Data Export and Retention Policy

1. Purpose and scope

This policy sets out how long PlanProve retains different categories of data, what happens to that data when an account is closed or a subscription ends, and how a professional or practice can export their data. It applies to all data processed through the PlanProve platform, whether entered directly by a professional, uploaded as a document, or generated by the platform (such as AI-extracted deadlines or site constraint data).

This policy is written to reflect the storage limitation principle under UK GDPR Article 5(1)(e): personal data must be kept for no longer than is necessary for the purpose it was collected for. Where PlanProve acts as a data processor on behalf of a professional or practice (the data controller), retention of client and third-party data within case files follows the controller's instructions, not a period set unilaterally by PlanProve.

2. Roles: controller and processor

For data relating to a professional's own account (login details, billing, usage of the platform), PlanProve (Make My Plan Ltd) is the data controller.

For client and case data entered by a professional (client details, project correspondence, objector or neighbour personal data included in case files, documents uploaded to a site), the professional or practice is the data controller and PlanProve acts as data processor. Retention decisions for this category rest with the controller; PlanProve's role is to retain, delete, or export this data on their instruction, consistent with the periods set out below unless the controller specifies otherwise in our Data Processing Agreement, which you accept online.

3. Retention schedule

What we keep, and for how long. This is the same schedule as in our Privacy Notice.

4. What happens when a subscription ends or an account is closed

4.1 Voluntary non-renewal (e.g. at the end of a free trial period)

If a professional or practice chooses not to continue after a trial or free period ends, their account and data are not deleted automatically. Data remains in place unless and until a deletion request is made, as described in 4.2.

4.2 Voluntary account deletion

A Client can request deletion from their account settings; the request is recorded and the account is deleted automatically after a 30-day grace period.

A professional can also request deletion from their account settings, and the request is recorded immediately, but completion of a professional or practice deletion is currently handled manually rather than automatically. We will complete it within 30 days of the request, consistent with UK GDPR erasure expectations, and you can withdraw the request at any time before then. You can also request deletion by email at info@planprove.com.

Completion is manual because a professional's account may be linked to a practice, to invoices, and to case files for which the professional is the data controller, each of which has to be settled before the account itself can be removed. Invoices you create are your own financial records. Export them first, including as a CSV for Xero, and we delete them on your instruction when we close your account. We keep our own billing records for your subscription for as long as tax law requires.

4.3 Backups

Database backups are managed by Supabase under their standard platform terms, with a 7-day rolling window; deleted database records may persist in one for up to 7 days after removal from the live system.

Uploaded documents and files are backed up separately and daily to Cloudflare R2 (EU jurisdiction), independent of the primary database infrastructure. A document you delete has its file removed from storage straight away. The files of a condition, stage or site you delete, or of an account when we complete its deletion, are removed from storage within 30 days. Once a file is removed from storage, its backup copy is kept for 30 days and then deleted.

Backups are encrypted at rest, are not shared with any party outside the sub-processors listed in Section 6, and are used only for disaster recovery.

5. Data export

You can export your data at any time, whether the account is active or scheduled for deletion, using the Download My Data button in your account settings. The export is generated immediately; there is no need to request one.

• What an export includes: your main records and documents, that is your profile, the sites you own or are directly assigned to, the projects and stages on those sites, case notes you have written, your contacts, time entries, invoices, messages you have sent, enquiries, notifications, case studies, subscription records, search history, and your uploaded documents.
• It does not yet include everything we hold for you, for example planning conditions and some stage details, and we are extending it. If you need something that is not in your export, ask us at info@planprove.com.
• What it does not include: sites and records belonging to practice colleagues, even where you can view them in the app. An export covers your own records rather than the whole practice's. A practice-wide export is not yet available self-service. Request one at info@planprove.com.
• Format: a ZIP archive containing export.json (all records in structured JSON) and a documents/ folder holding the original uploaded files.
• Size limits: the archive holds up to 100 MB of documents, and individual files of 25 MB or more are listed rather than included. Anything left out is named, with the reason, in _omitted-files.txt inside the archive, and can be downloaded individually from the project it belongs to or requested at info@planprove.com. An export is never silently truncated.
• Rate limit: one export per hour per account.

6. Third-party and sub-processor data

Where data is held by a sub-processor rather than directly within PlanProve's own database, that sub-processor's own retention behaviour also applies. Current sub-processors and their role:

This is Annex A of our Data Processing Agreement, also published on our sub-processors page. Application functions run in London, Dublin and Paris, and some request routing runs on Vercel's global edge network, which processes sign-in session data in transit but does not store it.

Supabase, Cloudflare and PostHog process data within the European Union, which the UK recognises as adequate, so no Article 46 transfer safeguard is required for those transfers.

Anthropic, Stripe, Resend and Vercel are based in or process data via the USA. Each incorporates the UK Addendum to the EU Standard Contractual Clauses into their standard commercial terms, confirmed directly from each vendor's published Data Processing Addendum, so this applies automatically as a customer on their normal terms. Stripe, Resend and Vercel are additionally certified under the UK Extension to the EU-US Data Privacy Framework; Anthropic relies on the UK Addendum alone.

7. Review of this policy

This policy should be reviewed whenever the underlying technical implementation changes (for example, if account deletion behaviour is rebuilt, or if AI processing is moved to an EU-pinned provider), and at minimum annually.