Privacy notice

Last updated: 24 October 2026

Who we are

Residual is provided by Lee Reevell, trading as Hilbre Studio, 52 Grange Cross Lane, Wirral, CH48 8BQ (“we”, “us”). We are the controller of the information in the table below. Contact for anything about your personal information: privacy@residual.space.

ICO registration number: ZC283893.

Information we're responsible for

What	Why we use it	Lawful basis	How long we keep it
Registering interest in the private beta	To invite you to join the private beta	Your consent, which you can withdraw at any time	See Registering interest
Your account: name, email address, organisation and role, sign-in records	To let you sign in and keep accounts secure	Legitimate interests (ours and your organisation's) in a secure service it has asked for	While your account exists. Removed when you or your organisation's account is deleted
Service emails	To tell you about your account	Legitimate interests	A record that it was sent, not a copy
Steps you reach in Residual, such as creating a scheme (no figures, names or text you typed)	To see where people get stuck	Legitimate interests (improving the service)	While the account exists
Your answer to the one-question survey after your first report export	To decide what to work on next	Legitimate interests (learning what customers find useful)	While the account exists
Security logs: IP address, pages and routes requested, browser type, time	To keep Residual secure and fix faults	Legitimate interests (security)	Until our hosting provider's log retention expires, after 7 days (Railway's current plan)
Administrator actions on accounts (account IDs and counts, no content)	An accountable record of changes	Legitimate interests (security and accountability)	2 years. If an account is deleted, its ID in these records is replaced by a one-way code
Data protection requests and complaints you send us	To deal with them	Legal obligation	2 years after we close the request

We don't sell personal information or use it for advertising.

Registering interest in the private beta

If you register at residual.space/register, we collect your name, work email address, organisation and role, what you would use Residual for (if you tell us), when you gave consent, your browser's user-agent string (to help us spot automated sign-ups), and where your visit came from. We use it only to contact you about the private beta, on the basis of your consent. It is stored by our hosting provider. If we invite you, your email address goes to our sign-in provider, which sends the invitation.

We delete your registration:

30 days after we mark it as declined, counted from the last change to your registration;
30 days after we invite you;
in any case, 12 months after you first registered (registering again doesn't restart this);
and, once the private beta ends, 90 days after its end date if we haven't invited you.

To withdraw your consent and have your registration removed sooner, email privacy@residual.space.

If we contact you about Residual at work

We may email people at local planning authorities and viability consultancies to tell them about Residual or ask for their views.

What we use, and where from: your name, job title, work email address and organisation, as your organisation publishes them for professional contact, or a role inbox. We don't buy lists or guess email addresses.
Lawful basis: our legitimate interests in telling organisations about a professional tool relevant to their work. We only email companies, councils and other corporate bodies this way, never sole traders or ordinary partnerships without their consent.
How much: no more than three messages to any organisation, and we stop when you reply. Every message tells you how to object. If you do, we won't contact you again, and keep your email address on a do-not-contact list for that purpose only.
How long: if you don't reply, we delete your details 6 months after our last message. If you do, we review them 12 months after our last contact and delete them then unless we're still working together.

Information your organisation puts into Residual

Schemes, appraisals, reports, uploaded documents, the names in the audit trail and questions you ask Sid belong to your organisation, which is the controller. We process them only to provide Residual and under our contract with them, so contact your organisation first with any question. We keep them while its account exists. From an uploaded document, Residual keeps only the fields you accept, with a short quote showing where each came from. Uploads you don't finish are deleted after 30 days.

Please don't upload personal information about residents or other individuals, such as tenancy lists or rent rolls. Residual doesn't need it.

Sid's drafting

Sid is Residual's built-in help and doesn't calculate figures. Sid's drafting reads documents, drafts inputs from plain language, writes report narrative and answers help questions. It can use a language model supplied by Anthropic, PBC (USA). It is off for every organisation, so nothing is sent to Anthropic, and we switch it on only when an organisation asks.

If it is on, only these are sent: the lines of an upload that Residual's own reader couldn't use; what you type to Sid, with a short description of the screen and scheme; and, for narrative, the scheme name and headline figures. Anthropic would be our processor, under a data processing addendum we'll accept first. Its commercial terms say it may not train its models on this content. We'll state here how long it keeps API content before we switch drafting on. We make no automated decisions about people.

Who we share information with

Our service providers (sub-processors) are Railway (hosting), Clerk (sign-in), Resend (service emails) and Hostinger (business email). Each is bound by a data processing agreement that requires it to protect your information. Details are on our sub-processors page. We may also share information if the law requires it, or to protect our rights or the safety of others.

International transfers

Some providers are in the USA. Where personal information goes outside the UK, we use the protections UK law requires:

the UK Extension to the EU-US Data Privacy Framework, for Clerk;
the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, for Resend;
the same Addendum, in Anthropic's data processing addendum, for Anthropic. We'll accept it before Sid's drafting is switched on, and nothing is sent to Anthropic today;
for our business email host, Hostinger, the safeguards in Hostinger's Data Processing Addendum;
for our hosting, which is in the Netherlands, the UK adequacy regulations (EEA).

Ask us for a copy of the relevant safeguards.

Cookies and similar technologies

We don't use advertising or analytics cookies. We use:

Sign-in cookies set by Clerk, only on the sign-in and sign-up pages and in the app, not on public pages like this one. They are strictly necessary.
Your preferences (theme, density, Sid's voice, the scheme you last opened), in your browser's local storage.
Where your visit came from, in session storage until you close the tab, so the register-interest form can tell us.

Do you have to give us your information?

Providing it is voluntary. Without your registration details we can't invite you, and without your account details you can't sign in.

Your rights

You have the right to:

access your information and get a copy;
have it corrected;
have it deleted;
restrict how we use it;
object to our use of it where we rely on legitimate interests;
withdraw consent where we rely on consent (this doesn't affect what we did before);
data portability: receive information you gave us in a machine-readable format, where the law gives this right.

To use any of these rights, email privacy@residual.space. We may need to confirm your identity. We'll respond within one month, and tell you why if a complex request needs longer. If it concerns information your organisation put into Residual, we'll pass it to them and help them respond. Deleted information stays in encrypted backups for 35 days; we don't restore it from them.

Complaints

If you're unhappy with how we've handled your personal information, please tell us first at privacy@residual.space. We'll acknowledge within 30 days and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113.

Changes

We'll update this notice and its date when how we use information changes, and tell account holders by email if a change is significant.