Privacy policy.

ParaplanAI (the “Service”) is operated as a sole trader in the United Kingdom under the trading name ParaplanAI by a working UK paraplanner at a regulated UK firm. The operator’s identity is available to professional bodies and prospective firms on request via info@paraplanai.co.uk; contracts and data-protection agreements are entered into under the trading name ParaplanAI. We are the data controller for the personal data we collect from you when you create an account. We are a data processor for personal data your firm, as controller, uploads about its end clients.

Contact: info@paraplanai.co.uk.

Registered with the Information Commissioner’s Office, reference ZC277308.

2.1 · Account data (controller)

When you sign up:

• Email address (used for sign-in, account and service emails, and — only if you tick the box at sign-up — occasional emails about ParaplanAI features and plans).
• Your name (as you enter or confirm it after signing in or in your account settings; a Google or Microsoft sign-in may suggest one), used on your account, as your initials on any activity-log entry recording that you deleted a client or calculation, and, if your firm owner turns on preparer names, on the PDFs you produce.
• Firm name + the role you hold (owner / adviser / paraplanner).
• Your firm's FCA details, if you give them: its firm reference number and, if it is an appointed representative, its principal firm's name and reference number.
• Your email preference (whether you agreed to optional emails) and a random unsubscribe code.
• Optional: firm branding (a logo and brand colour, stored inline against your firm record).
• Billing data — handled by our payments processor, see §4. We never see your card details.
• Feedback and support emails: what you write in the in-app feedback form or the recommend prompt, sent with your email address, firm, role, the page's address and your browser details, and the emails you send to info@paraplanai.co.uk. They stay in our support inbox for 24 months, then we delete them.
• Security and activity events (for example sign-ins, invitations, member changes, deletions and document reviews) — recorded in your firm's activity log with the time and, for some events that came from a browser request (such as sign-ins, sending invitations and member removals), the IP address and browser used. They are kept as part of your firm's audit trail and are not deleted on a fixed schedule; when a firm is closed, the IP addresses and browser details are removed from them, as are any email-address hashes (see §6).

2.2 · Client data (processor)

When your firm runs a calculation for an end client, the firm uploads or types in figures about that client. ParaplanAI does not require the client’s name, NI number, address, or any other directly-identifying field to function. We strongly recommend you use only an anonymised client reference (e.g. JS-2026-04-12).

Where your firm chooses to upload identifying information into free-text fields or via document upload, that information is encrypted at rest and in transit. The calculation engine and audit trail operate on the anonymised reference only — they never see PII. Where a client’s name is set on the record, the rendered PDF annex displays it.

2.3 · Uploaded documents

P60s, pension statements, chargeable-event certificates, and other source documents you upload for figure-extraction are stored in UK/EU-region encrypted object storage. To lift the structured figures off each document we use a large language model through a managed AI service hosted in the EU. The document is processed in-region; it is not transmitted outside the UK / EU.

What the AI provider does with the document. The model runs as a managed service. Your document and the figures returned from it are never used to train any model, and the provider does not store them after the request, apart from a short-lived cache: so that repeat reads run faster, the service can hold recent request content in a temporary cache that expires shortly after its last use (about five minutes for an uploaded document). The same applies to Pan, our read-only query assistant — it runs on the same EU-hosted service and computes nothing itself. Processing is covered by a Data Processing Agreement with the provider.

Source-file window: 24 hours. Uploaded source PDFs, including provider packs, are scheduled for deletion after 24 hours. Automated cleanup runs hourly and retries failed removals; this is not a guarantee of completion at the exact deadline. The structured figures extracted from them (and the calculation that consumed those figures) are retained for audit per §6. The output PDF (the compliance annex you download) has a 30-day default file window while in draft; a filed annex is kept with its calculation under your firm’s retention policy.

See /data-minimisation for the full picture — what we hold and why, what the calc engine never reads, and how the three retention buckets fit together.

Our lawful bases under UK GDPR Article 6:

• Performance of contract (Art 6(1)(b)) for providing the calculator, audit trail, and PDF outputs you have subscribed to.
• Consent (Art 6(1)(a)) for persistent, account-linked browser product analytics and anonymous browser session replay on eligible queryless public pages in production. You can refuse or withdraw this choice at any time without affecting the Service. Browser session replay is disabled on authenticated and client workspace pages.
• Consent (Art 6(1)(a) and PECR regulation 22) for optional emails about ParaplanAI features and plans. They are sent only if you tick the box at sign-up; every one carries an unsubscribe link, and unsubscribing does not affect sign-in, receipts or service notices.
• Legitimate interests (Art 6(1)(f)) for operational security logs, abuse prevention, error diagnostics, service reliability, and limited cookieless public-page and calculator counters. Those memory-only counters do not use an account, firm or persistent browser identifier and stop if you reject analytics. Our legitimate interests assessment is on file; available on request.
• Your firm's instructions as controller(Art 28) for keeping calculation records for the retention period your firm chooses (six years by default). Your firm holds its own FCA SYSC 9 record-keeping obligation. We keep these records only as your firm's processor, for the period it sets, and delete them when it tells us to or the period ends.
• Legal obligation (Art 6(1)(c)) for our own records — e.g. a six-year record of paid invoices for HMRC.

We use sub-processors under written Data Processing Agreements (UK GDPR Article 28). Categories of recipients:

• Hosting and infrastructure — the application, database, and file storage used for the client-data path are hosted on UK / EU infrastructure.
• AI document extraction and the Pan assistant — source PDFs are sent to an EU-hosted AI provider to extract their figures, which you review before any calculation runs; on Pro and Firm, Pan sends your questions in the open conversation, with its earlier answers, and the selected client’s name and stored records to the same provider to answer questions about that client (see §2.3). Neither calculates. The provider keeps none of it after the request, apart from a short-lived cache that expires shortly after its last use (see §2.3), and does not train on customer data.
• Payments — subscription billing handled by a PCI-compliant payments processor. It receives billing data only — never your client data — and we never see your card details.
• Email delivery — sign-in links, invitations, receipts, billing, security and other service notices, and the optional emails you agreed to at sign-up, via an EU-resident email provider. It receives the address, subject and content of each email. Emails carry no client figures or source documents; a draft-saved notice can include the client reference your firm gave the calculation. Please do not include client details in feedback you send from inside the app. Feedback and emails you send to info@paraplanai.co.uk stay in our support inbox for 24 months, then we delete them.
• Browser analytics — before a choice, only allowlisted public-surface counters with memory-only state; on our public marketing and calculator pages only, those counters also include page-leave, page-speed, frustrated-click and unhandled browser-error signals, which carry a redacted page path and no account, firm or persistent browser identifier and are never collected on sign-in or signed-in pages; after consent, pseudonymous product events and anonymous, blanket-masked browser replay on allowlisted queryless public pages in production. Hosted in the EU; browser session replay is disabled on authenticated and client workspace pages, all rendered text and typed input values are masked, charts, sliders and links that carry figures are blocked, sensitive route identifiers are removed, and request headers, bodies, console output and canvas content are not recorded.
• Operational telemetry — server-side reliability, usage, and cost counters. By default each event has a fresh random identifier and carries no browser, account, or firm identifier. If you are signed in and have accepted analytics, some of the server events recorded for your own actions, for example when you run or file a calculation, add a client, upload a document or set up your firm, carry the same one-way pseudonymous identifier as your browser analytics instead; others keep a fresh random identifier. Server exception reports, and events with no visitor behind them, such as scheduled jobs and payment notifications, always stay unlinkable.
• Application error monitoring — browser, edge, and server diagnostic events, EU-hosted. Request bodies are never sent, and before transmission an automatic filter removes the client references, money amounts, dates and personal identifiers it recognises in error reports; session replay is disabled. It also receives an anonymous count of browser sessions (whether a session ended in an error), which is used for reliability, carries no account or client data, and is not affected by your analytics choice.
• Sign-in bot protection — on the sign-in page and, when enabled, the email-link confirmation page, a Cloudflare Turnstile check may run in your browser to stop automated abuse of sign-in emails and sign-in links. It receives your IP address and browser signals, never account or client data.

We host on UK / EU infrastructure throughout. The full named list of the sub-processors we currently engage — with the purpose and data location of each — is available in the disclosure below. This named register supports our UK GDPR Article 28(2) sub-processor obligations and is the register our Data Processing Agreement will refer to. A summary of its terms is at /legal/dpa; a signed copy will be available on request once the execution copy is approved.

We do not transfer client personal data outside the UK / EU. Everything in the client-data path — the database, file storage, AI figure-extraction, PDF rendering, analytics, and error monitoring — is hosted and processed within the UK and EU.

Outside the client-data path, some services may process data outside the UK / EU. Our payments processor (Stripe, §4) operates internationally under its own approved transfer safeguards and receives subscription and billing details only. The sign-in bot check (Cloudflare Turnstile, §4) runs on Cloudflare’s global network under Cloudflare’s own terms and receives the IP address and browser signals of visitors to the sign-in page and, when enabled, the email-link confirmation page only. Neither receives the client data your firm uploads. Our hosting provider (Vercel, §4) runs the application in London, but its global edge network routes each request, and serves static files, from the edge location nearest the visitor, so a request made from outside the UK / EU passes through an edge location outside it. Vercel stores no client data at rest.

• Uploaded source documents — scheduled for deletion after 24 hours, including provider packs. The hourly cleanup processes removals in batches and retries failures until storage confirms deletion. This 24-hour rule covers the documents firms upload; it does not cover a small, separate set of documents we hold with written consent to test how accurately figures are extracted.
• Parsed extractions (the structured figures lifted from each document) — unconfirmed content is scheduled for removal after 90 days. Once confirmed, content follows your firm’s retention window, measured from confirmation. Raw extraction responses have a separate 30-day window. Content cleanup removes the extracted payload and filenames; the audit/provenance record may remain. Earlier client deletion also removes its extraction records.
• Output PDFs (the compliance annex you download) — kept alongside the calculation they belong to once filed. Draft PDF copies normally have a 30-day window and can be regenerated only while the calculation remains available and passes the required checks. Deleting a calculation schedules its files for erasure; downloaded copies cannot be recalled.
• Calculation records (inputs, intermediate steps, configured tax-year rules, output) — deletion requires confirmation and the appropriate firm access. Finalised (filed) calculations you keep are retained for the window your firm configures — six years by default — then scheduled for automatic deletion. Unfiled calculations have a 90-day window; autosaved working drafts become due after 90 days without an update.
• Account and firm details — account details are retained while your account exists, on Free or a paid plan. Firm details are retained while the firm exists. Closing a firm ends its members' access and removes or keeps its records as the deletion confirmation describes (§7), and the closed firm record itself is kept in anonymised form to support the calculation and audit records retained under the firm's chosen deletion option and retention window. When the firm is closed, its name is replaced with a placeholder, its FCA number and branding settings (including any logo saved with them) are cleared, every invitation is deleted with the email address it was sent to, and the IP addresses and browser details are removed from the firm activity log below, together with any email-address hashes it holds. What remains — the anonymised firm record, the activity log's events, identified by account ID rather than name or email address, and a record of when each removed or departed member left, by account ID, with its email-address hashes cleared — is not deleted on a fixed schedule; email us if you want it erased. Entries recording that a client or a calculation was deleted also keep the initials of the member who deleted it (for example J. M.), where that member has confirmed their name.
• Email records — your email preference and unsubscribe code, and a log of the emails we have sent to you or your firm, optional ones included (the kind of email and when, not its content or your address), which we keep so we do not send the same email twice. Deleting your account deletes your email preference and removes your account ID from that log; entries recording an email to your firm stay with the firm.
• Feedback and support emails — kept for 24 months, then deleted, as set out in section 4.
• Billing records — held by our payments provider under its retention policy; we retain a six-year record of paid invoices for HMRC (our own legal obligation).
• AI service usage and cost records — records become due for removal 13 months after creation; requests still being processed must be closed first. These records contain usage and cost metadata, not source-document contents. Account erasure removes their link to your user account.
• Pan answers and document-type results — each answer Pan gives, and the document type the AI identifies for an upload (with how sure it is), are kept on our servers for 24 hours so a response lost in transit can be recovered, then deleted. Your questions are not stored on our servers.
• Pension IHT calculator hand-off — when you continue from the public Pension IHT calculator to the full workbench, its figures (no names or contact details) are kept on our servers under a single-use link so they survive a sign-in on another device, and are deleted after 7 days.
• Firm activity log — security and administrative events (sign-ins, invitations, member, billing and deletion events) and records of work done in the product, such as a document review being accepted, with the IP address and browser used for some events that came from a browser request, such as sign-ins, sending invitations and member removals. They are kept as part of your firm's audit trail and are not deleted on a fixed schedule; deleting your account or closing the firm does not remove the events, but closing the firm removes their IP addresses and browser details and any email-address hashes. An entry recording that a client or calculation was deleted also keeps the initials of the member who deleted it (for example J. M.), where that member has confirmed their name; deleting that member's account or closing the firm does not remove them. A document-review record is written the first time a single uploaded document's review is accepted. It notes the document type, how many fields the reviewer changed, which extracted fields they were, how confident the extraction was in each, and which versions of the extraction model and instructions produced it — never the values themselves. It stays in the log after the document and its extracted figures are deleted. The log records an invitation or a sign-in email change without the email addresses involved: at most, it keeps a keyed one-way hash of each, made with a secret key held only on our servers, so a hash cannot be matched to an address without that key. Hashes the log recorded in an earlier, unkeyed form have been removed from it; the separate member-removal digests described under Firm invitations are unkeyed.
• Firm invitations — an invitation holds the invitee's email address. An invitation that is never accepted is deleted, with the email address it was sent to, 30 days after it expires (the activity log keeps at most a keyed one-way hash of it). An accepted invitation is kept with the firm's membership history while the firm exists; closing the firm deletes every invitation, with the email address it was sent to. When a member is removed or leaves, we keep an unkeyed SHA-256 digest (a one-way hash made without a secret key) of their sign-in email address and of each invitation address they accepted, so that an invitation sent to them before they left can no longer be accepted. Anyone who already knows an address could check it against such a digest, so the digests are stored where no signed-in user and none of our application code can read them; only the database's own invitation checks use them. We empty these digests automatically 14 days after the member leaves (an invitation sent before they left cannot stay open longer than seven days); closing the firm clears them at once.
• Sign-in logs — held for account security and troubleshooting under our authentication provider's log-retention settings. Contact us for the applicable retention details.

Under UK GDPR you have the right to:

• Ask what data we hold about you (Article 15 — subject access).
• Have inaccurate data corrected (Article 16).
• Have your data erased (Article 17 — “right to be forgotten”); you can delete your client records yourself at any time (see below).
• Have processing restricted (Article 18).
• Take your data elsewhere in a machine-readable format (Article 20 — portability).
• Object to processing based on legitimate interests (Article 21).
• Withdraw consent at any time, where we are relying on it (Article 7).

Self-serve deletion. Deletion requires confirmation and the appropriate firm access. Archiving a policy hides it from active lists and preserves its audit history; deleting a policy removes it permanently. A calculation is deleted, not archived: deleting it removes it permanently. Deleting a client erases their client records and queues stored files for removal. Firm owners can delete the whole firm from Settings → Firm → Danger zone. The confirmation explains whether calculation records will be kept for the firm's configured window or erased too. File and subscription cleanup may complete in the background. Export anything you need to keep before confirming deletion. You can delete your own user account from Settings → Account → Delete account. If you own your firm, first transfer ownership to a colleague in the firm or delete the firm.

Self-serve data export. Subject access (Art. 15) and portability (Art. 20) are available at Settings → Account → Export my data. We keep the ZIP for 7 days and email you a link to it. The link works only while you are signed in to your own account (and your second factor, if you have set one up or your firm requires one); each time you open it we issue a fresh download that expires after two minutes. Some records are not in the self-service export, for example the inputs and results of calculations, saved drafts, our log of the emails we have sent you and the upload records of provider packs. Email info@paraplanai.co.uk to request them. For corrections, restriction, or anything else, email info@paraplanai.co.uk and we will respond within one month. Requests are free of charge, unless a request is manifestly unfounded or excessive.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/concerns · 0303 123 1113.

All personal data is encrypted in transit (TLS 1.2 or higher) and at rest. Client records (name, date of birth, NI number, address and email), plan numbers and beneficiary names are additionally encrypted at the application layer (AES-256-GCM) before storage, so the database alone is not sufficient to decrypt them, and the calculation engine never sees them. Details read from an uploaded document, which can include the member's name, date of birth and NI number, are held on the extraction record encrypted at rest but without that extra layer, and follow the extraction windows in §6. Database row-level security policies enforce firm-level isolation on every read and write — your firm cannot read another firm’s rows. Sign-in is passwordless (magic-link + Google / Microsoft OAuth). There is no password for you to set, and nobody at ParaplanAI holds one.

For account data where we act as controller, we assess every personal-data breach and notify the ICO within 72 hours where Article 33 requires it; where the risk is high, we notify affected individuals without undue delay under Article 34. For client data where we act as processor, we notify the affected firm without undue delay and provide the information it needs to make those controller-side decisions.

The full control set — encryption, tenant isolation, data residency, auditability and continuity — is documented on our security page.

We use essential browser storage without consent to keep you signed in, preserve work in progress on this device, and remember your privacy choice. This is required for the Service features you request to function.

Product analytics. Their purpose is to understand product adoption and reliability so we can improve the Service. Before you choose, we collect only allowlisted cookieless public-page and calculator counters. That path uses memory-only state, creates no person profile or persistent browser identifier, removes query strings and sensitive route identifiers, and stops if you reject analytics. Those counters include which call-to-action was clicked on the homepage, the pricing page or the Learn index (their footers included), in the site header or its mobile menu on our homepage and our pricing, calculator, Learn, FAQ, help, rates and research pages, or in the “For professionals” note on a calculator page opened from a link sent to an adviser. Each click is recorded as labels from a fixed set: where the call-to-action sits, what it leads to (for example, creating a free account) and, for some links, their named place on the page; never the link’s address or text. Like the other counters, it also carries the redacted path of the page you were on. Before you choose, your browser also fetches the analytics settings for this site from our analytics provider, through our own server. That request carries only our project key: no visitor data, identifier, cookie or IP address is sent with it. Advertising click identifiers in the address you arrive at (such as gclid, fbclid and msclkid) and campaign tags (utm_ parameters) are removed before you choose; they are kept with your analytics events only after you accept analytics. A closed landing label (one of five fixed words, in the link you followed) may be added to the sign-up step before you choose; it identifies no one. If you consent, we may also collect a pseudonymous account and firm identifier when signed in, subscription tier, redacted page paths and product interactions. Browser session replay is disabled on authenticated and client workspace pages. With consent, anonymous browser replay may run only on queryless public pages in production. Every rendered text node and typed input value is masked, charts, sliders and links that carry figures are blocked, sensitive route identifiers are removed, and request headers, bodies, console output and canvas content are not recorded. If you later sign in on the same browser with analytics accepted, its earlier replays and events are linked to your pseudonymous account identifier. We disable IP enrichment, do not use advertising trackers and do not sell personal data. Server-side operational counters are unlinkable unless you are signed in and have accepted analytics, in which case some of the server events recorded for your own actions, for example when you run or file a calculation, add a client, upload a document or set up your firm, carry your browser analytics identifier. We aim to keep analytics event history for no more than 12 months, then delete or anonymise it. You can withdraw consent below at any time.

ParaplanAI is a professional tool for UK financial advisers and accountants. It is not designed for or marketed to people under 18.

We may update this policy. We will email account owners about a material change at least 30 days before it takes effect. The “Last updated” date at the top of this page is the canonical version date.