Privacy Notice

Last updated 27 September 2026

PlanningLeads compiles construction-lead intelligence from public records and serves it to business customers. This notice explains what personal data we process, why, and the rights you have under the GDPR.

Who we are

PlanningLeads is the data controller for the lead database. Contact us about anything in this notice at privacy@planningleads.ie. Our customers are independent controllers for what they choose to do with a lead after retrieving it.

What we process, and what we don’t

Most of our data is about companies and other registered entities - which is not personal data. Where an applicant is a private individual(for example a homeowner applying for an extension), our policy is deliberately restrictive:

We do not enrich or sell personal phone numbers or email addresses for private individuals.
We classify organisation vs individual fail-safe - anything ambiguous is treated as an individual.
The public planning record (which may name an applicant) is shown only on our highest tier, and exports mask individuals.

Homeowner quote requests (only if you ask)

Our free tools are anonymous: the Home Energy & Grant Report does not store the address or property details you enter, and the planning exemption checker does not store your answers. Separately, both tools offer an optional quote-request form. If - and only if - you submit that form with its consent box ticked, we store what you provide (name, email, phone, the project or jobs you want priced, your timeframe and the tool's summary) under consent (Article 6(1)(a)). We use it for exactly one thing: sharing that project with up to three building professionals who subscribe to PlanningLeads so they can contact you about quoting - and with no one else. We do not vet, endorse, or verify any professional, including whether they hold any registration such as SEAI. Each professional sees your contact details only by taking one of the three slots, and we record which request came from which tool. These requests are held in a separate store that is never part of our lead products, API or exports. Every email we send you about it carries a one-click withdrawal link; withdrawing deletes your details from the request immediately, including for professionals who already claimed a slot. Requests we never match are deleted after 12 months.

Free tools, feedback and analytics

When you look up an address or Eircode in our free tools, the text you type is sent to the OpenStreetMap Nominatim geocoding service (and, where precise Eircode lookup is enabled, to HERE) solely to place the map pin. We do not store it in our database; it appears only in short-lived web-server logs. “Email me this report” uses your address once, to send the link, unless you separately tick the weekly-digest option. Our funnel analytics are anonymous counters (an event name and the time, with no identifiers and no cookies). If you answer our one-question product survey while signed in, the answer is stored against your account and deleted with it.

Where the data comes from

All from public sources: the national planning system and local-authority registers, the Building Control Management System, An Coimisiún Pleanála (formerly An Bord Pleanála), the Companies Registration Office, EU tenders (TED), and public business listings (used only to enrich organisations). Re-used under Ireland’s open-data / PSI licence. We also use data about places, not people: CSO Census 2022 Small Area statistics, the Pobal HP Deprivation Index by electoral division, CSO and Tailte Éireann statistical boundaries, National Monuments Service zones of notification and NIAH records, the EIA portal, eTenders and the Property Price Register.

AI & automated processing

We use Anthropic's AI models to read public planning records as the councils publish them (these can include an applicant's name; for a private individual it is never shown on public pages or in exports) and, when you use AI features, the text you give us for that purpose: your search, and on Max your trade and business description. The AI turns the public planning description of each project into structured, filterable data - the project type, scale, storey count and trade signals - and drafts optional outreach notes for customers. It does not make automated decisions that produce legal or similarly significant effects on any individual (no Article 22 profiling of people); the outputs are indicative classifications that a human customer chooses whether to act on, and can be wrong.

For this processing Anthropic acts as our processor under a data-processing agreement, with EU Standard Contractual Clauses for any transfer outside the EEA, and does not use our data to train its models. AI-drafted outreach text is presented as AI-generated so you review and edit it before sending. In line with the EU AI Act’s transparency rules, we disclose our use of AI here and label AI-assisted features in the app. A plain-English explainer of exactly what our AI does (and doesn’t do) is at /how-we-use-ai.

Age

You must be at least 16 to hold an account or to use TNDR. We do not knowingly process the personal data of anyone younger. If you believe we hold data about someone under 16, tell us at privacy@planningleads.ie and we will delete it.

TNDR (the trade app)

TNDR is our iOS app for tradespeople. When you sign in we process your email address, the firm you claim (checked against the Companies Registration Office and our own company profiles; a claim we cannot check automatically is reviewed by a person and shown as unverified until then), your trades, counties and preferred job size, and the calling cards and tenders you leave on jobs. We share a calling card or tender only with the applicant or homeowner of that job, never on public pages. Your deck is ordered automatically by fit: your trades and counties, the project's stage and our lead score. No automated decision excludes you and no Article 22 decision is made about you; the full parameters are published at /how-ranking-works. Lawful basis: performance of our contract with you (Article 6(1)(b)); for the public planning data shown on job cards, our legitimate interest as described on this page.

Retention: intro threads are deleted 12 months after their last message; filings and matches 24 months after the job closes; firm-verification evidence is deleted as soon as the decision lands. You can delete your account from inside the app (Settings), which starts a full erasure completed within 30 days. Crash diagnostics (Apple MetricKit) are optional, contain no personal identifiers, and can be switched off in the app's Settings.

Public planning application pages

For a set of planning authorities (currently 30 of the 31 planning authorities) we publish one public web page per planning application at /planning, built only from the statutory public planning register: the reference, the address and description of the proposed works, dates and status. These pages show no applicant or agent names and no contact details, and nothing is sent to anyone. Where the applicant is an individual, this is processing under legitimate interest (Article 6(1)(f)) supported by a written legitimate interest assessment. We publish applications received in the last 36 months, plus older ones where work has started or a granted permission is within a year of lapsing with nothing started, and the few whose receipt date the register does not give. Every page carries a “Remove my application from this page” link: an objection (Article 21) removes the page as soon as you press the confirmation link we email you, no account needed. We keep a minimal record so the page stays down after our weekly refresh: the reference, the date, whether you told us you are the applicant or agent, your email (used only to confirm the removal), your note if you gave one, plus a hashed IP address for abuse control. The email, note and hashed IP are deleted after 12 months; the do-not-publish record itself is kept. A request whose link is never pressed is deleted after 48 hours. Removing the public page does not by itself remove the record from our subscriber service; email privacy@planningleads.ie for that and we will add you to the suppression list described below.

Some pages carry a labelled sponsor card, chosen only by the kind of work and the council area, under a legitimate interest assessment approved on 24 September 2026. Sponsors' product pictures are served from our own server, so no reader data reaches the sponsor. We count views and clicks by category, council area, county, sponsor creative and time, with no identifier or cookie; crawlers are not counted.

Lawful basis

For organisation data we rely on legitimate interest (Article 6(1)(f)) - providing business-to-business construction lead intelligence from public records - balanced against the limited impact of processing already-public business information, and the restrictions above for individuals.

Your rights

You can ask us to give you access to, correct, or erase your personal data, and to object to our processing. Email privacy@planningleads.ie. On an erasure or objection request we add you to a permanent suppression list: your personal data and any enriched contact stop being served everywhere within 72 hours of your request, and the suppression survives our weekly data rebuild. You may also complain to the Irish Data Protection Commission (dataprotection.ie).

Retention

Our lead database is rebuilt weekly from the public sources rather than accumulated indefinitely; individual contact details are never stored; and suppression records are kept permanently so a “do-not-process” request always holds. Homeowner quote requests are deleted after 12 months if never matched, and immediately on withdrawal; account data (including survey answers) is deleted with the account.

Activity and access logs

For signed-in accounts we keep an activity record per user (for example leads viewed, searches by the names of the filters used, and links opened from our emails), deleted with the account. We also keep the contact details you give in an enterprise or sponsorship enquiry; if you report a sponsor card, the optional email and note you add, blanked after 12 months; the email addresses subscribed to the free weekly digest; a list of email addresses we must not email because they unsubscribed, bounced or complained; and a record of each Stripe checkout started (the email and the plan). Our web server keeps access logs holding your IP address, browser user agent and the page that referred you, for 30 days, to investigate abuse and to produce traffic statistics. The statistics we keep longer are counts only (pages, referring sites, countries), with no address or user agent. To count countries and spot automated traffic we look addresses up in a database held on our own server; no address is sent anywhere.

Our service providers

We use a small set of processors, each under a data-processing agreement: Hetzner (hosting, Germany); Anthropic (AI processing of public planning records, and of the search, trade and business description you enter to use AI features; EU SCCs, no training on our data); Google Maps Platform(finding a company's public phone number and website by its name, and a satellite picture of a site by its coordinates; no reader data); Resend (email); Stripe (payments - we never see card details); and OpenStreetMap Nominatim (the address you type into our free tools, to place the pin; a public service), with HERE where precise Eircode lookup is enabled. We run no advertising or tracking networks. Nothing about you or the applicant is shared with a sponsor (see how sponsors are chosen).

When you view a map, your browser loads map tiles and layers directly from OpenStreetMap and from Esri (ArcGIS, for satellite imagery and the zoning, heritage and nature layers), which see your IP address and the area shown.

Cookies

We use only strictly-necessary cookies - your sign-in session and a security (CSRF) token, plus Stripe’s own cookies during checkout. We run no tracking, advertising or third-party analytics cookies, and our traffic analytics are cookieless (based on server logs, not the browser). Because we set only essential cookies, no consent banner is required under the ePrivacy rules - we show a short notice for transparency only.