Useful information.
Careful handling.

Who is responsible

Darran Barton trading as YardBrief is the controller of the personal information used to operate YardBrief. Contact us at 15 Cupar Road, Newport-on-Tay, DD6 8AF, United Kingdom, or hello@sectorpost.net about privacy, access, corrections or deletion.

Information we use and where it comes from

• Account and workspace information you provide: business name, email, coverage, equipment, delivery preference, feedback, company watches, saved-record snapshots and approach drafts. Passwords are stored as salted hashes. We verify access to your email before payment. Verification and recovery requests create limited-life security records; using a recovery link ends existing account sessions.
• Service and billing records: accepted offers, account actions, subscription and payment references, payment status, cancellation and refund events. Stripe handles payment details on its checkout; YardBrief does not store full payment-card numbers.
• Public business research: project notices and amendments, named organisations and business contacts, published contact details, locations, equipment and service coverage. Sources include Find a Tender, public procurement records, councils, contractors and the businesses' own websites. Source links are kept with the research. Published details are not treated as consent to marketing.
• Technical and correspondence information: session identifiers, access attempts, request information needed by our host to deliver and protect the site, and messages you send to our support inbox. Optional analytics are described separately below.

Why we use it

Our legitimate interests are to operate and secure the service, answer enquiries, check research accuracy and assess whether public projects fit a business's equipment and region. We keep these uses relevant to the business context and consider people's privacy and objections. Company matching is a relevance assessment; it does not establish a confirmed requirement for equipment.

Information needed to provide an individual's paid subscription is used to perform that contract. Business contact information used to administer a company subscription is handled in our legitimate interests in providing the requested service. We retain transaction information where required to meet accounting obligations. Optional journey analytics use your consent. You do not need to allow them to read a sample or use your account.

Account and billing information needed to provide a paid subscription is identified when requested; without it we cannot provide that subscription. Additional profile detail and approach drafts are optional. The service does not make solely automated decisions with legal or similarly significant effects on individuals.

Your right to object

You can object to direct marketing at any time. Email hello@sectorpost.net to ask us to stop. You can also object to other processing based on legitimate interests. We keep a minimal suppression record where needed to respect an objection across YardBrief and other SectorPost brands; opening a new account does not remove that instruction.

Who receives information

• Cloudflare: website hosting, security and the hosted database. Hosted account information is not stored only on a local laptop. Local development uses a separate local database.
• Stripe: processes checkout and billing information, including customer contact details, the accepted subscription and payment status.Its use of information is explained in the Stripe Privacy Policy.
• Google Workspace: messages sent to our support email are handled through the existing Workspace inbox.
• Resend: processes recipient addresses, email content, sending records and delivery events for account verification, recovery and subscriber briefings. The connection also supports controlled setup tests. It is not used for unsolicited prospect introductions. Read its data-processing terms.
• OpenAI: receives selected text from public project sources to assist research review. Those sources may identify business representatives. This workflow does not receive your private profile, watchlist, approach drafts, password or payment details. Model output is held for review and cannot itself publish a verified fact or send a message. Response storage is disabled for these requests; this is not a promise of zero provider retention. OpenAI describes security logging and other retention in its API data controls.

Project briefings may include relevant information from their public business sources. Another subscriber does not receive your private watchlist, profile or draft approaches. Authorised administration may be needed for support, security and information-rights requests. Entering a company name or website does not connect its inbox or CRM, and copying an approach draft does not send a message.

International processing

Our providers operate internationally, including in the United States; this service does not promise UK-only processing. Cloudflare's data-processing terms include contractual safeguards and a UK addendum for relevant restricted transfers. Stripe describes its transfer arrangements in its privacy policy, and Google's Workspace data-processing terms describe its safeguards. Resend stores customer data in the United States; its transfer information describes its contractual safeguards and UK arrangements. OpenAI's API data controls describe its processing and retention; our research workflow does not claim UK-only processing or zero retention. Contact us for information about the safeguards applicable to information we handle. New delivery providers' processing arrangements must be confirmed before live customer use.

Cookies and optional analytics

Essential cookies keep your account signed in. Hosted sessions expire after 12 hours; the separate local simulation's account cookie lasts up to 45 days. Session tokens are stored as hashes on the server. A saved offer context keeps the requested journey consistent; it is not proof of the visitor's identity or payment.

Optional analytics are off until you choose “Allow analytics”. The preference cookie lasts 90 days. With permission, the journey ledger records page views and deliberate actions by journey version without adding your email or IP address to those analytics events. Necessary security and billing records remain separate. There are no email open-tracking pixels. Turn analytics off using the footer control; refusal does not change the offer or access to the requested service. Stripe may use its own cookies when you visit its checkout, as explained in its privacy policy.

How long information is kept

Account and workspace records remain until an applicable deletion request or administrative deletion; closing a browser tab does not delete them. There is no scheduled account-data purge in this build. Contact us to request deletion. We assess what must remain by whether it is still needed to provide the service, resolve an enquiry or dispute, investigate misuse, or respect a marketing objection. A cookie's expiry does not mean the underlying account or billing records are deleted.

Account deletion does not automatically erase required billing or suppression records or records separately held by Stripe. Tax records must normally be retained for at least five years after the relevant 31 January filing deadline, as described in HMRC's record-keeping guidance. This does not require keeping every workspace draft for that period.

Your information rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction or a portable copy of your information. You may withdraw analytics consent at any time without affecting earlier lawful use. Email us to make a request; we may need to confirm your identity. You can complain to the Information Commissioner's Office if you are unhappy with how your information is handled.