with a secret key that only we hold. Before hashing we ignore any + tag and, for Gmail addresses, any dots, so variants of one address match. We cannot read your email address from the hash. We keep it for 24 months from the day your free trial started, and it is not deleted when you delete your account, so that deleting an account and signing up again does not give a second free trial.

2.9 Business contacts and prospects

If you work at a planning, transport or development consultancy, we may hold your business contact details before you have an account with us: your name, job title, business email address, business phone number, the company you work for, a note of where we found those details, and a record of when we contacted you and what you said. We collect these from public sources only: Companies House, your company's own website, professional directories, and planning applications on which your company is named. We do not buy marketing lists.

We use these details to introduce TransportPlanAI to practices we think it could help, by email, phone, post or LinkedIn, and to keep a record of anyone who has asked us not to contact them, so that we do not contact them again. Unsolicited email goes only to limited companies and other corporate bodies, which the Privacy and Electronic Communications Regulations allow; we ask sole traders and partnerships before emailing them. Every message says who we are and how to tell us to stop.

We keep these details for 12 months from our last contact with you, or delete them sooner if you ask us to stop, and we keep a minimal "do not contact" record (your name and business email address) for as long as we need it to honour that request. If you open an account, your details become account data under section 2.1.

We map each processing activity to a specific legal basis per UK GDPR Article 6.

3.6 IP addresses for sign-in security

We log the IP address of each sign-in attempt for security monitoring (lockouts, suspicious-activity detection, "this looks like a new device" notifications). IP addresses are stored alongside the audit event for the retention period of the relevant data class (operational events: 1 year; security-relevant events: 3 years).

We use a small number of carefully-chosen third parties (sub-processors) to operate the service. The summary is:

Where data is transferred outside the UK or European Economic Area, we use the legal mechanisms specified by the UK Information Commissioner's Office:

• UK → EU: Mutual adequacy (no additional safeguards required).
• UK → US: The UK Extension to the EU-US Data Privacy Framework where the provider is certified under it (Stripe Inc., Vercel, Railway, Cloudflare, Salesforce (Slack), and Resend each hold an active EU-US DPF + UK Extension certification). Anthropic is not certified under the DPF; transfers to Anthropic rely on the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum (IDTA), as set out in Anthropic's Data Processing Addendum.

We have a written data processing agreement, as required by UK GDPR Article 28, in place with each of these processors. For some this is an agreement we have signed directly; for others it is the provider's standard data processing terms, which became part of our contract with them when we signed up for their service. We monitor their published sub-processor lists for changes.

In short: as long as we need it for the purpose listed in section 3, then we delete it. The user-facing summary:

When you delete your account: a 14-day grace period during which you can restore it, then hard delete (account data, project content, sessions). Audit records are anonymised - the action and timestamp remain, but your user ID is replaced with a hash. Payment records are retained for tax-law reasons but anonymised where the law permits.

Under UK GDPR you have the following rights. We will respond without undue delay and within one calendar month. For a complex or numerous request, we may extend by up to two further months. If we do, we will tell you within the initial month and explain why.

• Access - get a copy of the personal data we hold about you and information about how it is used. Settings → Download my data provides the active-account response, including authentication, project, generated-content, billing, usage, audit and private-file records. It also includes the Article 15 information. Email us for former-account, correspondence or processor-only data.
• Rectification - correct inaccurate personal data. Settings → Profile (for editable fields); email us for the rest.
• Erasure ("right to be forgotten") - have your data deleted. Settings → Delete account. For partial erasure (e.g. one project), use the delete buttons next to each item.
• Portability - receive your data in a portable format and transmit it to another controller. Settings → Download my data. JSON is recommended; CSV contains the same records in a long-form table.
• Objection - object to processing based on legitimate interest. Email us with the specific processing you object to. If we contacted your practice as a business contact (section 2.9), replying "please stop" to any message is enough: we stop and add you to our do-not-contact record.
• Restriction - pause processing while a complaint is investigated. Email us - we'll suspend the disputed processing during review.
• Automated decision-making (Article 22) - not be subject to a decision based solely on automated processing that has legal or similarly significant effects. The AI generates drafts - you remain the professional reviewer and final decision-maker. See section 8 below.
• Complain to the regulator - lodge a complaint with the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113. We'd appreciate a chance to address concerns first, but you're free to go directly to the ICO.

We treat your data carefully. Key safeguards:

• Encryption in transit: HTTPS everywhere, with HSTS preload.
• Encryption at rest: Supabase Postgres + Stripe + all sub-processors encrypt data at rest per their standards (SOC 2 / ISO 27001).
• Row-level security: every database table enforces that you can only read your own data.
• Server-side authentication: every API request is verified on the backend; the frontend is never trusted for security.
• Secret rotation: high-value keys rotated every 90 days.
• Vulnerability scanning: dependencies scanned in CI; high/critical CVEs block deployment.
• Incident response: documented procedure for security events; regulator notified within 72 hours if a personal-data breach risks individuals' rights (UK GDPR Article 33).

For our security disclosure process see /.well-known/security.txt (or email contact@transportplanai.co.uk).

TransportPlanAI uses an AI model (Anthropic's Claude) to generate portions of transport assessments. Some specifics that matter for your rights:

• The AI produces drafts. You - the user, a qualified transport planning professional - are the reviewer. The assessment is yours; you decide whether to submit it. We've made this explicit in our Terms of Service and the in-app UI.
• No training on your data. Per Anthropic's published commercial terms, Anthropic does not use Customer Content to train its models. This is the default and applies to every call.
• Anthropic data retention. Anthropic retains API inputs and outputs for up to 30 days for safety, abuse-prevention, and legal-compliance purposes - this is Anthropic's standard policy for paid API customers and is documented in their Data Processing Addendum. The 30-day window is independent of the 90-day retention we apply to our own logs.
• Minimum necessary data sent. We send only the inputs the AI needs for that specific generation - coordinates, parameters, your prompts. We do not send your full account profile to the AI.
• Audit trail. AI generation records include the model, prompt-template version, input-context size, generated output, warnings, user or project scope and request ID. Your active-account export includes these records while we retain them.
• AI origin markings. When a project's recorded country is in the European Union, AI-bearing exports include a visible AI-assisted draft notice and machine-readable origin markings. Non-EU project exports are unmarked by this control. The markings do not contain your account identity or project name.
• Article 22 status: because the AI output requires professional review by you before it has any effect on a planning application, we consider that we are not making decisions "solely by automated means" under Article 22.

Your active-account export contains the generated outputs and generation records we retain. If you want to understand what records are held for a specific assessment, or need provider-held input or output data that is not in the active account, contact us so we can provide the records we hold and make any necessary processor search.

To generate transport assessments we incorporate a number of openly-published UK datasets into the AI prompt and the generated report. These are not personal data - they are geographic, regulatory, and statistical information about places, roads, public transport, planning regulation, environmental constraints, and recorded incidents. We mention them here because they appear in your generated output and we want to be transparent about their provenance and licence.

Attribution. Where these datasets contribute material content to a generated report, we list the relevant attribution in the report itself. We are working to make these attributions visible both on-screen and in the Word export footer; if you spot a missing attribution, please tell us and we'll fix it.

Restrictive-licence handling. A small minority of LA publications are not under OGL. Where we identify a dataset that we don't have the right to incorporate commercially, we exclude it from the generation rather than fall back to a guess.

You're the responsible party. As the planning professional reviewing the assessment, the final responsibility for confirming that the cited datasets are appropriate and the attributions are correct sits with you. We surface the source name and retrieval timestamp in the report so you can verify.

See our Cookie Policy for the full list, including how to revisit your consent choices.

Quick version: we use essential cookies for authentication (required to be logged in). Analytics cookies (PostHog) are non-essential and only fire if you accept them. Marketing cookies: none currently.

TransportPlanAI is a professional tool for transport planning practitioners. It is not directed to or intended for use by people under 18. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, contact us and we will delete it.

We will update this policy when:

• We add a new sub-processor or change where data is processed.
• We introduce a new feature that processes personal data differently.
• The law changes in a way that affects our processing.
• Our retention periods change.

For material changes (new categories of data, new processors, expanded purposes), we will:

• Notify you by email.
• Display a banner in the application.

For minor changes (typos, clarifications, link updates), we'll simply update this page and bump the "Last updated" date. We keep a dated version history of this policy, and will provide previous versions on request.

12.1 Ireland (EU GDPR)

When Ireland is enabled as a market, this section covers the EU GDPR specifics - supervisory authority (Data Protection Commission), EU representative (we'll appoint one when first EU customer enrols), and any Ireland-specific consumer protection requirements.

12.2 Australia (Privacy Act 1988 + Australian Privacy Principles)

When Australia is enabled: Office of the Australian Information Commissioner (OAIC) procedures, APP 8 cross-border disclosure mechanics, AU-specific notice requirements.

12.3 United States (state-by-state)

California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), and the growing list of state privacy regimes. We'll add per-state addenda at US launch, prioritising California due to CCPA reach.

• General privacy enquiries: contact@transportplanai.co.uk
• Data subject rights requests: same address (the in-app Settings page is faster for self-service).
• Security disclosures: contact@transportplanai.co.uk or /.well-known/security.txt.
• Complaint to the regulator (UK): ICO - ico.org.uk/make-a-complaint or 0303 123 1113.
• Postal address: 1 Medlock Crescent, Ashton Under Lyne, Manchester, England, OL6 9FL, United Kingdom.