Privacy notice

ValidFirst (validfirst.co.uk) helps people check a planning application before they submit it, and helps council validation officers check it when it arrives. Contact: hello@validfirst.co.uk.

Our role depends on the situation:

• Applications made to a council that uses ValidFirst. The council is the controller and we process the data on its behalf, as its processor, under a contract (UK GDPR Article 28). The council’s own privacy notice for planning applies, and the council handles requests about your data; we help it.
• Our own website, guest trials and the pilot request form. We are the controller.

Applicants and agents: your email address; your name, phone number and company if you enter them; the site address and its location; the description of the work and your answers; the documents you upload (plans, drawings, photos, statements), which may show people or property; the check findings and any notes you add; the check code.

People named or shown in documents, such as neighbours, owners or report authors, where an applicant includes them.

Council staff: name, work email, role, how you log in (passkeys, Microsoft Entra ID), and your decisions, reasons, messages and notes on applications.

Everyone who logs in: a hash of your session, the network address of your logins (kept 90 days) and an audit log of what you did in an application.

Pilot requests: your name, council, role, work email, phone number if given, and your message.

We don’t ask for special category data (such as health or ethnicity). It can appear in a document an applicant uploads, for example a statement explaining a disability adaptation; it is then treated with the same protection as the rest of the application.

• Checking and validating applications (for the council): public task, Article 6(1)(e). The council’s functions as local planning authority under the Town and Country Planning Act 1990 and the Development Management Procedure Order 2015.
• Keeping the service secure (login logs, rate limits, audit log): for the council, part of its public task; for our own site, our legitimate interest in protecting the service and its users, Article 6(1)(f).
• Guest trials and answering pilot requests: our legitimate interest in showing councils and applicants what ValidFirst does and replying to people who ask, Article 6(1)(f). You can object at any time.
• Measuring accuracy: the council sees how often the check agreed with its officers. We may use aggregated figures without personal data to improve the service.

We don’t sell personal data, and we don’t use it for advertising.

An AI model reads each uploaded document and checks whether it shows what the planning requirements ask for. It does not decide anything: the applicant decides whether to change a document and can submit regardless, and the council’s validation officer decides whether an application is valid, judging each finding first. No decision about you is based solely on automated processing.

The model is Claude, made by Anthropic, used through Amazon Bedrock in AWS regions in the EU. Bedrock does not pass requests to Anthropic. A council can choose a European provider (Mistral AI, Paris) instead. More on the trust page.

Data is stored at Amazon Web Services in Frankfurt, Germany, with a backup copy in Ireland, and the AI check runs in AWS regions in the EU. Transfers from the UK to the European Economic Area rely on the UK’s adequacy regulations.

We use a small number of sub-processors under contract: Amazon Web Services (hosting, storage, email, AI), Sentry (error reports, scrubbed of personal data, EU region), Google Workspace (our mailbox) and, only if a council chooses it, Mistral AI. The full list is on the trust page. To show site constraints we send only the location to planning.data.gov.uk, never your name or email.

Within an application, your data is seen by you, the people you invite, and the officers of the council you apply to. Our support staff can look inside a council’s account read-only for up to two hours when the council needs help; every time is logged.

The council keeps its own planning record in its back-office system, under its own retention schedule. Pilot requests are kept in our mailbox for as long as we need them to follow up.

We use only functional cookies: to keep you logged in, to hold a login step for a few minutes, and to recognise your device for security alerts. No advertising, analytics or tracking cookies, so we don’t ask for cookie consent.

You have the right to access your data, to have it corrected, to have it erased, to restrict or object to its use, and to receive it in a portable form. Some rights are limited where a council processes data for its public task; for example, an application the council needs for its planning record may not be erased on request.

• For an application made to a council, contact the council’s planning team or Data Protection Officer. If you contact us, we pass your request to the council within 2 working days.
• For guest trials, pilot requests and your account, contact us at hello@validfirst.co.uk.

We reply within one month.

If you’re unhappy with how your data is handled, tell us or the council first. You can also complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.