Skip to main content
CChallenge Council Tax Band
Legal

Privacy & cookies

Last updated: 14 August 2026.

1. What we collect

We collect the minimum necessary to deliver the product:

  • Postcode — to look up your Council Tax band and comparables.
  • Your name — supplied at checkout; used to fill the VOA proposal form (Part A and Part C).
  • Move-in date (optional) — supplied at checkout; used to determine the right challenge route and pre-fill Part A of the form.
  • Phone number (optional) — supplied at checkout; placed on Part C of the form so the VOA can contact you about the case.
  • Email address — supplied to Stripe at checkout, used to deliver your pack and for customer support.
  • Payment data — handled by Stripe. We never see your full card number.
  • Server logs — IP address, user agent, timestamps. Retained 30 days for security purposes.

2. What we don’t collect

We do not run advertising or remarketing tags, do not sell or share your data with marketers, and do not require an account. We do measure how the site is used, in aggregate — see section 4 — with Google Analytics’ advertising features switched off.

3. Where data lives

Order records are stored on Neon (PostgreSQL, AWS US-East-1 region). The transfer of UK personal data to the US is permitted under the UK Extension to the EU-US Data Privacy Framework (the “UK-US Data Bridge”), which the UK Government adopted in October 2023. Neon participates in the Data Privacy Framework. The application itself is hosted on Hetzner (Germany) and served through Cloudflare. Payments are processed by Stripe Payments UK Limited. Email is delivered by Resend. The AI cover-letter generation uses Anthropic’s API. Site analytics are processed by Plausible (EU) and by Google, which also participates in the Data Privacy Framework — see section 4. We use Sentry (EU region) to monitor server errors; before any error report is sent we strip the IP address, email address and username, remove cookie and authorisation headers, and redact email addresses and postcodes from the error text, so Sentry receives the shape of a fault and not your personal data.

4. Cookies and analytics

Strictly necessary cookies. A small number of cookies are required for the site to work at all — CSRF protection and session handling. PECR allows these to be set without consent.

Plausible. We use Plausible for basic traffic counts. It is EU-hosted, sets no cookies, stores no personal data and does not track you between sites, so it runs without needing consent.

Google Analytics. We also use Google Analytics 4 to see which pages get read and where people drop out of the process. It does set cookies (_ga and _ga_…) that require your consent under PECR, so it is only loaded after you accept in the cookie banner. Consent is managed by Cookiebot, a certified consent platform, which blocks the Google tag outright until you accept; Google Consent Mode is additionally set to deny analytics and advertising storage by default.

Google’s advertising features are switched off on our property: Google Signals, user-provided data collection and advertising personalisation are all disabled, no Google Ads account is linked, and the tag is sent with ads data redaction enabled. We use Analytics for measurement, not advertising. Google deletes the underlying event data after 14 months.

You can change or withdraw your consent at any time using the cookie icon at the bottom-right of any page.

5. Your rights

Under UK GDPR you may request access, correction, or deletion of your data; object to processing; and lodge a complaint with the ICO (ico.org.uk). Email [email protected]— we respond within 30 days.

One limit applies to deletion: we are legally required to keep a basic record of each transaction for 6 years (HMRC). Where that applies, we honour a deletion request by erasing your personal details — your name, phone number, move-in date, email address and the property address — and keeping only the minimal financial record described in section 6. That record no longer identifies you.

6. Retention

We keep a minimal financial record of each order — order reference, date, amount paid, Council Tax band and postcode district (e.g. “W14”) — for 6 years, to comply with HMRC rules on commercial record-keeping.

The personal details attached to an order — your name, phone number, move-in date, email address and the full property address captured during the lookup — are automatically anonymised 12 months after the order, and sooner on a valid deletion request. Anonymising leaves the financial record intact but removes anything that identifies you. Server logs (IP address, user agent) are kept for 30 days.

7. Children

The service is intended for adults aged 18+. We do not knowingly process children’s data.

8. Data controller

The data controller is Praxis Ventures Ltd (trading as Challenge Council Tax Band), Black Bull House, 353–355 Station Road, Bamber Bridge, Preston, PR5 6EE, United Kingdom. For data requests, email [email protected].