Short version: all our cost / planning / grant / timeline calculations run in your browser and never leave your device. The only times we ever process your data on our servers are when you ask us to — by emailing yourself a report, by uploading a quote document for AI review, or by using the AI Snapshot estimator (photo or property-listing URL). All three are opt-in, and all three are covered in detail below.
This policy is written for the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the Irish Data Protection Act 2018. The data controller is untangle.ie, registered in Ireland.
What we collect
1. In-browser tool inputs (no transmission)
When you use the cost calculator, planning checker, grant finder, quote sanity-check tool, or timeline planner, the selections you make stay in your browser. They are not transmitted to our servers. Closing the tab clears them.
2. Email reports (Resend)
If you ask to email yourself a report, we transmit the report text and your email address to Resend Inc. (Delaware, USA), our email delivery sub-processor, who sends the message and then discards the address. We do not retain the email address on our servers, do not send unsolicited follow-ups, and do not use it for any other purpose.
3. AI quote analysis (Anthropic + our database)
If you upload a builder’s quote for AI analysis (the section on the quote-check page marked “upload the full quote”), you tick an explicit consent box. At that point we collect, transmit and store:
- The file you upload (PDF or image).
- The project context you select (project type, region, spec tier, optionally square metres and quote total).
- The AI’s structured analysis output (verdict, line items, red flags, summary).
- A SHA-256 hash of your IP address (for rate-limit enforcement only — not used to identify you), your browser user-agent string, and the timestamp.
Important: a builder’s quote document usually contains personal data about you (name, address, phone) and about the builder (company name, director’s name, contact details, sometimes a CRO number or RCT registration reference). By uploading, you confirm you’re happy for that information to be processed as described here. If you’d rather not, redact those fields before upload, or use the headline-figure tool above the upload section instead — that one stays in your browser.
4. Snapshot AI estimate (Anthropic + our database)
The Snapshot tool has two flows, both gated by an explicit consent box:
- Photo mode — you upload a photo of a room. We transmit the photo to Anthropic to generate the estimate, and store the photo, your room-type / region / target-quality choices, and the AI output.
- URL mode (Beta) — you paste an Irish property-listing URL (typically daft.ie or myhome.ie). Our server then makes a single, server-side HTTPS GET to that URL on your behalf, parses the public OpenGraph and JSON-LD metadata (title, lead image, asking price, description) and forwards the lead image plus the parsed text to Anthropic for the estimate. We do not impersonate you, log into any account, or fetch behind authentication walls. The major Irish portals sometimes block this kind of automated request and we surface that block as a friendly error rather than working around it. The listing URL, the parsed metadata snippets we extracted, and the AI output are stored.
In both modes we also store a SHA-256 hash of your IP address (rate-limiting only), your user-agent string and the timestamp.
5. Anonymous web analytics (only if you accept cookies)
We use Google Analytics 4 under Google’s Consent Mode v2 to understand which tools Irish renovators find useful. Until you click Accept on the cookie banner, analytics measurement and analytics cookies stay off; if you decline, they stay off permanently for that browser. IP addresses are anonymised at source. We never run advertising, ad-personalisation or behavioural cross-site tracking. You can change your mind at any time below.
Analytics consent
Current status: not yet chosen
6. Email correspondence
If you email us, we keep the thread to reply and for our records.
Lawful basis under (EU) GDPR
- Email reports: consent under Article 6(1)(a) (you initiated the email send).
- AI quote analysis: explicit consent under Article 6(1)(a) (you ticked a specific consent box before upload).
- Snapshot AI estimate (photo or URL): explicit consent under Article 6(1)(a) (you ticked a specific consent box before submission). The server-side fetch of a listing URL is performed in legitimate reliance on the public availability of that listing page and only after your consent.
- Web analytics: consent under Article 6(1)(a) via the cookie banner; lawful refusal removes all analytics cookies.
- Email correspondence: legitimate interests under Article 6(1)(f) — responding to your enquiry.
Sub-processors and international transfers
To run the AI quote analysis or Snapshot estimate we transfer the relevant inputs (quote document, photo, or listing image and parsed text) and your project context to Anthropic, PBC in the United States. Anthropic processes the data only to generate the analysis response and does not train models on the data sent through their API (per their published commercial terms and Data Processing Addendum).
Transfer to the US is covered by the European Commission’s Standard Contractual Clauses (SCCs) in Anthropic’s Data Processing Addendum. Anthropic is also self-certified under the EU–US Data Privacy Framework (DPF), which provides an additional adequacy basis under Article 45 (EU) GDPR. The same DPF + SCC combination covers our transfer of email-recipient addresses to Resend Inc.
When you use Snapshot in URL mode, our server additionally makes a single HTTPS GET request to the property-listing URL you provided. We do not transmit any data to that listing site beyond a standard browser-style request; we only read the public HTML the site already serves to anyone. The third-party listing site is not a sub-processor and we have no contractual relationship with them — they are simply the source of a public web page. Where a portal’s bot-protection blocks the request, nothing further is processed.
The full list of sub-processors we use:
- Anthropic, PBC (USA) — AI quote analysis and Snapshot estimates (only when you submit something to one of those tools). Transfers under SCCs + EU-US DPF.
- Resend Inc. (USA) — transactional email delivery (only when you ask to email yourself a report). Transfers under SCCs + EU-US DPF.
- Railway Corp. (USA) — application hosting and managed Postgres database. The database stores quote-analysis submissions and Snapshot submissions only. The Postgres instance is hosted in Railway’s EU region (Amsterdam) where available. Any control-plane access from US staff is covered by SCCs.
- Google Ireland Ltd (Ireland) — Google Analytics (only if you accept the cookie banner). Data controller for analytics measurement is Google Ireland; no US transfer of personal data takes place at the measurement layer.
Retention
- AI quote analyses: 24 months from submission, then deleted automatically. You can ask for earlier deletion at any time — see below.
- Snapshot AI estimates (photo or URL): 24 months from submission, then deleted automatically. You can ask for earlier deletion at any time using the reference UUID shown after your estimate.
- Email reports: not retained on our servers; the recipient address is held in transit by Resend and discarded after delivery.
- Web analytics: Google Analytics retains anonymised page-view data for 14 months (the default we’ve configured).
- Email correspondence: kept for up to 3 years to allow follow-up and record-keeping.
Your rights under (EU) GDPR
You have the right to ask us to (1) confirm what data we hold about you, (2) provide a copy in a portable format, (3) correct inaccurate data, (4) erase your data, (5) restrict our processing, (6) object to processing, and (7) withdraw consent at any time (this doesn’t undo processing already done with consent).
To exercise any right, email admin@untangle.ie with the subject line “Privacy”. If your request relates to an AI quote analysis or a Snapshot estimate you submitted, include the reference UUID you were shown on completion. We’ll respond within one calendar month, as required by Article 12(3) (EU) GDPR.
If we get it wrong, you have the right under Article 77 (EU) GDPR to lodge a complaint with the Irish supervisory authority, the Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, D02 RD28 — phone +353 (0)761 104 800.
What we don’t do
- We don’t sell, rent or share your data.
- We don’t pass your details to contractors, lenders or any third party for marketing.
- We don’t use advertising or behavioural-tracking cookies.
- We don’t require an account — every tool works for anonymous visitors.
- We don’t allow our AI sub-processor to train models on your data (per their commercial DPA).
Changes to this policy
We’ll update this policy if our processing changes. The “Last updated” date at the top of this page is the authoritative version date. Material changes that affect your rights will be flagged on the homepage for at least 30 days.
Contact
Privacy enquiries, deletion requests, data-subject access requests: admin@untangle.ie
Data Controller: untangle.ie, registered in Ireland.