Needles
Privacy Policy
Last updated: 12 September 2026
This policy explains how Curtography Limited (company number 17277370, registered office 89 Margaret Road, Barnet, United Kingdom, EN4 9NX) ("Needles", "we", "us") collects and uses personal data when you use needles (the "Site"), in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are the data controller for the personal data described below.
If you only browse the free tools — search, the homepage, the map, the calendar — without creating an account, we collect very little about you (see Analytics below). Most of the personal data we hold relates to people who create an account or subscribe.
Public planning appeal data
Needles republishes planning appeal decisions issued by the Planning Inspectorate, a UK government body. Decision letters are already public documents and may name appellants, agents, planning officers and inspectors. We treat this as data already made public by a public authority as part of its statutory functions. A small number of Needles features — the daily digest, Bluesky posts, and the automated LinkedIn post described in our About page — redistribute this already-public content; they do not collect any new personal data about the people named in those decisions. If you are named in a decision letter and have concerns about how it appears on Needles, see Contact us below.
Data we collect
Account and subscription data
If you register for a free account or subscribe, we collect your email address, name, and (optionally) your organisation. If you subscribe, our payment processor Stripe handles your card details in full — we never see or store your full card number. We keep a Stripe customer/subscription reference and your plan status so we can manage your access.
Security and session data
When you sign in, we store a hashed session identifier, a hashed IP address, and your browser's user agent string against your account, so we can show you your active sessions and enforce our concurrent-device limit (to deter credential sharing). We do not store your raw IP address for this purpose.
Analytics
We record anonymised page-view statistics: a one-way salted hash of your IP address and browser combination (not your raw IP), a coarse device type (desktop/mobile), browser family, and country (from our CDN's edge location, not IP lookup). This cannot reasonably be used to re-identify you, and we do not use any third-party analytics or advertising trackers (no Google Analytics, no ad pixels).
Contact form
If you use our contact form, we email your name, email address and message directly to our team so we can reply. We don't keep a separate copy in our database beyond that email.
Ask Needles (AI assistant)
If you use Ask Needles, your questions and our answers are stored against your account so you can return to past conversations, and are sent to our AI provider, Anthropic, to generate a response (see Who we share it with). Please don't include personal or sensitive information about yourself or others in your questions.
Appeal Report
If you use the Appeal Report tool, we store the decision notice (and any officer's report) you upload, the details you enter about your case, and the generated report against your account. The extracted text is sent to Anthropic to help generate your report. Please only upload documents you have the right to share.
Feature suggestions and API access
Feature suggestions you submit are stored against your account. If you're granted REST API access, your API key and request activity (for rate-limiting and abuse prevention) are tied to your account.
How we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and administering your account, delivering the service you've subscribed to | Contract |
| Processing payments (via Stripe) | Contract; legal obligation (accounting records) |
| Sending the daily digest email you opted into | Consent (you enable this in your account) |
| Password resets, email verification, service notices | Contract / legitimate interests (account security) |
| Enforcing our concurrent-session limit | Legitimate interests (preventing credential sharing) |
| Anonymised traffic analytics | Legitimate interests (understanding site usage) |
| Responding to contact form enquiries | Legitimate interests / steps prior to a contract |
| Ask Needles and Appeal Report (AI features) | Contract (features you've chosen to use) |
| Preventing fraud, spam and abuse (e.g. contact-form rate limiting) | Legitimate interests |
International transfers
Some of our processors (including Stripe and Anthropic) are based outside the UK, including in the United States. Where this happens, we rely on appropriate safeguards recognised under UK GDPR, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or the processor's own adequacy-recognised certification.
How long we keep it
We keep account and subscription data for as long as your account is active, and for a reasonable period afterwards to deal with any queries, disputes, or legal/accounting obligations. Session and security logs, and analytics records, are kept only as long as needed for the security and reporting purposes described above and are periodically deleted. If you close your account, contact us and we will delete or anonymise personal data we no longer need to keep.
Security
Passwords are stored as salted one-way hashes, never in plain text. The Site is served over HTTPS. Session identifiers and IP addresses used for security purposes are stored as one-way hashes, not in raw form. We restrict administrative access to the systems that hold personal data. No method of transmission or storage is 100% secure, but we work to protect your data using appropriate technical and organisational measures.
Your rights
Under UK GDPR, you have the right to:
- Ask for a copy of the personal data we hold about you (access)
- Ask us to correct inaccurate data (rectification)
- Ask us to delete your data, subject to legal or contractual limits (erasure)
- Ask us to restrict or object to certain processing
- Ask for your data in a portable format, where technically feasible (portability)
- Withdraw consent at any time where we rely on consent (e.g. the daily digest — you can turn this off in your account)
To exercise any of these rights, contact us at russell.curtis@outlook.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to address your concern directly first.
Children
Needles is a professional research tool for the planning and property sector and is not directed at, or intended for use by, children.
Changes to this policy
We may update this policy from time to time, for example as we add new features. We'll update the "Last updated" date above when we do. Continued use of the Site after a change means you accept the updated policy.
Contact us
Questions about this policy or your data? Email russell.curtis@outlook.com or use our contact form.