Curtilage Privacy Notice
In one paragraph. Curtilage is run by Patient Thread Ltd. We keep the minimum needed to give you a planning letter, a quote check or a feed of approved applications: your account email, what you type or upload, and a record of what you paid for. We never collect or store neighbours' names or addresses. Applicant and agent names appear only where the council itself publishes them. Card details go to Stripe, not to us. If you agree, the line items from a quote you check are added, anonymised, to a benchmark corpus; nothing about you travels with them.
1. Who we are
The controller is Patient Thread Ltd, company number 17167409, part of the Lawrence Medical Ltd group (ICO registration ZC223090). Correspondence address: 9 Harley Street, London W1G 9QY. Contact: chris@patientthread.com. Curtilage is a working product name.
2. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account: email address, sign-in tokens | To run your account and show you your letters, reports and subscription | Contract |
| Planning letter requests: the council, the application reference, the points you type, and the name and address you choose to sign the letter with | To draft your letter from adopted policy | Contract |
| Quote checks: the document or photo you upload and the line items extracted from it | To produce the report | Contract |
| Anonymised quote line items (trade, project type, region, category, quantity, price), with no name, address, company or document | To build the benchmark that shows whether a price is typical. Only aggregates over five or more quotes are ever shown. | Consent (the box on the quote page; untick it and nothing is added) |
| Orders: what you bought, when, the amount, and Stripe's reference numbers | Records, receipts, subscription access | Contract and legal obligation (accounting) |
| Technical logs: IP address, browser, timestamps, errors | Security, abuse prevention, keeping the service working | Legitimate interests |
We do not collect neighbours' details, and the trade leads feed shows only what councils publish on their public planning registers.
3. Who processes data for us
- Supabase (database and authentication, hosted in London) and Netlify (website and functions).
- Stripe handles payment. We never see your card number. Stripe's own privacy notice applies to the payment page.
- Anthropic provides the AI model that turns your request into a draft letter and reads your quote document. The text of your request or document is sent to the model to produce the result and is not used to train models.
- PlanIt (planit.org.uk) and council planning portals are the sources of application data. When you look up an application we send the reference to those services.
Where a processor is outside the UK, transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
4. How long we keep it
- Your account, letters, reports and uploaded documents: while your account is open. Ask us and we delete them; we may keep order records for six years for accounting.
- Anonymised corpus line items: kept indefinitely; they cannot be linked back to you.
- Technical logs: up to 90 days.
5. Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to processing based on legitimate interests, withdraw consent to the corpus at any time, and ask for your data in a portable form. Email chris@patientthread.com. You can complain to the Information Commissioner's Office at ico.org.uk.
6. Cookies
We use only the cookies and local storage needed to keep you signed in. No advertising or analytics cookies.
7. Children
Curtilage is for adults dealing with planning matters and building work. We do not knowingly collect data from anyone under 18.
8. Changes
If we change this notice we will update the date above and, for material changes, tell account holders by email.