Privacy Notice

Last updated 18 July 2026

PlanningLeads compiles construction-lead intelligence from public records and serves it to business customers. This notice explains what personal data we process, why, and the rights you have under the GDPR.

Who we are

PlanningLeads is the data controller for the lead database. Contact us about anything in this notice at privacy@planningleads.ie. Our customers are independent controllers for what they choose to do with a lead after retrieving it.

What we process, and what we don’t

Most of our data is about companies and other registered entities - which is not personal data. Where an applicant is a private individual(for example a homeowner applying for an extension), our policy is deliberately restrictive:

We do not enrich or sell personal phone numbers or email addresses for private individuals.
We classify organisation vs individual fail-safe - anything ambiguous is treated as an individual.
The public planning record (which may name an applicant) is shown only on our highest tier, and exports mask individuals.

Homeowner quote requests (only if you ask)

Our free tools are anonymous: the Home Energy & Grant Report does not store the address or property details you enter, and the planning exemption checker does not store your answers. Separately, both tools offer an optional quote-request form. If - and only if - you submit that form with its consent box ticked, we store what you provide (name, email, phone, the project or jobs you want priced, your timeframe and the tool's summary) under consent (Article 6(1)(a)). We use it for exactly one thing: sharing that project with up to three building professionals who subscribe to PlanningLeads so they can contact you about quoting - and with no one else. We do not vet, endorse, or verify any professional, including whether they hold any registration such as SEAI. Each professional sees your contact details only by taking one of the three slots, and we record which request came from which tool. These requests are held in a separate store that is never part of our lead products, API or exports. Every email we send you about it carries a one-click withdrawal link; withdrawing deletes your details from the request immediately, including for professionals who already claimed a slot. Requests we never match are deleted after 12 months.

Free tools, feedback and analytics

When you look up an address or Eircode in our free tools, the text you type is sent to the OpenStreetMap Nominatim geocoding service (and, where precise Eircode lookup is enabled, to HERE) solely to place the map pin. We do not store it in our database; it appears only in short-lived web-server logs. “Email me this report” uses your address once, to send the link, unless you separately tick the weekly-digest option. Our funnel analytics are anonymous counters (an event name and the day - no identifiers, no cookies). If you answer our one-question product survey while signed in, the answer is stored against your account and deleted with it.

Where the data comes from

All from public sources: the national planning system and local-authority registers, the Building Control Management System, An Bord Pleanála, the Companies Registration Office, EU tenders (TED), and public business listings (used only to enrich organisations). Re-used under Ireland’s open-data / PSI licence.

AI & automated processing

We use AI (a large-language model provided by Anthropic) to read the public planning description of each project and turn it into structured, filterable data - the project type, scale, storey count and trade signals - and to draft optional outreach notes for customers. This runs on public, organisation-level text. It does not make automated decisions that produce legal or similarly significant effects on any individual (no Article 22 profiling of people); the outputs are indicative classifications that a human customer chooses whether to act on, and can be wrong.

For this processing Anthropic acts as our processor under a data-processing agreement, with EU Standard Contractual Clauses for any transfer outside the EEA, and does not use our data to train its models. AI-drafted outreach text is presented as AI-generated so you review and edit it before sending. In line with the EU AI Act’s transparency rules, we disclose our use of AI here and label AI-assisted features in the app. A plain-English explainer of exactly what our AI does (and doesn’t do) is at /how-we-use-ai.

Age

You must be at least 16 to hold an account or to use TNDR. We do not knowingly process the personal data of anyone younger. If you believe we hold data about someone under 16, tell us at privacy@planningleads.ie and we will delete it.

TNDR (the trade app)

TNDR is our iOS app for tradespeople. When you sign in we process your email address, the firm you claim (checked against the Companies Registration Office and our own company profiles; a claim we cannot check automatically is reviewed by a person and shown as unverified until then), your trades, counties and preferred job size, and the calling cards and tenders you leave on jobs. We share a calling card or tender only with the applicant or homeowner of that job, never on public pages. Your deck is ordered automatically by fit: your trades and counties, the project's stage and our lead score. No automated decision excludes you and no Article 22 decision is made about you; the full parameters are published at /how-ranking-works. Lawful basis: performance of our contract with you (Article 6(1)(b)); for the public planning data shown on job cards, our legitimate interest as described on this page.

Retention: intro threads are deleted 12 months after their last message; filings and matches 24 months after the job closes; firm-verification evidence is deleted as soon as the decision lands. You can delete your account from inside the app (Settings), which starts a full erasure completed within 30 days. Crash diagnostics (Apple MetricKit) are optional, contain no personal identifiers, and can be switched off in the app's Settings.

Public planning application pages

For a pilot set of planning authorities (currently South Dublin County Council and Wexford County Council) we publish one public web page per planning application at /planning, built only from the statutory public planning register: the reference, the address and description of the proposed works, dates and status. These pages show no applicant or agent names and no contact details, and nothing is sent to anyone. Where the applicant is an individual, this is processing under legitimate interest (Article 6(1)(f)) supported by a written legitimate interest assessment. Every page carries a “Remove my application from this page” link: an objection (Article 21) removes the page at once, no account needed. We keep a minimal record so the page stays down after our weekly refresh: the reference, the date, whether you told us you are the applicant or agent, and, if you gave them, your email (used only to confirm the removal) and note, plus a hashed IP address for abuse control. The email, note and hashed IP are deleted after 12 months; the do-not-publish record itself is kept. Removing the public page does not by itself remove the record from our subscriber service; email privacy@planningleads.ie for that and we will add you to the suppression list described below.

Lawful basis

For organisation data we rely on legitimate interest (Article 6(1)(f)) - providing business-to-business construction lead intelligence from public records - balanced against the limited impact of processing already-public business information, and the restrictions above for individuals.

Your rights

You can ask us to give you access to, correct, or erase your personal data, and to object to our processing. Email privacy@planningleads.ie. On an erasure or objection request we add you to a permanent suppression list: your personal data and any enriched contact stop being served immediately, everywhere, and survive our weekly data rebuild. You may also complain to the Irish Data Protection Commission (dataprotection.ie).

Retention

Our lead database is rebuilt weekly from the public sources rather than accumulated indefinitely; individual contact details are never stored; and suppression records are kept permanently so a “do-not-process” request always holds. Homeowner quote requests are deleted after 12 months if never matched, and immediately on withdrawal; account data (including survey answers) is deleted with the account.

Our service providers

We use a small set of processors, each under a data-processing agreement: Anthropic (AI classification of public planning text, EU SCCs, no training on our data), Stripe (payments - we never see card details), Resend (transactional email), Hetzner (EU hosting), and the geocoding lookups above. We run no advertising or tracking networks. Some planning pages carry a labelled message from a supplier who sponsors a kind of work in that county; it is chosen by the work and the county alone, sets no cookie, and nothing about you or the applicant is shared with the sponsor (see how sponsors are chosen).

Cookies

We use only strictly-necessary cookies - your sign-in session and a security (CSRF) token, plus Stripe’s own cookies during checkout. We run no tracking, advertising or third-party analytics cookies, and our traffic analytics are cookieless (based on server logs, not the browser). Because we set only essential cookies, no consent banner is required under the ePrivacy rules - we show a short notice for transparency only.