PlanPost

Privacy Policy

Last updated: 2 June 2026

1. Who we are

PlanPost (“we”, “us”, “our”) is a trading name of Solid Digital Marketing Ltd, registered in England and Wales. Company No. 09888926. VAT No. GB890341131. Registered office: Suite 33 Peel House, 30 The Downs, Altrincham, United Kingdom, WA14 2PX. We provide an automated lead generation service for UK builders and tradespeople, monitoring public planning applications and sending letters on behalf of our subscribers.

For data protection purposes, we are the data controller for the personal data we collect about our subscribers. For personal data relating to homeowners (derived from public planning records), we act as data processor on behalf of our subscribers. We are also the data controller for the limited business-contact data of builders and tradespeople we contact about PlanPost (see section 9).

2. What data we collect

Account data

Name, email address, company name, business address, postcode, phone number (optional), and website (optional). This is collected when you register and may be updated from your dashboard.

Payment data

Payment card details are collected and processed by our payment provider, Stripe. We do not store card numbers or CVVs. We store your Stripe customer and subscription identifiers for billing management.

Service data

Your monitoring preferences (centre postcode, radius, project categories), letter templates, letterhead images, and lead tracking data (status, notes, contact details you enter).

Support and sales correspondence

If you contact us (through the contact form, the in-app support page, or by replying to one of our emails), we keep a record of that correspondence: your name, email address, and the content of the messages. We use it to respond to you and to keep a history of the conversation so you do not have to repeat yourself.

Planning application data

We collect publicly available planning application data from local planning authority websites, including applicant addresses, application descriptions, and decision dates. This data is a matter of public record. For London, this includes data from the Planning London Datahub, © Greater London Authority, used under the Open Government Licence v3.0.

Usage and analytics data

If you consent to analytics cookies, we collect anonymous usage data via Google Analytics (through Google Tag Manager), including pages visited, time on site, and referral source. We also store UTM parameters and referrer URL at the time of registration to understand how users find PlanPost.

QR scan events

Subscribers can choose to print a QR code on the letters we send on their behalf. When a homeowner scans that QR code we log the scan so the subscriber can see that their letter was acted on. Each scan event contains: a one-way hash of the scanner's IP address (salted with a value that rotates every calendar month, so repeat scans in the same month can be grouped but cannot be attributed to a specific person or linked across months), the browser user-agent string, the HTTP referer, and a timestamp. We do not set cookies on the scanner, do not collect their location, and do not track them across other sites. After a scan is logged, the scanner is redirected to the subscriber's chosen destination URL (typically their own website).

3. How we use your data

  • To provide the PlanPost service: matching leads, printing and posting letters, tracking your pipeline
  • To process payments and manage your subscription
  • To send transactional emails (welcome, credit warnings, lead summaries)
  • To improve the service based on aggregated usage patterns
  • To comply with legal obligations

4. Legal basis for processing

  • Contract: Processing your account, payment, and service data is necessary to perform our contract with you.
  • Legitimate interest: Processing publicly available planning application data and sending letters to homeowners is based on our legitimate interest in providing a lead generation service. Planning applications are public records. The same legitimate-interest basis covers anonymised measurement of QR code scans on those letters (hashed IP, no identity stored) so subscribers can see whether their letters were acted on.
  • Consent: Analytics cookies are only set after you give explicit consent via our cookie banner.
  • Legal obligation: We may retain certain data to comply with tax, accounting, or other legal requirements.

5. Who we share data with

We share data with the following third-party providers, strictly for service delivery:

  • Stripe: payment processing. Stripe is PCI DSS Level 1 certified. Stripe Privacy Policy
  • Stannp: letter printing and postal delivery. Stannp receives homeowner addresses and letter content to fulfil printing and postage. Stannp Privacy Policy
  • Resend: transactional email delivery. Resend processes your email address to deliver service emails. Resend Privacy Policy
  • Sentry: error monitoring, hosted in the EU. When something goes wrong in the app, Sentry receives the technical error report and the account ID it happened under. Reports are stripped of names, email addresses, IP addresses, postcodes, form contents and cookies before they are sent. Sentry Privacy Policy

We do not sell, rent, or trade your personal data to any third party. We do not share data with advertisers.

6. Data retention

  • Active accounts: Data is retained for as long as your account is active.
  • Cancelled accounts: After cancellation, your data is retained for 30 days (grace period) to allow reactivation. After 30 days, personal data is anonymised.
  • Financial records: Payment and invoice data may be retained for up to 7 years to comply with UK tax and accounting obligations.
  • QR scan events: Retained for 24 months from the scan date, after which they are permanently deleted. The monthly salt rotation further reduces re-identification risk over time.
  • Support and sales correspondence: Messages you send us (and our replies) are retained for 24 months after the conversation is closed, then deleted.

7. Your rights

Under the UK GDPR, you have the right to:

  • Access your personal data (Subject Access Request)
  • Rectify inaccurate personal data
  • Erase your personal data (“right to be forgotten”)
  • Restrict processing of your data
  • Data portability (receive your data in a structured format)
  • Object to processing based on legitimate interest
  • Withdraw consent for analytics cookies at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Cookies

We use essential cookies to keep you signed in and protect against cross-site request forgery. Analytics cookies (Google Analytics via Google Tag Manager) are only set after you give explicit consent. See our Cookie Policy for full details.

9. People we contact for marketing

As part of running PlanPost we identify UK builders and tradespeople whose business may benefit from the service and contact a small number of them by email. For this outreach we are the data controller.

What we hold and where it comes from

Business contact details only: company or trading name, business email address, website, phone number, and registered company information. We obtain these from publicly available sources: the business's own website, public business listings (such as Google), and the Companies House register. We do not use any special-category data, and we verify that an email address is published on the business's own domain before using it.

Legal basis

Our legal basis is legitimate interest (UK GDPR Article 6(1)(f)): promoting a relevant professional service to a business audience, balanced against the recipient's interests and rights. We have carried out and documented a Legitimate Interest Assessment. Where a recipient is an individual subscriber for the purposes of PECR (for example a sole trader or partnership), we take their interests and the PECR direct-marketing rules into account before contacting them.

Your choices and opt-out

Every marketing email lets you opt out. Simply reply asking us to stop, or use the unsubscribe link. We action opt-outs promptly and add you to a permanent suppression list, so you will not be contacted again and will not be re-added if we later come across your details from another public source.

Retention

We keep prospect data only while it is relevant for outreach and review it periodically. If you reply to one of our emails, we keep that correspondence for up to 24 months after the conversation is closed. If you opt out, we retain the minimum needed (a suppression record) purely to make sure we do not contact you again. You can ask us to erase your details entirely at any time.

All of the rights in section 7 apply to this processing, including the right to object to direct marketing at any time, which we will always honour. To opt out, object, or be erased, email [email protected].

10. Contact

If you have any questions about this privacy policy or how we handle your data, contact us at [email protected].

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk.