What we do with your data.

Short version: all our cost / planning / grant / timeline calculations run in your browser and never leave your device. The only times we ever process your data on our servers are when you ask us to — by emailing yourself a report, by uploading a quote document for AI review, or by using the AI Snapshot estimator (photo or property-listing URL). All three are opt-in, and all three are covered in detail below.

This policy is written for the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The data controller is untangleuk.co.uk.

What we collect

1. In-browser tool inputs (no transmission)

When you use the cost calculator, planning checker, grant finder, quote sanity-check tool, or timeline planner, the selections you make stay in your browser. They are not transmitted to our servers. Closing the tab clears them.

2. Email reports (Resend)

If you ask to email yourself a report, we transmit the report text and your email address to Resend Inc. (Delaware, USA), our email delivery sub-processor, who sends the message and then discards the address. We do not retain the email address on our servers, do not send unsolicited follow-ups, and do not use it for any other purpose.

3. AI quote analysis (Anthropic + our database)

If you upload a builder’s quote for AI analysis (the section on the quote-check page marked “upload the full quote”), you tick an explicit consent box. At that point we collect, transmit and store:

• The file you upload (PDF or image).
• The project context you select (project type, region, spec tier, optionally square metres and quote total).
• The AI’s structured analysis output (verdict, line items, red flags, summary).
• A SHA-256 hash of your IP address (for rate-limit enforcement only — not used to identify you), your browser user-agent string, and the timestamp.

Important: a builder’s quote document usually contains personal data about you (name, address, phone) and about the builder (company name, director’s name, contact details). By uploading, you confirm you’re happy for that information to be processed as described here. If you’d rather not, redact those fields before upload, or use the headline-figure tool above the upload section instead — that one stays in your browser.

4. Snapshot AI estimate (Anthropic + our database)

The Snapshot tool has two flows, both gated by an explicit consent box:

• Photo mode — you upload a photo of a room. We transmit the photo to Anthropic to generate the estimate, and store the photo, your room-type / region / target-quality choices, and the AI output.
• URL mode (Beta) — you paste a UK property listing URL. Our server then makes a single, server-side HTTPS GET to that URL on your behalf, parses the public OpenGraph and JSON-LD metadata (title, lead image, asking price, description) and forwards the lead image plus the parsed text to Anthropic for the estimate. We do not impersonate you, log into any account, or fetch behind authentication walls. Major portals (Rightmove, Zoopla) block this kind of automated request and we surface that block as a friendly error rather than working around it. The listing URL, the parsed metadata snippets we extracted, and the AI output are stored.

In both modes we also store a SHA-256 hash of your IP address (rate-limiting only), your user-agent string and the timestamp.

5. Anonymous web analytics (only if you accept cookies)

We use Google Analytics 4 under Google’s Consent Mode v2 to understand which tools UK renovators find useful. Until you click Accept on the cookie banner, analytics measurement and analytics cookies stay off; if you decline, they stay off permanently for that browser. IP addresses are anonymised at source. We never run advertising, ad-personalisation or behavioural cross-site tracking. You can change your mind at any time below.

6. Email correspondence

If you email us, we keep the thread to reply and for our records.

Lawful basis under UK GDPR

• Email reports: consent under Article 6(1)(a) (you initiated the email send).
• AI quote analysis: explicit consent under Article 6(1)(a) (you ticked a specific consent box before upload).
• Snapshot AI estimate (photo or URL): explicit consent under Article 6(1)(a) (you ticked a specific consent box before submission). The server-side fetch of a listing URL is performed in legitimate reliance on the public availability of that listing page and only after your consent.
• Web analytics: consent under Article 6(1)(a) via the cookie banner; lawful refusal removes all analytics cookies.
• Email correspondence: legitimate interests under Article 6(1)(f) — responding to your enquiry.

Sub-processors and international transfers

To run the AI quote analysis or Snapshot estimate we transfer the relevant inputs (quote document, photo, or listing image and parsed text) and your project context to Anthropic, PBC in the United States. Anthropic processes the data only to generate the analysis response and does not train models on the data sent through their API (per their published commercial terms and Data Processing Addendum).

Transfer to the US is covered by Standard Contractual Clauses in Anthropic’s Data Processing Addendum, together with the UK ICO’s UK Addendum to the EU SCCs. Anthropic is also self-certified under the EU–US Data Privacy Framework as extended by the UK Extension.

When you use Snapshot in URL mode, our server additionally makes a single HTTPS GET request to the property-listing URL you provided. We do not transmit any data to that listing site beyond a standard browser-style request; we only read the public HTML the site already serves to anyone. The third-party listing site is not a sub-processor and we have no contractual relationship with them — they are simply the source of a public web page. Some major portals (Rightmove, Zoopla) block this kind of request; in that case nothing further is processed.

The full list of sub-processors we use:

• Anthropic, PBC (USA) — AI quote analysis and Snapshot estimates (only when you submit something to one of those tools).
• Resend Inc. (USA) — transactional email delivery (only when you ask to email yourself a report).
• Railway Corporation (USA) — application hosting and managed Postgres database. The database stores quote-analysis submissions and Snapshot submissions only.
• Google Ireland Ltd (Ireland) — Google Analytics (only if you accept the cookie banner).

Retention

• AI quote analyses: 24 months from submission, then deleted automatically. You can ask for earlier deletion at any time — see below.
• Snapshot AI estimates (photo or URL): 24 months from submission, then deleted automatically. You can ask for earlier deletion at any time using the reference UUID shown after your estimate.
• Email reports: not retained on our servers; the recipient address is held in transit by Resend and discarded after delivery.
• Web analytics: Google Analytics retains anonymised page-view data for 14 months (the default we’ve configured).
• Email correspondence: kept for up to 3 years to allow follow-up and record-keeping.

Your rights under UK GDPR

You have the right to ask us to (1) confirm what data we hold about you, (2) provide a copy in a portable format, (3) correct inaccurate data, (4) erase your data, (5) restrict our processing, (6) object to processing, and (7) withdraw consent at any time (this doesn’t undo processing already done with consent).

To exercise any right, email admin@untangle.ie with the subject line “Privacy”. If your request relates to an AI quote analysis or a Snapshot estimate you submitted, include the reference UUID you were shown on completion. We’ll respond within one calendar month, as required by Article 12(3) UK GDPR.

If we get it wrong, you can complain to the UK’s Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

What we don’t do

• We don’t sell, rent or share your data.
• We don’t pass your details to contractors, lenders or any third party for marketing.
• We don’t use advertising or behavioural-tracking cookies.
• We don’t require an account — every tool works for anonymous visitors.
• We don’t allow our AI sub-processor to train models on your data (per their commercial DPA).

Changes to this policy

We’ll update this policy if our processing changes. The “Last updated” date at the top of this page is the authoritative version date. Material changes that affect your rights will be flagged on the homepage for at least 30 days.

Contact

Privacy enquiries, deletion requests, data-subject access requests: admin@untangle.ie.