Privacy Policy

Last updated: 2 September 2026

This policy explains what personal data we collect, how and why we use it, who we share it with, and the rights you have. It applies to our website and waitlist, and to the ExactaPlan application.

1. Who we are

ExactaPlan is a product of Empire Technologies Ltd, a company registered in England and Wales.

For the ExactaPlan application, we act as a data controller for the account and billing information we hold about our own customers and users, and as a data processor for the content our customers upload and manage in the platform (for example project data, reports, photos and details of their own clients and contacts). This policy describes our own processing; where we act as a processor, our customer's own privacy notice governs how that data is used.

If you have any questions about this policy or how we handle your data, contact us at privacy@exactaplan.com.

2. The information we collect

If you join our waitlist

When you sign up to our pre-launch waitlist we collect:

• the email address you provide; and
• basic technical information attached to your request — your IP address, browser type (user-agent) and the page you came from — which we use to prevent spam and abuse of the form.

When you use ExactaPlan

If and when you use the application, we (or our customers, through us) may process:

• Account & profile data — name, email, phone number, avatar and, optionally, address.
• Organisation data — company name, address, company registration and VAT numbers, team members and their roles.
• Content you create or upload — projects, tasks, reports, notes, documents, drawings/plans and photos (which may show people or work sites).
• Location & attendance data — site addresses and coordinates, and, where enabled, precise GPS check-in/check-out locations and geofenced attendance for staff and invited guests.
• Communications — team chat, support messages, bug reports, and logs of SMS and email we send on your behalf.
• Billing data — billing contact and address, subscription and invoice records. Card payments are handled by our payment providers; we only store limited details such as the card type and last four digits.
• Usage & device data — how the service is used, and, in our mobile apps, device identifiers and push-notification tokens.

Information about other people

Where you invite guests or add contacts (for example a client or subcontractor invited to a job), we process the contact details you give us so we can provide that access and send the related notifications. If you provide someone else's data, you are responsible for ensuring you may do so.

3. How and why we use your information

We rely on the following legal bases under the UK GDPR and EU GDPR:

• Consent — to email you about our launch when you join the waitlist. You can withdraw consent at any time using the unsubscribe link.
• Contract — to create and run your account, provide the service, and take payment.
• Legitimate interests — to secure our service and prevent abuse (for example rate-limiting the waitlist form), to support you, and to improve the product. We balance these against your rights.
• Legal obligation — to keep records we are required by law to keep (for example for tax).

4. Cookies

We keep cookies to a minimum and do not use advertising or third-party tracking cookies. See our Cookie Notice for details of the strictly necessary and functional cookies we use.

5. Who we share your information with

We do not sell your personal data. We share it only with trusted service providers who process it on our behalf under contract ("sub-processors"), and where we are required to by law. Our main sub-processors are:

Where you use our AI features, the content you submit (such as a plan, a document, or the text of your request) is sent to OpenAI's API to generate a response. OpenAI does not use data submitted through its API to train its models, and we do not use your content to train AI models. AI-generated output may be inaccurate or incomplete and should be reviewed before you rely on it.

6. International data transfers

Some of our providers are based outside the UK and European Economic Area (for example in the United States). Where personal data is transferred internationally, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement / Addendum, the European Commission's Standard Contractual Clauses, or a provider's certification under the applicable Data Privacy Framework — so that your data continues to be protected.

7. How long we keep it

We keep personal data only for as long as we need it for the purposes above. Waitlist data is kept until we launch and you have decided whether to create an account, and technical anti-spam data (such as IP addresses) is kept only briefly. Account and content data is kept for the life of your account and for a limited period afterwards, and billing records are kept for as long as the law requires. Contact us if you would like more detail about a specific type of data.

8. Your rights

You have the right to:

• access a copy of the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data ("right to be forgotten");
• object to, or ask us to restrict, certain processing;
• receive certain data in a portable format; and
• withdraw consent at any time, where we rely on it.

To exercise any of these rights, email us at privacy@exactaplan.com. We will respond within one month.

9. Keeping your information secure

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls and row-level security in our database. No system is perfectly secure, but we work to protect your information and will notify you and the relevant regulator of a serious breach where we are required to.

10. Children

ExactaPlan is a tool for businesses and is not intended for children. We do not knowingly collect data from anyone under 16.

11. Changes to this policy

We may update this policy from time to time. When we do, we will change the "last updated" date above and, for significant changes, take reasonable steps to let you know.

12. How to complain

We hope to resolve any concern you have, so please contact us first at privacy@exactaplan.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or, if you are in the EU, to your local data protection authority.