Your privacy, in plain English.

1. Who we are

SortMyPCN is operated by 89labs Ltd, a company registered in England and Wales. We're the “data controller” for the information you give us through this service.

Got a question about your data? Email us: inigo@89labs.com

2. What we collect

We only collect what we actually need to help you fight your PCN:

• Your PCN photos — the images you upload so we can read the notice details.
• Vehicle registration — extracted from your photo or entered by you, used to look up the case on the council or operator portal.
• Your name, email address and contact details — so we can identify you in the appeal letter and send you updates on your case.
• Payment card details — handled entirely by Stripe. We never see, store, or touch your card number, expiry or CVV. Stripe is PCI-DSS Level 1 certified.
• Case correspondence — any letters, portal submissions and outcome notifications related to your appeal.
• Usage data — basic server logs (IP address, timestamp, page visited) so we can keep the service running and debug problems.

We don't buy data from third parties, run ad tracking, or sell your information to anyone.

3. Why we collect it (our legal bases)

UK GDPR requires us to have a lawful reason for processing your data. Here's what applies to each thing we do:

4. Where your data lives

All your data stays in the UK and EU:

• Uploaded photos and documents — AWS Lightsail object storage in eu-west-2 (London), encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Case data, your profile and correspondence — PostgreSQL database hosted on Railway in eu-west. Encrypted at rest.
• Session data and short-lived cache — Redis on Railway eu-west, encrypted at rest. Nothing sensitive persists here beyond your current session.

No data is transferred outside the UK/EU in normal operation.

5. Who we share your data with

We share the minimum necessary, with the fewest parties possible:

• Council / operator portals — we submit your appeal on your behalf. The portal receives your name, vehicle reg, PCN reference and letter. You authorise this explicitly before we submit.
• Anthropic (Claude) — we send your PCN photo and case details so Claude can extract the ticket information and draft your appeal letter. Anthropic processes data under their data-processing agreement and doesn’t train models on your inputs by default.
• OpenAI — used only for text embeddings (similarity search across our case-law corpus). Your PCN photo is never sent to OpenAI; we send short text snippets so we can find the most relevant precedents for your appeal.
• Stripe — for payment processing only. Stripe's privacy policy: stripe.com/gb/privacy.
• Railway (infrastructure) — our hosting provider. They can access server infrastructure but operate under a data-processor agreement with us.

We will share data with law enforcement or regulators if legally required to do so. We'll tell you if we can.

6. How long we keep it

We keep your data for as long as we need it and no longer:

• Active cases — kept for the lifetime of your case plus 6 years afterwards. This matches UK record-keeping requirements for legal correspondence and financial records.
• Your account — kept while your account is open. Close your account and we delete or anonymise personal data within 30 days, except where we're legally required to keep it (e.g. financial records).
• Server logs — retained for 90 days, then deleted.

You can request deletion at any time — see “Your rights” below. If a legal hold applies (e.g. an ongoing dispute), we'll tell you.

7. Your rights

Under UK GDPR you have the right to:

• Access your data (DSAR) — request a copy of everything we hold about you.
• Delete your data — ask us to erase your personal information (the “right to be forgotten”).
• Correct your data — if something is wrong, tell us and we'll fix it.
• Object to processing — particularly where we rely on legitimate interests.
• Withdraw consent — for anything we process with your consent (e.g. marketing emails). Withdrawing consent doesn't affect anything already done.
• Data portability — receive your data in a machine-readable format.

To exercise any of these rights, use our self-service portal: www.sortmypcn.co.uk/me/dsar, or email us at inigo@89labs.com. We'll respond within one month.

8. Not happy? Complain to the ICO

If you think we've handled your data badly, please tell us first — we'd rather fix it. But you also have the right to complain to the UK's data regulator, the Information Commissioner's Office (ICO):

ico.org.uk/make-a-complaint · 0303 123 1113

9. Changes to this policy

If we make significant changes we'll notify you by email or an in-app banner before the changes take effect. The “Last updated” date at the top always reflects the current version.