Effective date: 1 May 2026
Privacy Policy
1. Data Controller
The data controller for personal data processed through the ExtendPal platform is Extend Technologies Ltd, a company registered in Northern Ireland.
Contact: privacy@extend.app
2. What Data We Collect
We collect and process the following categories of personal data:
- —Account data: your name and email address, obtained when you sign in via Google OAuth or email.
- —Property address: the address you enter when creating a project. Used to resolve planning jurisdiction and permitted development rules.
- —Project data: your extension brief — room dimensions, design preferences, and any text or images you provide during the guided design flow.
- —Payment data: managed by Stripe. We store only your subscription tier and the Stripe customer ID; no card details are stored on our systems.
- —Usage data: pages visited, features used, error events — collected only with your consent via analytics cookies.
3. Legal Basis for Processing
Contract performance (Article 6(1)(b) UK GDPR)
Processing your account data, address, and project brief is necessary to provide the service you have requested — resolving planning rules, generating design assistance, and producing documents.
Legitimate interests (Article 6(1)(f) UK GDPR)
We process aggregate usage data to improve the accuracy of our planning rules engine and design assistance tools. No individual-level profiling is performed.
Consent (Article 6(1)(a) UK GDPR)
Analytics cookies are loaded only after you give explicit consent via the cookie banner. You can withdraw consent at any time from the cookie preferences link in the footer.
4. Third-Party Processors
We share your data with the following sub-processors, each under a data processing agreement:
Supabase (EU data residency)
Database and file storage provider. Your project data, address, and account information are stored on Supabase infrastructure in the EU.
Anthropic (United States) — AI sub-processor
When you use the guided design assistant or request AI-generated planning summaries, your project brief text is sent to Anthropic's API for processing. Anthropic does not use API inputs for model training under its current API terms. Transfers to the US are covered by Standard Contractual Clauses.
Stripe (United States)
Payment processing. Stripe handles all card data directly; we receive only a customer ID and subscription status. Covered by Stripe's own GDPR framework and SCCs.
Google (United States) — OAuth only
Used for sign-in via Google only. We receive your name and email. No other Google services receive your data.
Vercel (United States)
Hosting and CDN. Request logs may include IP addresses and are retained for up to 7 days.
5. Retention Periods
- —Account data: retained for the life of your account plus 30 days after deletion.
- —Project data: retained while your account is active. Deleted within 30 days of account closure on request.
- —Audit logs: retained for 90 days for security and fraud investigation purposes.
- —Payment records: 7 years, as required by HMRC financial record-keeping obligations.
6. Your Rights
Under the UK GDPR you have the right to:
- —Access a copy of your personal data.
- —Rectification of inaccurate data.
- —Erasure ("right to be forgotten") — subject to legal retention obligations.
- —Data portability — receive your project data in a machine-readable format.
- —Objection to processing based on legitimate interests.
- —Restriction of processing while a complaint is investigated.
To exercise any of these rights, email privacy@extend.app. We will respond within 30 days.
7. Right to Complain
If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
If you are in Ireland, you may contact the Data Protection Commission (DPC) at dataprotection.ie.
8. Cookies
We use two categories of cookies:
- —Essential: Supabase authentication session cookie and Stripe payment session. These are strictly necessary and cannot be disabled without breaking the service.
- —Analytics (consent required): Usage event data to understand how the product is used. Only loaded after you click "Accept all" in the cookie banner. You can change your preference at any time via "Cookie preferences" in the footer.
9. Changes to This Policy
We will notify you by email and update the effective date above when we make material changes. Continued use of the service after notification constitutes acceptance.
Questions? privacy@extend.app