Version: privacy-2026-08-31 Last updated: 31 August 2026 Contact: privacy@eireplan.ie

This policy explains what personal data EirePlan collects, why, on what legal basis, who we share it with, where it goes, how long we keep it, and what you can do about it.

It covers two different groups of people, and the difference matters:

• Users. People who hold an account or visit the website. Sections 1 to 14 are about you.
• People named in the public planning record. If you applied for planning permission in Ireland, your name may appear in our database because the planning authority published it. You did not give us that data and you may not have known we hold it. Section 15 is written for you, and it is the section that explains your rights.

1. Who is responsible for your data

The controller is Neri Carcasci, trading as EirePlan, of [REGISTERED ADDRESS TO BE INSERTED BEFORE PUBLICATION], Ireland.

We intend to incorporate an Irish limited company to carry on this business. When we do, that company becomes the controller and we will update this policy and tell you.

Contact us about anything in this policy at privacy@eireplan.ie. We have not appointed a Data Protection Officer, because we are not required to under Article 37. Privacy queries go to the address above and are handled by the business owner.

2. Personal data we collect about users

You give us:

We generate or observe:

We do not collect special category data as defined in Article 9, and we ask you not to upload it. We do not knowingly collect data about children.

3. Why we use it, and the legal basis

Where we rely on legitimate interests, we have assessed our interest against your rights and concluded that our processing does not override them. You can ask us for that assessment at privacy@eireplan.ie, and you can object under section 11.

4. Cookies and similar technologies

We place nothing on your device that is not strictly necessary to run the service, so there is nothing to consent to and no cookie banner.

What we store is limited to your sign-in session and anti-forgery tokens. If you are not signed in, we store nothing at all. We do not use analytics cookies, advertising cookies, tracking pixels, or any third party script, and we do not sell or share personal data for advertising.

We understand product usage from our own server logs instead, which is covered in section 3 and requires nothing on your device. Full detail is in the Cookie Policy.

5. AI features

When you use an AI feature, the content needed to answer your request is sent to a model provider. That may include the text of your prompt, extracts from documents in the project you are working in, and relevant planning records.

• We instruct our providers not to train models on our data, and they are contractually bound not to.
• Your content is not used to answer another customer's question and is not shared between organisations.
• We keep a record of the request for billing, cost control and debugging.
• Model providers are outside the European Economic Area. Section 8 explains the safeguards.
• No AI feature makes an automated decision about you that produces a legal or similarly significant effect within the meaning of Article 22.

AI output can be wrong. It is a draft for your review, not a statement of fact by us.

6. Who we share data with

We do not sell personal data. We share it only with the processors listed below, each under a written contract that meets Article 28.

We will give notice in this policy before adding a new processor, and business customers may object under the Data Processing Terms.

We may also disclose personal data where we are legally required to, to establish or defend a legal claim, or to a buyer if the business is sold, in which case we will tell you.

7. Where your data is stored

Your account, your documents, your project data and the planning database are stored in Ireland, and the applications that serve them run in Belgium. For the great majority of what we hold, your data does not leave the European Union.

8. Transfers outside the European Economic Area

Some processors in the table above operate from the United States. Those transfers are protected by:

• The European Commission's Standard Contractual Clauses, incorporated into our contract with each of them, together with technical measures including encryption in transit.
• Where the provider is certified, the EU to US Data Privacy Framework adequacy decision.

We have assessed each transfer and limited what is sent. Geocoding sends an address, not your identity. Model providers receive the content of your request, so please do not put personal data into a prompt unless you need to.

You can ask us for a copy of the safeguards that apply to a specific transfer at privacy@eireplan.ie.

9. How long we keep it

10. Security

Data is encrypted in transit and at rest. Access to production systems is limited to those who need it and requires multi-factor authentication. The database denies access by default and is reachable only through our backend. Organisation and project separation is enforced by our application layer, and we log administrative access.

If a breach is likely to result in a risk to your rights, we will notify the Data Protection Commission within 72 hours, and we will tell you directly where the risk is high.

Report a vulnerability to security@eireplan.ie. See clause 21 of the Terms for our commitment to researchers who report in good faith.

11. Your rights

You have the right to:

• Access the personal data we hold about you, and receive a copy.
• Rectify data that is wrong or incomplete.
• Erase your data, where one of the grounds in Article 17 applies.
• Restrict processing while a dispute about accuracy or legitimate interests is resolved.
• Portability of data you gave us, in a structured, machine readable format, where processing is based on consent or contract.
• Object to processing based on legitimate interests. If you object, we will stop unless we can show compelling grounds that override your rights. If you object to direct marketing, we will stop, with no exceptions.
• Withdraw consent at any time, which does not affect processing already carried out.
• Not be subject to a decision based solely on automated processing with legal or similarly significant effect. We do not make such decisions.

To exercise any right, email privacy@eireplan.ie. We will respond within one month, and may extend by two further months for complex requests, telling you if we do. We do not charge, unless a request is manifestly unfounded or excessive.

We may ask you to verify your identity before we act, so that we do not disclose your data to someone else.

12. Complaints

Please raise concerns with us first at privacy@eireplan.ie.

You also have the right to complain to the Data Protection Commission at any time:

Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland www.dataprotection.ie

If you live in another EEA country, you may complain to your local supervisory authority instead.

13. When you upload other people's data

If you upload documents containing personal data about other people, for example an applicant, an objector, a neighbour or a client, you are the controller of that data and we process it on your behalf. Our Data Processing Terms govern that relationship and meet Article 28.

You are responsible for having a lawful basis for the upload, and for telling those people what you are doing, as your own privacy notice requires.

14. Changes to this policy

We will update this policy as the service changes. Where a change is material, we will tell you by email or in the platform before it takes effect, and we will ask you to acknowledge it. The version identifier at the top changes whenever the substance changes.

15. If your name appears in the public planning record

This section is for people who never signed up to EirePlan and did not give us their data. It is our notice under Article 14 of the GDPR.

What we hold. Planning authorities in Ireland are required by the Planning and Development Act 2000 to keep a public register of planning applications, and to publish it. That register includes the name of the applicant, the address of the development, a description of it, and the decision. We collect that published record and organise it so it can be searched and analysed.

If you applied for planning permission, your name may be in our database, next to the address of the development.

Where we got it. From the planning authorities themselves, through the national planning data service and the authorities' own public portals, and from An Coimisiún Pleanála for appeals. We did not obtain it from you, and we do not buy personal data.

Why we process it, and on what basis. Our legal basis is Article 6(1)(f), legitimate interests. The interests are our own commercial interest in operating a planning research service, the interests of our users, who are planning professionals, researchers, solicitors and members of the public, and the wider public interest in the planning system being transparent and capable of being scrutinised. Planning is a public process that affects neighbours and communities, and the law requires the register to be public precisely so that it can be examined.

We have carried out a legitimate interests assessment and are satisfied that our use does not override your rights, taking into account that the data was published by a public authority, that it relates to a public administrative process rather than your private life, and that we apply the limits below.

The limits we apply.

• Applicant names are not shown to anonymous visitors and are not published on pages open to the public internet or to search engines. They are visible only to people who have signed in and accepted our Terms.
• We do not enrich applicant names with data from other sources, we do not build profiles of individuals, and we do not use these names for marketing or advertising.
• We do not sell this data.
• We link to the official record so that the authority's version remains the authoritative one.

How long we keep it. For as long as the record has research and reference value, which reflects the fact that planning history attaches to land indefinitely and that a decision from decades ago can still be material to a site today. We review this.

Your rights. You have every right listed in section 11. Two are particularly relevant:

• You can object at any time under Article 21(1). You do not need to give a reason, though it helps if you explain your situation. When you object, we stop processing unless we can demonstrate compelling legitimate grounds that override your interests. In practice, if you object to your name appearing, we will remove or suppress it, and we will tell you what we have done.
• You can ask us to erase your name under Article 17.

Removing your name from our copy does not remove it from the statutory register held by the planning authority, which we do not control. If you want it removed there, you must contact the authority.

To object, or to ask what we hold about you, email privacy@eireplan.ie with the address of the development and, if you know it, the planning reference. We will respond within one month.

Why we did not contact you directly. Article 14(5)(b) does not require us to give this notice individually where doing so would involve disproportionate effort. The register contains hundreds of thousands of records covering many years, and we do not hold contact details for the people named in them. Writing to each person is not possible, and attempting it would mean collecting contact data we do not currently hold and do not need. We publish this notice instead, keep it linked from every page of the site, and apply the safeguards above, which is the balancing measure Article 14(5)(b) requires.

16. Contact

Neri Carcasci, trading as EirePlan [REGISTERED ADDRESS TO BE INSERTED BEFORE PUBLICATION], Ireland

Data protection: privacy@eireplan.ie Security: security@eireplan.ie General: hello@eireplan.ie