Privacy Policy

Buildwise is operated by BUILD WISE AI LTD, a company registered in England and Wales. We operate the platform at mybuildwise.co.uk.

BUILD WISE AI LTD is registered with the Information Commissioner's Office (ICO) as a data controller under reference ZC110119.

For the purposes of UK data protection law, BUILD WISE AI LTD is the data controller — we determine the purposes and means of processing your personal data. Our third-party technology providers (Supabase, Anthropic, Stripe, DreamHost) act as data processors, processing data only on our instructions and subject to appropriate data processing agreements.

For privacy questions or to exercise your rights: hello@mybuildwise.co.uk

Account data: Your name, email address, company name, phone number, company registration number, VAT status, and profile information.

Project data: Site addresses, postcodes, project descriptions, questionnaire answers, and documents you upload (architectural drawings, decision notices, planning history).

Planning outcome data: Where you voluntarily upload a planning decision notice or record an application outcome, we collect the outcome (approved, refused, or pending), the LPA reasoning, and policies cited. This is used to improve our service — see Section 5.

Generated documents:Design & Access Statements, LDC statements, and other documents generated on your behalf.

Usage data: IP addresses, browser type, device type, and pages visited, collected to improve the service and ensure security.

Payment data: Processed entirely by Stripe. We do not store card details — only your Stripe customer ID and subscription status.

We use your data to:

• Provide the Buildwise service — generating planning documents, detecting constraints, running the PD Checker
• Personalise your experience — pre-populating documents with your profile and project details
• Send transactional emails — account verification, document delivery, subscription receipts, password resets
• Process payments and manage your subscription via Stripe
• Improve document quality — using anonymised, aggregated planning outcome data to improve our AI and policy library (see Section 5)
• Respond to support requests
• Detect and prevent fraud and abuse
• Comply with legal obligations

We do not use your personal data to train AI models. We do not sell your data to third parties. We do not use your data for advertising.

When you upload a decision notice or record a planning outcome, we may use that information — in anonymised and aggregated form only — to improve document quality for all users. This includes:

• Understanding which policy arguments correlate with planning approval
• Identifying which DAS sections planning officers engage with most
• Keeping our LPA policy database accurate and current
• Improving our AI prompts and document generation quality

Before any analysis, all personally identifiable information is removed — your name, company, and site address are stripped. Analysis is performed on aggregated patterns, not individual applications.

You can opt out at any time by emailing hello@mybuildwise.co.uk. Opting out does not affect the service you receive.

We will never share identifiable project data — your site address, client name, or the content of your specific DAS — with any third party for research or commercial purposes.

We share your data only with the following processors, all subject to data processing agreements and bound to act only on our instructions:

• Supabase Inc — database, authentication and file storage. Data hosted in EU (Ireland). No international transfer.
• Anthropic PBC — AI processing for document generation. Your project data is sent to Anthropic's US-based API — see Section 7 on international transfers. Anthropic does not use API input to train models. See their Privacy Policy.
• Stripe Inc — payment processing (US-based, EU-US DPF certified). See Stripe Privacy Policy.
• DreamHost LLC — email delivery for transactional emails (US-based).
• Vercel Inc — application hosting and privacy-friendly, cookieless website analytics (US-based; transfers covered by Standard Contractual Clauses). Vercel Web Analytics does not use cookies and does not collect personally identifiable information.

We do not share your data with any other third parties without your explicit consent.

Some processors are based outside the UK. We ensure appropriate safeguards are in place:

• Anthropic (US): Transfers covered by Standard Contractual Clauses (SCCs) in Anthropic's API terms.
• Stripe (US): Certified under the EU-US Data Privacy Framework, recognised as adequate by the UK.
• DreamHost (US): Transfers covered by Standard Contractual Clauses.
• Vercel (US): Transfers covered by Standard Contractual Clauses.
• Supabase (EU — Ireland): No international transfer — data remains within the EEA.

To request more information about the safeguards we rely on, contact hello@mybuildwise.co.uk.

Buildwise uses AI to generate planning documents automatically from the information you provide. This does not constitute automated decision-making producing legal or similarly significant effects about you as an individual. The AI generates a draft document — you remain in full control of whether and how it is used.

The PD Checker uses a hardcoded logic tree (not AI) to assess permitted development rights. Its output is advisory — it does not constitute a legal determination. Always verify with a qualified planning professional before relying on it.

We use essential cookies only. These are strictly necessary for the platform to function and do not require consent under the Privacy and Electronic Communications Regulations (PECR).

Cookie	Purpose	Duration
sb-access-token	Supabase auth — keeps you signed in	Session
sb-refresh-token	Supabase auth — renews your session automatically	30 days

We do not use advertising, tracking, or analytics cookies, and we do not use Google Analytics. For understanding aggregate site traffic (such as how many people visit and which pages they view) we use Vercel Web Analytics, a privacy-friendly, cookieless service — it sets no cookies, stores and reads nothing on your device, collects no personally identifiable information, and does not track you across other websites. Because we use only essential cookies and no tracking cookies, no cookie-consent banner is required under PECR.

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Ask us to correct inaccurate or incomplete data
• Erasure: Ask us to delete your personal data (subject to legal retention obligations)
• Restriction: Ask us to restrict processing in certain circumstances
• Portability: Request your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests, including the anonymised analysis in Section 5
• Automated processing: Request human review of any automated processing that significantly affects you

To exercise any right, email hello@mybuildwise.co.uk. We will respond within one calendar month.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

We protect your data through:

• HTTPS/TLS encryption on all data in transit
• Row-level security on the database — users can only access their own data
• OAuth 2.0 authentication via Supabase Auth
• Payment data handled entirely by Stripe's PCI-compliant infrastructure — we never touch card details
• Access to production systems restricted to authorised personnel only

No method of internet transmission is completely secure. We take reasonable precautions but cannot guarantee absolute security.

Buildwise is a professional tool intended for adults (18+). We do not knowingly collect data from minors. If you believe a child has provided personal data, contact us and we will delete it promptly.

We sometimes write to people whose details appear on a local planning authority's public planning register — for example, where a planning application has recently been refused and an appeal or a revised application may be an option. If you received a letter from us and have never used Buildwise, this section is the one that applies to you. It is provided under Articles 13 and 14 of the UK GDPR, because we obtained your details from a public source rather than from you.

Where we got your details: the public planning register published by the local planning authority for your area, and the application documents published on it. We do not buy marketing lists.

What we hold: the minimum needed to write to you once — name (or practice name), postal address, the site address, the application reference, and the publicly recorded decision and its date. We do not collect special category data, we do not profile you, and we do not enrich your record from other sources.

Our lawful basis: legitimate interests (UK GDPR Article 6(1)(f)) — a single, restrained postal contact offering a route forward on a live planning matter you are already engaged in. We have completed and hold a Legitimate Interests Assessment covering the purpose, the necessity of the postal channel, and the balance against your rights and reasonable expectations. Being on a public register is not consent, and we do not treat it as such.

How we contact you: by post only. We do not send marketing emails, texts or automated calls to private individuals or to sole traders and ordinary partnerships obtained this way, and we send one letter per matter — we do not send chase letters to people who do not reply.

How long we keep it: six months from the date we collected it, after which lead data for non-responders is deleted or anonymised. If you ask us to stop, we keep only the minimum record needed to make sure we do not contact you again.

Your right to object: you have an absolute right to object to direct marketing, and we will stop immediately and permanently — no reason needed. Email hello@mybuildwise.co.uk or reply to the letter, and we will add you to our suppression list and delete your details. You also have the rights set out elsewhere in this policy (access, rectification, erasure, restriction and portability), and you may complain to the ICO at ico.org.uk.

If you choose to verify your practice to unlock a free first document, we send the company name or number you enter to the Companies House Public Data API and store what it returns: the company number, registered name, company status and company type, plus the date you verified. Companies House data is public. Our lawful basis is performance of a contract (Article 6(1)(b)) — the check is how eligibility for the free document is established. We record that a company number has used its free document so it cannot be claimed twice. Verification is optional; you can use Buildwise without it by purchasing documents.

We will notify you by email of material changes at least 14 days before they take effect. The date at the top of this page shows when it was last updated. Continued use of the platform after the effective date constitutes acceptance.

Email: hello@mybuildwise.co.uk
Company: BUILD WISE AI LTD, registered in England and Wales

If we cannot resolve your concern, you may escalate to the ICO at ico.org.uk.