Privacy notice

This portal is operated by NAPC to let clients follow the progress of their planning applications. This notice explains what personal data the portal holds and why.

What we hold

Your name and email address (to sign you in and notify you), the contact details you gave us when you first enquired (name, email, phone and correspondence address, copied from our case-management system so we know which applications are yours), details of your planning applications (addresses, references, dates and status), documents we prepare for your application, messages you send us through the portal, and your questions to the automated assistant.

If your builder or annexe provider works with us

Some of our clients are companies who arrange planning permission on your behalf — your builder or annexe provider. If that's how your application reached us, theyshared your name and contact details with us so we can handle the planning side of your project. We use those details to email you when something real happens to your own application — when it's submitted, when the council validates it, and when there's a decision — and to answer questions you send us. Every email includes a link to stop these updates, and stopping them changes nothing about your application. We don't use your details for anything else.

Why we hold it

To perform our contract with you: managing your planning application and keeping you informed. We do not use your data for marketing and we do not sell it.

Who processes it for us

We use a small number of trusted providers to run the portal. They act on our instructions under data-processing agreements:

• Monday.com — our case-management system, the source of your application details.
• Supabase and Vercel — database, sign-in and document storage, and hosting (United Kingdom / London region).
• Resend— sends the portal's notification and sign-in emails.
• Anthropic — powers the automated assistant. Your questions are not used to train its models.
• postcodes.io — a public UK postcode service used to place applications on a map. Only the site postcode is sent, never your name or full address.
• GitHub (Microsoft) — stores our weekly backups, encrypted with a key only NAPC holds so the storage provider cannot read them.

Your live portal data is processed and stored in the United Kingdom (London). Backups are held with GitHub, encrypted with a key only we hold. This list may change; email info@napc.uk for the current set of providers.

Cookies

The portal sets only strictly necessary cookies — those that keep you securely signed in. We do not use advertising or analytics cookies and we do not track you across other websites, so no cookie banner is required.

How long we keep it

We keep application records in line with our file retention policy (typically six years after your matter completes), after which they are deleted.

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it (subject to our legal retention obligations). Email info@napc.uk and we'll respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).