PlanFalconSign in

PlanFalcon — Privacy Policy

Last updated: 25/9/26

1. Who we are

PlanFalcon ("we", "us", "our") is operated by William Kelsall, a sole trader trading as Kelwave, based in Alton, United Kingdom. For any privacy questions, contact us at william.kelwave@gmail.com.

For the purposes of UK data protection law (the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations), we are the data controller for the personal data described in this policy.

2. Scope

This policy explains what personal data we collect, why, how we use it, and your rights. It covers three groups of people:

  • Customers — the businesses and individuals who create a PlanFalcon account.
  • Alert subscribers — visitors who give us an email address on our public location pages to receive alerts, without creating an account.
  • People named in public records — individuals or organisations who appear in the publicly available planning and procurement records we monitor (for example, applicants, planning agents and site addresses).

3. Customer data we collect

When you sign up for or use the Service, we may collect:

  • your name, email address and business name;
  • account credentials and settings, such as the areas, postcodes and alert criteria you choose, your digest day and whether you are a homeowner or professional user;
  • business profile information you choose to give us, such as your services, sector, operating area and preferred project types (used to rank opportunities for you), and letterhead details and a logo (used to produce outreach letters);
  • the work you do in the Service, such as leads you track, pipeline stages, notes, and feedback you give on recommendations;
  • questions you type into our AI assistants and the drafts they produce (these are processed to answer you and are not kept as a chat history; we record only that a request was made, to enforce usage limits);
  • billing information — if you subscribe, our payment provider Stripe collects your card details. We do not see or store your full card number; we keep a Stripe customer reference, your plan and your subscription status;
  • security and technical data, such as the email address and IP address used in each sign-in attempt, and error reports when something breaks; and
  • any messages you send us.

Why we use it and our lawful basis:

  • to provide and operate the Service, including sending you the alerts and digests you have asked for, ranking opportunities, and generating AI summaries and outreach drafts — performance of a contract;
  • to take payment and manage your subscription — performance of a contract, and legal obligation for our accounting records;
  • to communicate with you about the Service, including service and account updates — performance of a contract and/or legitimate interests;
  • to keep the Service secure, including limiting repeated failed sign-ins and diagnosing errors — legitimate interests in protecting our customers and the Service;
  • to improve the Service — legitimate interests in running and developing our business;
  • to send you marketing about PlanFalcon where permitted — consent or, for existing customers, legitimate interests, and you can opt out at any time; and
  • to comply with our legal obligations — legal obligation.

4. Alert subscribers

If you enter your email address on one of our public location pages, we store it with the place you asked about and the date you signed up, and use it only to send you planning alerts for that place. Our lawful basis is your consent. You can withdraw it at any time by replying to any alert or emailing william.kelwave@gmail.com, and we will delete your address.

5. Public planning and procurement data

The Service collects publicly available UK planning information, directly from council planning portals and via PlanIt (a public aggregator of UK planning data), and public procurement notices from the government's Contracts Finder service. Planning records can contain personal data, such as site addresses and the names of applicants or agents. In practice, the records we hold mostly identify agents by company name; where a source withholds individual names, we do not try to recover them.

We use this data to operate the Service: to detect relevant applications, notify our customers, generate indicative relevance scores, produce AI-generated summaries, and help customers draft outreach to the organisations involved in a project. Scores and summaries are automated estimates to help customers prioritise; we do not use this data to make decisions producing legal or similarly significant effects about the individuals named in it.

Our lawful basis is our legitimate interests (and our customers' legitimate interests) in monitoring public planning and procurement activity for business purposes, balanced against the rights of the individuals concerned. Because this information is published by public authorities as part of a transparent statutory process, we consider this processing proportionate.

Customers who use the Service to contact anyone named in a planning record decide for themselves whether and how to do so, and are responsible for complying with data protection and electronic marketing law when they do.

If you are named in planning data we hold and have questions, or want to object to our processing, contact us at william.kelwave@gmail.com.

6. AI features

Some features use artificial intelligence provided by Anthropic (the Claude models): application summaries, opportunity briefs, outreach email and letter drafts, and the dashboard assistants. When you use them, we send Anthropic the relevant planning information and, where applicable, your question or business details. Anthropic processes this on our behalf to return a response and, under its commercial terms, does not use it to train its models. AI output can be wrong; treat it as a draft to check, not a statement of fact.

7. How we share data

We do not sell your personal data. We share data only with:

  • service providers who help us run the Service (listed in section 8), who process data on our behalf under appropriate agreements;
  • authorities or third parties where required by law; and
  • a successor if we reorganise or transfer the business, subject to this policy.

8. Current service providers (sub-processors)

We use the following providers to deliver the Service:

  • Supabase (database, authentication and file storage)
  • Vercel (application hosting)
  • Resend (email delivery)
  • Stripe (payments and subscriptions)
  • Anthropic (AI features)
  • Sentry (error reporting — configured not to attach IP addresses, cookies or request headers)

Our maps load map images from OpenStreetMap's tile servers, which means your browser sends your IP address to the OpenStreetMap Foundation when you view a map.

This list may change as the Service develops. We will update this page when it does.

9. International transfers

Some of these providers are based in, or process data in, the United States or other countries outside the UK. Where they do, we rely on safeguards recognised by UK data protection law, such as UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

10. How long we keep data

  • Account data: for as long as you have an account. You can delete your account at any time from Settings; this immediately deletes your account and the data linked to it, and cancels any subscription. You can also ask us to do it for you, and we will within 30 days. The only things we keep are what the law requires, such as payment records (below).
  • Payment and invoicing records: six years, as required for UK tax and accounting purposes.
  • Alert subscriber emails: until you unsubscribe.
  • Sign-in attempt records (email and IP address): 24 hours. A successful sign-in clears that account's earlier failed attempts.
  • Error reports: according to our error-reporting provider's standard retention, typically no more than 90 days.
  • Public planning and procurement data: for as long as it is relevant to the Service. Planning history is part of what the Service provides, so this can be several years.

11. How we protect data

We use appropriate technical and organisational measures to protect personal data, including encrypted connections, access controls that limit each customer to their own data, restricted administrative access, and secure hosting. No system is completely secure, but we take reasonable steps to reduce risk.

12. Your rights

Under UK data protection law you have the right to:

  • access the personal data we hold about you;
  • ask us to correct inaccurate data;
  • ask us to delete your data in certain circumstances;
  • object to or restrict certain processing (including processing based on legitimate interests, and any direct marketing);
  • withdraw consent where we rely on it; and
  • data portability in certain circumstances.

You can also act on some of these yourself: every email we send has an unsubscribe link, email can be turned off or back on in Settings, and you can delete your account from Settings. Otherwise, contact us at william.kelwave@gmail.com. We will respond within one month.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at william.kelwave@gmail.com. We will acknowledge your complaint within 30 days and tell you what we are doing about it. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

14. Cookies and similar technologies

We use only what the Service needs to work:

  • sign-in cookies that keep you logged in (strictly necessary); and
  • your browser's local storage, to remember small interface preferences such as whether the sidebar is collapsed.

We do not use advertising or third-party analytics cookies. We do count how many times our pages are viewed and buttons are clicked, on our own servers, without cookies and without recording who you are or your IP address — only which page and which button. Because these are strictly necessary or remember your own choices, we do not show a cookie banner. If we add analytics or other non-essential cookies in future, we will ask for your consent first.

15. Children

The Service is intended for businesses and adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.

16. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new "last updated" date and, for material changes, give account holders reasonable notice by email.

17. Contact

Questions about this policy or your data: william.kelwave@gmail.com

PlanFalcon — William Kelsall, trading as Kelwave, Alton, United Kingdom.