Privacy Policy

Validar (validar.co.uk) is committed to protecting your personal data and handling it transparently. This policy explains what we collect, why we collect it, and your rights.

Data Controller: Conor Naughton
Contact: privacy@validar.co.uk

1. What Data We Collect

• Account data: name, email, job title, organisation.
• Usage data: validation reports, checks run, council preferences.
• Payment data: Stripe handles payment processing; we never see your full card details.
• Planning documents: PDFs uploaded for validation are sent to Anthropic's Claude API for processing. Anthropic does not store your uploads permanently.

2. Why We Collect Data (Legal Basis)

• Account data: Contract performance.
• Usage data: Legitimate interests (improving and securing the service).
• Payment data: Contract performance.
• Planning documents: Contract performance (to provide validation results).

3. How We Use Your Data

• Provide the planning validation service.
• Send validation result emails and account notifications.
• Improve validation accuracy and product quality.
• Process payments via Stripe.
• Provide customer support.

4. Third-Party Processors

• Anthropic (Claude AI): Processes uploaded PDFs for validation. Data may be processed in the US. Privacy policy: anthropic.com/privacy
• Supabase: Database and file storage provider, with EU region availability. Privacy policy: supabase.com/privacy
• Stripe: Payment processor. Privacy policy: stripe.com/privacy
• Vercel: Hosting and deployment. Privacy policy: vercel.com/legal/privacy-policy
• Resend: Transactional email provider. Privacy policy: resend.com/privacy

5. Data Retention

• Account data: retained while your account is active and for 30 days after deletion.
• Validation reports: retained for 12 months, then automatically deleted.
• Uploaded PDFs: deleted from storage after 30 days.
• Payment records: retained for 7 years to meet legal and accounting obligations.

6. Your Rights

You have the right to access your data, correct inaccurate data, delete your account and personal data, export your data, object to processing, and withdraw consent where processing relies on consent.

To exercise your rights, contact privacy@validar.co.uk.

7. Cookies

• Essential cookies: login sessions and security features (cannot be disabled).
• Analytics cookies: only used where you provide consent.

8. Changes To This Policy

If we make material changes, we will notify you by email.

9. Contact

privacy@validar.co.uk
We respond to GDPR requests within 30 days.