Privacy policy

Last updated 19 September 2026.

You are about to send us a planning refusal, which is a document about your property and often about a dispute. This sets out exactly what happens to it. The short version: it is used to write your assessment and for nothing else, it is not sold or shared for marketing, and it is deleted after twelve months unless you ask otherwise.

Who is responsible

Mark Hicks, trading as Refusal Review, of Windmill Wood Cottage, Gumfreston, Tenby, Pembrokeshire, SA70 8BR, is the data controller. Contact: hello@refusalreview.co.uk.

We are registered with the Information Commissioner’s Office for the data protection fee under reference ZC248616.

What we collect

When you submit the form:

Your name, email address and telephone number
The local planning authority and the application reference
Your description of what you applied for
Your appeal deadline, if you give it
The decision notice you upload, as a PDF or a photograph, and any further documents you send
A record that you accepted the terms and asked for work to begin early, with the time you did so

The form has two steps. When you finish the first (your name, email, how you want to start, the authority and the reference) we keep those details, so we can bring you back to the second step if you stop there. If you never finish, they are deleted after thirty days.

During the work we also gather material about your application from public sources — your council’s planning register, committee papers, statutory consultees’ published responses, appeal decisions, and public mapping. That material is already public. Bringing it together in one file about you makes it personal data in our hands, so it is covered by this policy too.

Card details. We never see them. Payment is handled entirely by Stripe, who tell us only that a payment succeeded and for how much.

Analytics. This site sets no cookies for visitors and contains no tracking pixels or advertising tags. We count visits with Vercel Web Analytics, which uses no cookies and does not identify you: see Counting visits to this website, below. Vercel, who host the site, also keep short-term server logs including IP addresses for security and to keep the site running. The one cookie the site ever sets is a sign-in cookie on the devices of the person who runs Refusal Review, for the pages only he uses; it is never set for anyone else.

Stopping misuse of the forms. So that nobody can use our forms to send email to people who did not ask for it, we count how many requests arrive from one email address and from one internet connection in a day. For the connection we keep only a one-way scrambled form of the IP address (a salted hash), which cannot be turned back into the address, and we delete it after seven days. The legal basis is our legitimate interest in keeping the service secure and in not sending unwanted email.

Special category data. We do not ask for it. If your case involves health, disability or similar — a ground-floor bedroom for a disabled family member, say — and it is relevant to a reason for refusal, send it. It is then processed on the basis of Article 9(2)(f) UK GDPR, for the establishment, exercise or defence of legal claims, and it stays inside your file.

Why, and on what legal basis

To decide whether to take your case, and to write the assessment — performance of our contract, Article 6(1)(b) UK GDPR.
To take payment and issue a receipt — performance of our contract.
To keep accounting records — a legal obligation, Article 6(1)(c).
To keep a record of what we advised and the consent you gave — our legitimate interests in being able to answer a later query or complaint, Article 6(1)(f), balanced against the limited retention below.
To send the few reminders described below — our legitimate interests in finishing something you started with us, Article 6(1)(f), within the rules on email marketing in regulation 22(3) of the Privacy and Electronic Communications Regulations 2003.

The emails we send

We do not send marketing and there is no mailing list. Every email you get from us is about a request you started with us: the confirmations and answers that are part of it, and at most these reminders.

One, if you finish the first step of the form and stop before sending it.
Two, if you start paying for an assessment and do not finish: one when the payment page expires and one a day later.
Two, after a free check that said we can help and has not been booked: one a few days later, and one two weeks before your appeal deadline.

You can refuse them when you first give us your email address, with the tick box at the first step of the form, and every reminder has a link that stops them. Stopping them does not stop the emails that are part of a service you have bought.

Who else sees it

Nobody, other than the services we need to run this. None of them are given your information for their own purposes, and none of them sell it.

Vercel — hosts the website, counts visits to it without cookies (see below), and stores your uploaded documents in a private store located in the United Kingdom.
Stripe — takes the payment. Stripe is the controller of your card data, under its own policy.
Todoist — where the job sits while we do it.
Resend — sends the confirmation and any email about your case.
Neon — the database holding the record of your enquiry: your name, contact details, the reference, and what stage the work has reached. Your uploaded documents are not stored there.
Anthropic — reads your decision notice when it arrives and pulls out the authority, the reference, the date and the reasons given, so we can tell you quickly whether we can help. Processing is under Anthropic’s commercial terms, which incorporate a data processing agreement and the standard contractual clauses; by default inputs and outputs from those commercial products are not used to train models.
Google (Gmail) — email.
Stannp — prints and posts the letters described under “If we have written to you by post”. It receives the address and the letter, nothing else.
Google Ireland Limited (Google Ads) — only if you reached us from a Google advert. Google is sent the click identifier from that advert and, if you go on to buy, the fact, time and value of the purchase, so we can tell which adverts pay their way. Nothing about your case — not your name, your documents or your council — is shared.

Your uploaded documents are stored in the United Kingdom, and the site itself runs there. Anthropic, named above, receives your decision notice so that it can be read. Anthropic and some of the other services above are based in the United States or process data there; those transfers rely on the UK extension to the EU–US Data Privacy Framework where the provider is certified, or on the International Data Transfer Addendum to the European Commission’s standard contractual clauses.

We will disclose information if the law requires it. We will not disclose anything to your local planning authority, to an objector, or to anyone else involved in your case, and we do not contact your council on your behalf.

If we have written to you by post

We send letters to people whose planning application has recently been refused. We get the site address, application reference, decision and decision date — and the applicant’s name where the council publishes it — from the council’s public planning register, via planit.org.uk, which collects register data. Our lawful basis is legitimate interests: telling refused applicants about a service that is relevant to a time-limited decision. We send one letter. We do not share your details with anyone except Stannp, the company that prints and posts our letters, and we delete them six months after your appeal deadline unless you become a client. Your letter carries a reference beginning RR-; it links the letter to your enquiry if you get in touch, and nothing else.

You can object at any time at refusalreview.co.uk/no-post, by emailing hello@refusalreview.co.uk, or by post. We remove your details within one working day and will not write again. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

Counting visits to this website

We count visits to this website so we can see which pages are used and whether our letters and advertising bring people here. We use Vercel Web Analytics, run on our behalf by Vercel, our hosting provider.

It uses no cookies. It records the page visited, the site you came from, your country, and your device type, browser and operating system. It does not record your IP address or anything that identifies you, and it cannot follow you to other websites or from one day to the next. We see only totals. We remove any case reference, payment link or advertising click identifier from the address before anything is sent.

The law allows this without asking first, as a statistical purpose under Schedule A1 to the Privacy and Electronic Communications Regulations 2003, provided you can object. You can, at any time and free of charge: use the switch below, or turn on Global Privacy Control in your browser, and nothing is counted. Our lawful basis under UK GDPR is legitimate interests (Article 6(1)(f)): knowing whether the website works and which ways of reaching people are worth what they cost.

We also count how far people get through the form, so we can see where it loses them. When you reach a step (starting the form, finishing its first step, starting and finishing an upload, sending it), the page sends us a note of that step, whether you arrived from one of our letters, from an advert or directly, and a random number that exists only for that page load, so one visit is not counted twice. It goes to our own database, not to anyone else, and nothing is stored on your device. Until you have a reference, nothing about you is in it; after that, the note carries the reference. The switch below and Global Privacy Control stop these notes as well. Separately, we record on your reference when we answer a free check, when a payment page is opened and when a payment arrives, as part of handling your order.

How long it is kept

Your documents and your file — twelve months after the assessment is delivered, then deleted. Ask us sooner and we will delete them sooner.
The assessment itself and the record of your consent — six years, being the limitation period for a contract claim in England and Wales. Held in case either of us needs to refer back to it.
Records required for tax — six years from the end of the tax year, as HMRC requires. These are transaction records, not your planning file.
Declined cases — thirty days, then deleted, apart from the refund record.
A form started and not finished — thirty days, then deleted.

Security

The site is served over HTTPS. Your uploaded documents are held in private storage in the United Kingdom — they have no public web address at all, and cannot be reached by anyone who has not been given a signed, time-limited link. Those links expire. Access to email, storage and our task list is protected by two-factor authentication. We do not put your documents on removable media, and we do not email them to anyone.

No system is perfect. If there were ever a breach likely to result in a risk to you, we would tell the ICO within 72 hours and tell you without undue delay.

Your rights

Under the UK GDPR you can ask us to:

give you a copy of what we hold about you
correct anything inaccurate
delete it — though we may keep the minimum needed for tax and for a limitation-period record
restrict or object to what we are doing with it
give you your data in a portable form

Email hello@refusalreview.co.uk. It is free, and we will reply within one month. There is no automated decision-making and no profiling.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you told us first, but you do not have to.

The sample on this website

The sample assessment published on this site is a real one. It appears with the client’s express permission, and with the location, the authority, all dates, all names and every application and appeal reference removed, so that neither the client nor the case can be identified from it. We will never publish your case without asking you first, and never while it is live.

Changes

If this policy changes, the date at the top changes with it. If a change materially affects work we are doing for you, we will email you.