Version 0.2 — 3 November 2026 — not yet reviewed by a solicitor.

Version 0.2, 3 November 2026 · Fossaplan, a service of Dragnex LLC · Data protection: privacy@fossaplan.com · Support: support@fossaplan.com · Takes effect: 3 November 2026

Fossaplan Privacy Policy

This notice says what we do with personal data, in the order the UK GDPR asks for it. It is written for the businesses who subscribe to Fossaplan. If you are someone whose details appear inside a Fossaplan job — a property owner, a neighbour, an engineer named in a service logbook — section 2 tells you who to ask.

1. Who we are and how to contact us

1.1 The controller is Dragnex LLC, a limited liability company registered in the United States (Wyoming), registration number EIN 37-2136997 (Wyoming Secretary of State filing ID 2024-001423059), registered office 30 N Gould St, Ste R, Sheridan, WY 82801, United States.

1.2 For anything about personal data, write to privacy@fossaplan.com. For anything else, support@fossaplan.com.

1.3 We have not appointed a data protection officer.

1.4 UK representative. We are established outside the United Kingdom and have no branch or office here, so we must appoint a representative in the UK under Article 27 of the UK GDPR, unless the exemption in Article 27(2)(a) applies. We do not consider it does, because our processing of job records is continuous rather than occasional. Our UK representative is to be confirmed — not yet appointed; until this clause names them, write to privacy@fossaplan.com — and once appointed you may contact them instead of us on any question about this notice.

2. Our two roles

2.1 We are the controller of your account data. Your e-mail address, your sign-in, your subscription and your messages to support are ours to explain, and this notice explains them.

2.2 We are a processor of what is inside your jobs. The site address, your client's name, the photographs, the levels, the quote, the logbook entries naming engineers — you decide what goes in and why. You are the controller of that data; we hold and process it on your instructions.

2.3 Our obligations as your processor are in the Data Processing Addendum, which forms part of your contract with us. It covers our security measures, our sub-processors, how we help you answer people's requests, our breach-notification window, and deletion at the end.

2.4 If someone whose details appear inside one of our customers' jobs asks us about their data, we will pass the request to that customer and tell the person who the customer is, so far as we can identify them. We have no relationship with them and we cannot answer for our customer.

2.5 A note for our customers. Where you put someone else's details into a job — your client, a neighbour whose well you record, an engineer you name in a logbook — the duty to tell that person how their data is used falls on you as controller under Article 14 of the UK GDPR, not on us. Article 14 has a "disproportionate effort" route that may help a small practice, and it comes with its own conditions.

3. What we collect, why, and for how long

3.1 The table is the summary. The clauses after it add the detail. Article references are to the UK GDPR.

3.1a Your e-mail address is a requirement of entering into the contract: without it we cannot create an account or send you a password reset. So is the name you trade under: Fossaplan is sold to businesses, and the name is how you tell us yours. Everything else in a job is yours to enter or not. There is no automated decision-making and no profiling in the Service.

3.2 Your password is sent from your browser straight to our hosting provider's authentication service, which hashes it; we never store it, log it or see the hash. That service — not us — sends your sign-up confirmation and password-reset e-mails, and it hands them for delivery to Resend, a mail-sending service, from the address no-reply@fossaplan.com. Resend therefore sees your e-mail address and the message. No other e-mail is sent by the app today.

3.3 Photographs. When you add a percolation photograph, the app re-encodes it in your browser before it is stored. That removes all of the file's embedded metadata, including any GPS location and any camera date. The date recorded against the photograph is the file's last-modified date as reported by your browser, not a camera date. The picture itself can still show a person, a vehicle or a property, so think before you upload one.

3.4 The basemap image. If you capture an Ordnance Survey basemap for a site plan, that captured image is stored inside the job — in your browser and in our database — and it is printed on the site plan sheet with the Ordnance Survey attribution. The job thumbnail shown in your dashboard includes it. Aerial imagery from Esri is different: it is drawn live on screen and is never stored or printed.

3.5 Images you supply yourself. If you drop, paste or choose your own image to use as the site aerial or plan, the app re-encodes it in your browser before it is stored, as it does a percolation photograph. That removes the file's embedded location, camera and date information. The picture itself is stored with the job, synced to your account, mirrored on your devices and printed on the site plan.

3.6 We do not use your job content to develop our rule sets, and we do not sell personal data to anyone.

3.7 Fault reports and usage counts. The app can send two kinds of technical record, and both go only to our own database — no third party receives them, neither sets a cookie, and neither stores anything on your device. Each is switched on or off for a whole deployment, not per person.

• A fault report is filed when the app hits a fault it cannot handle. It holds the kind of fault, the error message, a shortened technical trace, the page path (never the part of the address after a ? or #, and with any segment that looks like a secret replaced by "…"), the release's build code and your browser's user-agent string. It never holds your user id, your e-mail address, your sign-in token or anything from a job. It is sent without your sign-in token, so it cannot be tied to your account. The app sends at most five a page load. Every report is deleted after 30 days, by a nightly job. The account panel says whether fault reports are on.
• A usage count is one of five events — a job created, a plan pack printed, a share link made, a nation chosen, a check failing — with the nation, the build code and the day. It never holds a user id, a job id, an internet address or a user-agent string. Only a signed-in browser can send one. Each night the day's counts are folded into daily totals and the individual rows are deleted.

Our lawful basis for both is Art 6(1)(f), our legitimate interest in finding and fixing faults and in knowing which parts of the Service are used.

4. Who receives it

4.1 Our sub-processors. These are companies that process personal data for us, under contract, on our instructions.

Stripe would take payment. It is not a sub-processor — see clause 4.3.

4.2 Supabase in turn uses its own sub-processors, including Amazon Web Services for hosting, and publishes the list on its website. Supabase gives us 30 days' notice of changes to it.

4.3 Stripe is not our processor. For payment and fraud data, Stripe decides for itself what to do and why: it is an independent controller. Its own privacy notice applies to that data, at stripe.com/gb/privacy. Card details are entered on Stripe's own checkout page and never reach our servers.

4.4 Vercel wears two hats. It is our processor for the files we put on it, and its own controller for the telemetry it generates, including visitor internet addresses and the city and country it derives from them.

4.5 Open-data services. When you run a lookup, your browser calls the publisher's own service directly. What we send is a postcode or a grid reference — never the drawing, never your client's name. Because your browser makes the call, the publisher also sees your internet address, and may log it under its own policy. Each lookup is optional and each is triggered by you. One link in the Location step opens Google Maps in a new tab at the site's coordinates. Nothing from Google enters the app, but Google sees the location and whatever cookies your browser already holds for Google. It is a link you click, not something we load.

4.6 There is no map lookup for Northern Ireland. Where a sheet points you at the Spatial NI portal, you read a grid reference there yourself; nothing is sent from the app.

4.7 We may also disclose personal data to our professional advisers, or where the law requires it.

5. Sending data outside the UK

5.1 Supabase. Our project is pinned to the specific London region, eu-west-2, so the database, the sign-in service and stored objects sit in the UK. Supabase says region selection is a data-location control and nothing more, and Supabase itself is a United States company whose support and sub-processors may reach the data from outside the UK. Its data processing addendum incorporates the International data transfer addendum issued by the Information Commissioner, and accepting its terms counts as signing it.

5.2 Vercel. Vercel's primary processing facilities are in the United States, and a static site is served from whichever of its worldwide points of presence is nearest you. Its addendum deems the UK international data transfer addendum entered into, on the processor-to-processor module that fits our position. We cannot say our application files are served only from the UK; we can say your job data is stored in London. Vercel's addendum covers its Pro and Enterprise plans only, and which plan serves fossaplan.com is not recorded in our sources.

5.2a Resend. Resend is a United States service and receives your e-mail address with each sign-in e-mail it delivers. We have not read its processor terms, so we cannot yet tell you which transfer safeguard covers that leg.

5.2b GitHub. From the day we switch it on, GitHub, a United States company, holds each nightly export of our jobs table for 30 days. We have not read the terms of GitHub's data protection agreement, so we cannot yet tell you which transfer safeguard covers that leg.

5.3 Stripe (planned). Our Stripe contract is with Stripe Payments Europe, Limited, which is in Ireland — inside the European Economic Area, which regulations under Article 45A of the UK GDPR cover, so no separate transfer tool is needed for that leg. Stripe's own transfers are governed by its addendum and its privacy notice.

5.4 Cloudflare R2 (planned). The tiles hold no personal data. R2 cannot be pinned to the UK; the jurisdictions on offer are the European Union, the United States and FedRAMP, and we would use the European Union one. If personal data were ever put into R2 this position would have to be revisited.

5.5 Our own establishment. We are a United States company, but our data stays in the London region (clause 5.1) and the only people who access it work from the Czech Republic. Personal data reaching our team there is a transfer to an EEA state, which regulations under Article 45A cover through Schedule 21 to the Data Protection Act 2018. No transfer tool is needed for it. Our database is not in the United States; the United States providers in clauses 5.2 to 5.2b receive or hold only what those clauses describe.

5.6 Transfers to a third country are made under the rules in Chapter V of the UK GDPR as they now stand: the general rule in Article 44A, regulations under Article 45A, or appropriate safeguards under Article 46 with the data protection test in Article 46(6). Articles 44 and 45 were repealed on 5 February 2026 and we do not rely on them.

5.7 Ask us at privacy@fossaplan.com for a copy of the safeguards relied on for any transfer.

6. How long we keep things

These windows are operational commitments kept by hand; apart from the deletion of fault reports and usage counts in clause 3.7, nothing in the software runs a timer. When a subscription ends the workspace no longer opens; for 30 days the subscription page lists your jobs, each with a Download button that saves its job file and a link that opens a read-only copy of its drawings and documents to print or save as a PDF.

6.1 Account data — until you ask us to close your account. We delete it within 30 days of the request.

6.2 Job content while you subscribe — until you delete the job, or until your subscription ends.

6.3 Job content after your subscription ends — kept for 30 days so that you can download it from the subscription page, then deleted within a further 30 days. Your jobs are gone within 60 days of the end of the subscription.

6.4 Backups. Our database runs today on our provider's free tier, which takes no automatic backups. We take our own exports instead: a copy of the jobs table — whole job records — kept for 30 days, on a computer we control and, from the day we switch it on, as a GitHub workflow artefact (clause 4.1). The pictures in a job are held in a private storage bucket and are not in that export. So a job or an account you delete can survive in an export for up to 30 days, until that export is deleted. If a project is paused for inactivity our provider can restore it for up to a year. If we move to a paid tier, its backups will exist on that tier's retention cycle, and we will update this clause with the number before we do. Where a backup copy of deleted data exists and cannot be overwritten at once, we put it beyond use and delete it on the next deletion cycle.

6.5 Copies on your own devices. Your jobs are mirrored into the browser storage of every device you have used. Deleting a job or an account does not reach into a device we cannot see. Clear the site's data in your browser to remove them.

6.6 Support e-mail — 24 months from the last message in the thread. Billing and tax records — seven years from the end of the tax year they belong to, the longest period tax law commonly requires. Server and request logs — as in the table at clause 3.1.

7. Your rights

7.1 You have these rights over personal data about you. Each is subject to conditions and exceptions in the UK GDPR.

• Access (Art 15) — to be told whether we hold personal data about you and to get a copy, as far as a reasonable and proportionate search finds it.
• Rectification (Art 16) — to have inaccurate data corrected without undue delay, and incomplete data completed.
• Erasure (Art 17) — to have data deleted where, for example, it is no longer needed for the purpose it was collected for. It does not apply where we need the data to establish, exercise or defend a legal claim.
• Restriction (Art 18) — to have us hold data but stop using it, for example while we check a challenge to its accuracy.
• Portability (Art 20) — to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent on. Fossaplan's own job export covers most of this.
• Objection (Art 21) — to object to processing we base on legitimate interests, on grounds relating to your particular situation.

7.2 To exercise any of them, e-mail privacy@fossaplan.com. There is no charge. If a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse, and we would have to show why.

7.3 We may ask for information to confirm who you are, and may hold the request until we have it.

7.4 How long we take. One month from the relevant time — the latest of when we receive the request, when we receive any identity information we asked for, and when any fee is paid. We can extend that by two further months where the request is complex or there are several of them, by telling you why within the first month. For an access request, if we reasonably need more information to identify what you are asking about, the time while we wait for your answer does not count.

7.5 Deleting your account. In the app, Account → Delete account deletes your account, its jobs and its stored pictures at once, and clears the copies on the device you use to do it. You can also e-mail privacy@fossaplan.com or support@fossaplan.com instead, and we will delete your account, and the jobs attached to it, within 30 days. Clause 6.5 explains the copies on your other devices, and clause 6.4 the backup position.

7.6 You can delete an individual job yourself, from your dashboard, at any time.

8. Complaints

8.1 You can complain to us about how we handle personal data. That is a right under section 164A of the Data Protection Act 2018, not just our policy. The law requires us to make complaining easy — for example by a form that can be completed electronically and by other means. Today the route is e-mail;. Write to privacy@fossaplan.com with "Data protection complaint" in the subject line.

8.2 We will acknowledge your complaint within 30 days of receiving it, look into it so far as is appropriate, keep you informed of progress and tell you the outcome.

8.3 You can complain to the Information Commissioner's Office at any time, whether or not you complain to us first. Its address, online form and helpline number are published at ico.org.uk.

9. Cookies and what we store on your device

9.1 Fossaplan sets no cookies. No advertising and no third-party tracking. The fault reports and usage counts in clause 3.7 set no cookie and store nothing on your device. What we do store on your device is summarised below, and none of it is sent anywhere except as stated. Our cookie and local-storage notice is the single authoritative table: it names every key, its purpose, how long it lasts and the exception relied on, and this section is a summary of it. If the two ever differ, that notice governs.

9.2 Strictly necessary storage. These exist so that the service you asked for can work at all. The Privacy and Electronic Communications Regulations 2003, Schedule A1 paragraph 4, exempts storage that is strictly necessary for an information society service you requested — expressly including automatically authenticating you and maintaining a record of what you have put into a website, at paragraph 4(2)(e). No consent banner is needed for them.

9.3 Appearance and interface preferences. septicplan.theme remembers whether you chose light or dark. Seven keys remember what you last typed or picked so the next job pre-fills: septicplan.designer, septicplan.qualification, septicplan.businessName, septicplan.businessContact, septicplan.installerName, septicplan.testedBy and septicplan.country; the designer name and qualification also go into the job you type them into. septicplan.letterKeys remembers whether single-letter keyboard shortcuts are on. septicplan.showcaseSkip remembers that you dismissed the guided example. septicplan.fold.<id>, septicplan.inspectorOpen, septicplan.sidebarOpen, septicplan.hint.undo.count and septicplan.hint.undo.done remember how you left panels and hints. One key sits in session storage, which the browser clears when the tab closes: fossaplan.chunk-reload.v1 lets the app reload itself once, and only once, after a release, if a file it needs has gone — that one is strictly necessary (Schedule A1 paragraph 4(1)), not a preference, and our cookie and local-storage notice lists it so. These sit under paragraph 6 of Schedule A1 — storage whose only purpose is to adapt how the site appears or works to your preference — which requires us to tell you clearly (this clause) and to give you a simple, free way to object.

9.4 How to object. Clear this site's data in your browser and every preference key goes. Setting the theme back to the system default restores the default appearance but leaves the stored value. Deleting your account removes the designer name, the qualification and the firm copy from the device you delete it on; signing out removes the firm copy. You can also e-mail privacy@fossaplan.com and we will tell you how to stop them being written. Objecting to these preference keys does not stop the app working.

9.5 The preference keys in clause 9.3 are never sent to us or to anyone else, but the designer name and qualification you type into a job go with that job. The firm copy in clause 9.2 mirrors your firm's details as saved to your account. The subscription answer is read from our database and never sent back. The job mirror syncs to our database when you are signed in, which is what an account is for.

9.6 The full list of every key, with its purpose and the exception relied on, is in our cookie and local-storage notice, which is the authoritative table for this section.

9.7 The fault reports and usage counts in clause 3.7 store nothing on your device and read nothing from your device's storage, so the device-storage rules in this section do not apply to them. Clause 3.7 says what each sends. If either ever needs to store something on your device, we will update this notice first and ask for consent where the law requires it.

10. Children

10.1 Fossaplan is a paid tool sold to drainage designers, installers, surveyors and consultants. It is not aimed at children, has nothing on it of particular appeal to children, and has no consumer sign-up route. On the Information Commissioner's own test — whether access by children is more probable than not — this is not a service likely to be accessed by children, and we do not apply the children's code to it. We keep a short written record of that conclusion, as the Commissioner asks.

10.2 We do not knowingly collect data about children. If you think we hold any, e-mail privacy@fossaplan.com.

11. Changes to this notice

11.1 We may update this notice. The version and date are at the top.

11.2 If a change matters to you — a new sub-processor, a new purpose, a new kind of data — we will e-mail account holders at least 30 days beforehand.

11.3 This is version 0.2, dated 3 November 2026. Since version 0.1 (7 September 2026): the effective date filled in, fault reports and usage counts described (clause 3.7), the list of what we store on your device completed (section 9), and the processors brought up to date — Vercel in use, Resend and GitHub added (clause 4.1).