Last updated: 12 August 2026
Level Best is a planning tool for house and garden projects, operated by Richard Cowtan trading as Level Best, in the United Kingdom. This page says what data we hold, why, and what your rights are. The short version: we hold what the tool needs to work, we don't sell it, we don't run adverts, and you can export or delete everything.
We are the data controller, and we're registered with the Information Commissioner's Office under reference ZC213708. Questions about any of this go to hello@levelbest.build.
Signing in uses your browser's local storage strictly to keep you signed in. If we ever advertise, the ad networks' cookies (Reddit or Meta) load only if you accept them when asked: decline and the site works exactly the same, minus their measurement.
Changed your mind either way?
Withdrawing has to be as easy as agreeing, so that button forgets your answer and asks again next time you are on the site. It takes effect on this browser straight away; nothing that was already measured can be un-measured, which is why the choice is offered before anything loads rather than after.
We don't sell or share your data for marketing. It passes through these services, each doing one job:
| Service | Job | What they see |
|---|---|---|
| Supabase (EU region) | Database, sign-in, file storage | Account and project data, at rest in the EU |
| Vercel | Hosting the site and app | Standard web-server request data |
| Anthropic | The AI assistant | The project context needed to answer: sent when you use an AI feature, not otherwise |
| Resend | Sending and receiving our email | Your email address, and the contents of any message you send us or we send you. Also the address of anyone you invite to a project, so the invitation can reach them |
| GoatCounter | Anonymous visit counts | No personal data* |
| Stripe | Payments for paid plans | Card details go to Stripe directly and never touch our systems |
| MyJobQuote | Getting quotes from their trades network | Your name, contact details, postcode and the job description, only when you choose to send a quote request and after agreeing to their terms and privacy policy |
| Zoho CRM (EU region) | Keeping track of who we are talking to | Your email address if you joined the waitlist or hold a paid plan, your firm's name if you gave one, and the text of any message you send through the Professional support line, so the thread is not lost between an inbox and a memory. Also the property address if we wrote to you about a planning application, described below |
* GoatCounter is listed for openness rather than because it handles personal data: it sets no cookies and builds no profiles. Something processing no personal data is not strictly a processor, but leaving an analytics tool off this list would read worse than the inconsistency does.
This list was last changed on 4 August 2026. On the Professional plan, our data processing agreement commits us to telling you before it changes, and to giving you a way to object.
Some of these are outside the UK. Supabase and Zoho hold data in the EU, though Supabase's contracting company is in Singapore. Anthropic, Vercel, Resend, Stripe and Google process it in or from the United States. Those transfers are covered by the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses (Supabase, Vercel, Anthropic and Resend), by the UK Extension to the EU-US Data Privacy Framework (Resend and Google), by Stripe's own Data Transfers Addendum, or by an adequacy decision where one applies.
MyJobQuote is different from the others in one way worth spelling out: once you send a quote request, they handle your details under their own privacy policy (linked on the request form), because their job is to pass them to tradespeople who will contact you. That is the point of the feature, it happens only when you press the button, and never otherwise.
Google is the second exception. When you use the trade finder, the search goes to Google's Places service, and Google handles it under its own terms as an independent controller, not as a service working on our behalf. It sees the search query, including your project's area. What Google does with it is set out at policies.google.com/technologies/partner-sites. As with MyJobQuote, this happens only when you use the feature.
While your account exists. Delete a project and it's gone from your account immediately, along with any invitations to it; delete your account and everything goes with it. If someone invited you to their project, ending your account ends your access to theirs and leaves their project untouched. Residual copies in short-term backups cycle out within 30 days.
The home page draft is on shorter clocks and does not need an account to end: the drafted plan expires after seven days, and the scrambled code standing in for your address after three. What you typed was never kept in the first place.
Under UK GDPR you can ask to see, correct, export, or delete your data. The useful ones are built in: full export (open formats, any time, in the app) and project deletion. For account deletion or anything else, email hello@levelbest.build: done within 30 days, usually much faster. If you're unhappy with how we've handled your data, you can complain to the ICO (ico.org.uk).
Data is encrypted in transit and at rest, stored in the EU, and protected by per-user access rules enforced in the database itself. Your projects are readable by your account, and by anyone you have deliberately invited to a project, for as long as you leave that invitation in place. Sign-in is by emailed one-time link; there are no passwords to leak.
You can invite someone by email to look at one of your projects. You choose which parts they see, and whether costs are included; anything you have not granted is never sent to their browser at all, rather than being hidden in it. They cannot change your project, use the assistant on it, or see your name and phone number. Removing them ends their access immediately.
They can also leave comments, and you can reply. A comment is a conversation between one guest and you: if you have shared a project with several people, they cannot see each other's comments. You can put two of those conversations together, and from that moment the people in it see each other's messages. This never applies to anything written beforehand, which stays visible only to whoever wrote it and to you. You can delete a comment or a whole conversation, which removes it for everybody.
Inviting someone means we send them an email containing their name if you have given us one, the project's name, and a sign-in link. We keep the address you invited so you can see who has access and withdraw it.
The Professional plan adds team seats, which are different from the guest invitations above: a seat is a named colleague at your own firm, and seats see the firm's projects in full, including costs. A seat you make an editor can change those projects, and their changes are subject to the same versioning that stops two people silently overwriting each other. Any member of the firm can mark one of their projects private, which removes it from the others' view. Seats are managed from your account page, and revoking one ends that person's access immediately. The paid plan's plus one works the same way for one named person: you each see the other's projects in full and can edit them, either of you can mark a project private, and removing the seat or the add-on ends the access.
The front page lets you describe a project and get a costed plan back without making an account. That is a real plan, drafted at the moment you ask for it, because showing you a made-up one would be the one dishonest thing this product could do. Here is exactly what happens to what you type.
Where it goes. To Anthropic, in the United States, who run the AI that drafts the plan. Nowhere else, and to nobody else. They are listed in the table above like every other company we use.
What we keep. Not your description. It is sent, used, and the only thing left behind is a one-way fingerprint of it, which we use so that asking the same thing twice does not cost a second draft. Your words cannot be recovered from that fingerprint, by us or by anyone else. We also keep the plan that came back, for a week, against the same fingerprint.
Your postcode. Only the first part, the bit before the space. TN13, never TN13 4AB. That is all the pricing has ever used, so the rest would tell us where you live and buy you nothing. The app asks for the full postcode once you have an account, because it uses it to read your local planning register, which is a different job.
Your address on the internet. Your IP address is scrambled into a one-way code the moment it arrives, and that code is used to count how many drafts have come from one place today, so the page stays free for everybody. We never store the address itself, the code cannot be turned back into it, and it is deleted after three days.
What we do keep, and why it is not about you. A record of the shape of each request: which kind of job, the questions that were asked, which answers were picked, the first part of the postcode, and the totals. No free text, no full postcode, nothing that could point at a person. It tells us what people want built next, which is the only reason it exists.
If you would rather not. Do not press the button. Nothing is sent until you do, and the rest of the site works without it. If you have pressed it and want the cached plan removed, email hello@levelbest.build with roughly what you wrote and we will clear it, though in most cases it will have expired on its own within the week.
If a letter from us arrived through your door and you have come here to find out how we got your address, this section is the answer. It is also the formal privacy information required by Article 14 of the UK GDPR, which applies whenever a company holds data about you that you did not give it.
Where the address came from. Your local council's planning register. Planning applications are public by law (section 69 of the Town and Country Planning Act 1990), so anyone can read them, and much of it is republished by an aggregator called PlanIt. We read the register, or PlanIt's copy of it, and nothing else.
What we hold. The address of the property, its postcode, the planning reference, the date the application was registered, and the council's own one-line description of the works. That is all of it.
What we deliberately do not hold. Your name. The register usually gives it, and we leave it there, which is why the letter is addressed to "The Homeowner" rather than to you. We also do not take your architect's or agent's details, and we do not take a correspondence address if it is different from the property. We have not looked you up anywhere, and we hold no email address or phone number for you.
Why. Level Best is a tool for planning, costing and running a building project, and somebody who has just applied for planning permission is about to run one. We wrote to tell you it exists. The lawful basis is legitimate interests: ours in finding the people the tool is actually useful to, weighed against your interest in not being written to. We have written that balancing exercise down rather than asserted it, and we will send you a copy if you ask.
Who else sees it. Nobody. It sits in our CRM, Zoho, in the EU, listed in the table above. It is not sold, not shared, and never passed to a builder, a tradesperson or any partner of ours.
How long. Twelve months from the date your application was registered, then deleted.
How often. Once. One letter per application. There is no second letter, no follow-up, no email and no phone call, whether or not you reply.
Stopping it. You have an absolute right to object, and you do not have to give a reason. Email hello@levelbest.build, or write on the letter and post it back to the address on it. We delete the address and add the property to a suppression list that every future mailing is checked against, so it cannot come back in a later batch. You can also ask us for a copy of everything we hold about the property, or to correct it.
Complaining. To us first if you like, but you do not have to: the Information Commissioner's Office takes complaints directly, at ico.org.uk or 0303 123 1113. We are registered with them under reference ZC213708.
Level Best is for adults planning real projects; it isn't directed at children and we don't knowingly hold data on anyone under 16.
If this policy changes in any way that matters, we'll say so plainly on the site, not bury it.
Questions: hello@levelbest.build