PlanProve
Version 2.5. Last updated: 21 October 2026
Make My Plan Ltd (company number 16887298) is the data controller for personal data collected through PlanProve ("we", "us", "our"). PlanProve is a case management platform ("CRM") built for planning professionals, helping them manage their caseload, track applications, and collaborate with clients on individual projects.
This Privacy Notice explains what personal data we collect, why we collect it, the legal basis we rely on, how long we keep it, who we share it with, and your rights under UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025.
This notice applies to:
For account and billing data (your login details, your subscription and how you use the platform), we are the controller. For personal data of a customer's own clients and other people in their case files, the customer (the professional or practice) is the controller and we are their processor, under our Data Processing Agreement.
When you register and use PlanProve as a planning professional, we collect:
PlanProve does not market to or independently recruit Clients. A Client only has access to PlanProve because a Professional has invited them to view progress on a specific project. When a Client accepts an invite, we collect:
For this category of data, the Professional (or their practice) is the data controller and PlanProve acts as data processor.
When you visit planprove.com, we automatically collect certain technical data including your IP address, browser and device type, referring URL, and pages visited. We use PostHog for analytics. Analytics cookies are only set with your prior consent. See Section 8.
UK GDPR requires us to have a lawful basis for each type of processing. We rely on the following:
| Purpose | Data used | Lawful basis | Applies to |
|---|---|---|---|
| Creating and managing your account | Name, email, password hash | Contract (Art. 6(1)(b)) | Professionals & Clients |
| Client collaboration (Site invites, read-only project view) | Client name, email, invite token, documents marked visible | Contract (Art. 6(1)(b)), on the professional's instruction | Professionals & Clients |
| Fee proposals and invoicing (via Stripe Connect) | Billing details, invoice records, Stripe payment tokens | Contract (Art. 6(1)(b)) | Professionals |
| Shared practice access | Name, email, role, site access permissions | Contract (Art. 6(1)(b)) | Professionals |
| AI-assisted deadline and condition extraction, and the Planning Assistant | Uploaded documents, queries submitted, project context | Legitimate interests, providing the core service (Art. 6(1)(f)) | Professionals |
| AI-assisted development, debugging, and administrative support tooling | Platform records accessed while diagnosing a fault, building or maintaining the platform, or responding to a support request, which may include personal data | Legitimate interests, maintaining, securing and supporting the platform (Art. 6(1)(f)) | Professionals & Clients |
| Platform analytics and improvement | Usage data, search logs, interaction data | Legitimate interests, product improvement (Art. 6(1)(f)) | Professionals & Clients |
| Sending service emails (account, project updates) | Email address | Contract (Art. 6(1)(b)) | Professionals & Clients |
| Marketing emails (product news) | Email address | Consent (Art. 6(1)(a)) | Professionals only. We do not market to Clients |
| Security and fraud prevention | IP, device, activity logs | Legitimate interests, platform security (Art. 6(1)(f)) | Professionals & Clients |
| Legal obligations (accounting, tax records) | Billing records | Legal obligation (Art. 6(1)(c)) | Professionals |
We do not sell your personal data. We share data only with trusted third-party processors who act under our instruction, each subject to a Data Processing Agreement:
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Supabase Inc. | Database and file storage | Ireland, EU-west-1 | Adequacy |
| Anthropic PBC | AI Planning Assistant and document extraction (in-product features); and AI-assisted development, debugging, and administrative support tooling. | USA | UK Addendum to EU SCCs |
| Stripe Inc. | Payment processing for invoices paid through the platform (Stripe Connect). PlanProve does not store card details. | USA | UK Addendum to EU SCCs/DPF |
| Resend Inc. | Transactional email delivery | USA | UK Addendum to EU SCCs/DPF |
| Vercel Inc. | Application hosting. Application functions run in the UK and EU (London eu-west-2, Dublin eu-west-1, Paris eu-west-3). Request routing runs on Vercel's global edge network. | UK/EU for functions, global for edge routing | UK Addendum to EU SCCs/DPF |
| PostHog Inc. | Product analytics | EU (Frankfurt eu-central-1) | Adequacy |
| Cloudflare Inc. | Storage backup (R2) | EU | Adequacy |
This is Annex A of our Data Processing Agreement. The current list, and how we tell you about changes, is on our sub-processors page. Application functions run in London, Dublin and Paris, and some request routing runs on Vercel's global edge network.
Supabase, Cloudflare and PostHog process data within the European Union, which the UK recognises as providing an adequate level of protection, so a UK GDPR Article 46 transfer safeguard is not required for those transfers. Transfers to Anthropic, Stripe, Resend and Vercel in the USA are protected by the UK Addendum to the EU Standard Contractual Clauses, the correct UK-specific transfer mechanism since March 2022, rather than the EU SCCs alone. Stripe, Resend and Vercel are additionally certified under the UK Extension to the EU-US Data Privacy Framework (DPF); Anthropic relies on the UK Addendum alone.
Anthropic, Stripe, Resend and Vercel all incorporate the UK Addendum to the EU Standard Contractual Clauses into their standard commercial terms, confirmed directly from each vendor's published Data Processing Addendum. This applies automatically as a customer on their normal terms, with nothing separate to request or sign.
We may also share data with: law enforcement or regulatory authorities where legally required; professional advisers (lawyers, accountants) under confidentiality obligations; and, where you are part of a shared practice, other authorised members of that practice for the sites and data your practice administrator has given you access to.
We do not keep personal data longer than necessary for the purpose for which it was collected:
| What | How long we keep it | Why |
|---|---|---|
| Your account, profile, sites, projects, documents and case notes | For as long as the account is open. | Needed to provide the service (UK GDPR Art. 6(1)(b), contract). |
| Personal data of a professional's clients and other people in their case files (for example objectors, neighbours and consultees) | For as long as the professional's account keeps the related record. The professional or practice decides, as the controller. | We process this data for the professional or practice, on their instructions. |
| Client accounts, after a deletion request | Deleted automatically 30 days after the request. The request can be withdrawn until then. | A short window to change your mind, then deletion. |
| Professional and practice accounts, after a deletion request | Deleted by us on request, within 30 days of the request. | These accounts can be linked to a practice, invoices and case files, which we settle before deleting. |
| Invoices you create | Until we close your account, then deleted on your instruction. Export them first, including as a CSV for Xero. | They are your own financial records, and you keep them for as long as the law requires. |
| Our billing records for your subscription | As long as tax law requires. | Our own legal obligation for business records. |
| Search history | Your user id is removed after 90 days, and the record is deleted after 365 days. | Only useful for a short time, then kept only as anonymous totals. |
| Sign-in protection records (the email address and IP address of sign-in, sign-up and password reset attempts) | 24 hours. | Protecting accounts from password guessing. |
| Draft projects with no activity | Archived, not deleted, after 90 days without activity. | Keeps your project lists tidy. Archived drafts stay in your account. |
| AI assistant usage records | Until the account is deleted. These record when the assistant was used, not what you asked it. We do not store your conversations with the assistant. | Fair use limits and keeping the assistant working well. |
| Analytics events | Sent to PostHog (EU) only after you accept analytics cookies. They contain a user id and page address, not names or emails. | Understanding how the platform is used, with your consent. |
| Records of actions our administrators take on an account | Kept, with no fixed period. They are unlinked from the account when it is deleted. | Accountability for administrative actions. |
| All other records | Until the account is deleted. | Needed to provide the service. |
| Database backups | Overwritten within 7 days. | Our database provider's standard backups. A deleted record can stay in a backup for up to 7 days. |
| File backups | A document you delete has its file removed from storage straight away. The files of a condition, stage or site you delete, or of an account when we complete its deletion, are removed from storage within 30 days. A removed file's backup copy is kept for 30 days, then deleted. | Uploaded files are backed up separately, because database backups do not include files. |
A more detailed Data Export and Retention Policy is published on this site, setting out the full retention schedule and export process, particularly for practice customers who require this as part of their own due diligence.
Under UK GDPR you have the following rights. To exercise any of them, contact us at info@planprove.com. We will respond within one month.
Right of access: You can request a copy of all personal data we hold about you (a Subject Access Request).
Right to rectification: You can ask us to correct inaccurate or incomplete data.
Right to erasure: You can request deletion of your data where we no longer have a legal basis to hold it. Note: we keep our own billing records for your subscription for as long as tax law requires, as set out in Section 5.
Right to data portability: You can request your data in a machine-readable format via your account settings.
Right to restrict processing: You can ask us to pause processing your data while a complaint is investigated.
Right to object: You can object to processing based on legitimate interests (e.g. analytics). We will stop unless we have compelling legitimate grounds.
Right to withdraw consent: Where processing is based on consent (e.g. marketing emails, analytics cookies), you can withdraw it at any time.
Right to complain directly to us: Under the Data (Use and Access) Act 2025, you have the right to raise a complaint about how we've handled your personal data directly with us, before or instead of going to the ICO. Email info@planprove.com with "Data Complaint" in the subject line. We will acknowledge your complaint within 30 days and keep a record of how it was resolved.
Right to complain to the ICO: You also have the right to lodge a complaint with the Information Commissioner's Office: ico.org.uk or 0303 123 1113.
PlanProve uses an AI Planning Assistant powered by Anthropic's Claude models, available to Professionals. It is used to extract deadlines and planning conditions from documents you upload, and to answer questions about your own sites and projects. It does not draft planning statements or provide professional planning judgement. That remains entirely with you.
The AI Planning Assistant does not make automated decisions that have legal or similarly significant effects on any individual. It is a productivity tool for Professionals only. Clients do not interact with the AI Planning Assistant.
Content you submit to the AI Planning Assistant is processed by Anthropic as a data processor acting under our instruction. We do not use this data to profile users or make automated decisions about eligibility for services.
AI-assisted development and support. Separately from the in-product features above, we use Anthropic's models as a development, debugging and administrative support tool when building and maintaining the platform. Where diagnosing a fault or responding to a support request requires it, platform records that may contain personal data can be processed in that way. Anthropic acts as a data processor under our instruction for this use as well, it is covered by the same Data Processing Agreement, and it is never used to make automated decisions about any individual. The lawful basis is legitimate interests in maintaining, securing and supporting the platform.
We use the following categories of cookies:
| Category | Examples | Consent required? | Purpose |
|---|---|---|---|
| Strictly necessary | Supabase session cookie, Stripe session | No, essential for the site to function | Authentication, security, payment processing |
| Analytics | PostHog analytics cookies | Yes, opt-in consent required | Understanding how users use the platform to improve it |
You can manage your cookie preferences at any time via the cookie banner on our website.
We implement appropriate technical and organisational measures including:
Backup and disaster recovery. Database backups are taken daily and managed directly by our database provider, Supabase, under their standard platform service terms. Uploaded documents and files are separately backed up daily to Cloudflare R2, held in the EU, independent of the primary database infrastructure. Backups are encrypted at rest and are used only for disaster recovery. Retention periods for backups are set out in Section 5.
In the event of a personal data breach that is likely to result in a risk to individuals, we will notify the ICO within 72 hours and affected individuals without undue delay. If a breach affects personal data we process for a customer, we tell that customer without undue delay, as set out in our Data Processing Agreement.
We may update this Privacy Notice from time to time. If we make a material change, we will tell you by email or through a notice on the platform, and ask you to accept the new version the next time you sign in. The date at the top of this document reflects the most recent version.
For any questions about this notice or to exercise your rights:
If you are unhappy with how we have handled your data, you can raise it with us directly first (see Section 6), or complain to the Information Commissioner's Office (ICO):