BusinessRateChecker helps UK businesses check whether their property's rateable value — and therefore their business-rates bill — looks too high, by comparing it against similar properties in the official rating list. This policy explains what personal data we collect when you use the site, why, how long we keep it, and the rights you have over it.
We keep this deliberately plain. If anything here is unclear, contact us using the details at the end.
The data controller for the personal data described here is:
A data controller is the organisation that decides what personal data is collected and why. That is us, for everything described below.
We collect three kinds of data. We try to collect as little as possible.
When you type a postcode or address to look up a property, we process that search term and the property identifier it resolves to (the VOA reference) so we can return your assessment. On its own a postcode or business-address lookup is not usually personal data about you — but because it can sometimes identify a sole trader at their premises, we treat lookups carefully and apply the retention limits below.
We do not ask you to log in, and we do not require your name to produce an assessment.
If you ask us to help with your case — for example by entering your email address to receive a report, or clicking "Get help" / "Start my appeal" — we store the details you provide. In practice this is:
This lets us send you what you asked for and, where you've consented, follow up about your case.
To understand whether the product works and where people get stuck, we record funnel events — for example: a search was run, an assessment was produced, a report was unlocked, an intent button was clicked. Each event stores the event type, the property reference, a link to your lead record if one exists, a small set of technical properties about the event, and a timestamp. We use this to improve the service. We do not sell this data or use it to build advertising profiles.
We explain the cookie/consent position for analytics in section 5.
If you use the BusinessRateChecker API, we hold your account email, the intended use you chose at sign-up (for our own analytics — it never limits what you can do), the date you accepted the API terms, your plan and, on paid plans, billing details held by our payment provider. Your API keys are stored only in scrambled (hashed) form. For each request we log the key, the operation, the settings of the lookup (such as the postcode or council, filters, sort order and number of results, or the guide topic asked for), the result, the credits used and how long it took. We do not receive or log your conversation with an AI app: when you use us through Claude, ChatGPT or another assistant, it sends only the lookup, never what you typed. When you connect an assistant, we also record which app you allowed and when, so it can stay signed in until you disconnect it. If you joined the free beta of our AI-assistant connector, we also keep the details you gave us when you joined (your name, what best describes you, your organisation and what you want to use it for, if you tell us) and your agreement to be contacted, and we used them only to run the beta and ask for your feedback. The beta ended on 6 November 2026; we keep these details until 6 May 2027, in case of questions about the beta, then delete them, or sooner if you ask us to. We do not log your IP address. Free lookups that need no account (such as our guide to business rates) are logged the same way but with no account attached. Our lawful basis is the contract between us (providing and billing the service), and for free lookups our legitimate interest in understanding how the service is used; for beta feedback emails it is your consent, which you can withdraw at any time by emailing us. API responses contain no personal data about you, and we exclude names that appear to identify private individuals from them.
When you buy a full report we record:
We never see or store your card details. You enter them into Stripe's secure payment form, shown on our page, and Stripe processes the payment.
To let you open your report again, we create a private access link. We email it to you and also remember it in your browser (see section 5). We store only a scrambled (hashed) form of each link, so it cannot be read back from our database.
We email you your link and a PDF copy of your report. If you ask us to resend your link, we check the email you give against our purchase records and send a new link only to that address. We never tell anyone whether an email address has bought a report.
Under UK GDPR we must have a lawful basis for each use of personal data. Ours are:
| What | Lawful basis | Why |
|---|---|---|
| Producing your assessment from an address lookup | Legitimate interests | You asked for the result; processing your search is necessary to give it to you, and you would reasonably expect it. |
| Storing your email and case details so we can send the report you requested | Legitimate interests (to deliver the service you asked for) | Necessary to fulfil your request. |
| Sending you marketing / follow-up about your case or the service | Consent | We only do this where you have actively opted in. You can withdraw at any time. |
| Non-essential analytics and advertising measurement (usage and advert measurement that relies on cookies/similar) | Consent | We only run this once you accept on the cookie banner. |
| Essential, privacy-light operation of the site (security, load balancing, remembering your consent choice) | Legitimate interests | Strictly necessary to run the site safely; no marketing use. |
| Selling you a full report: taking payment, giving access, emailing your link and PDF, resending your link | Contract | Necessary to provide what you bought. |
| Keeping purchase and refund records | Legal obligation | We must keep financial records for HMRC and under company law. |
| Spotting a second payment for a report you already own, so we can refund it | Legitimate interests | To avoid charging you twice. |
| Stripe's own fraud checks on your payment | Stripe is responsible | Stripe acts as its own controller for fraud prevention; see its privacy policy. |
Where we rely on legitimate interests, we've weighed our interest in running and improving a useful service against your privacy, and limited what we collect and how long we keep it accordingly. You can object to legitimate-interests processing — see section 6.
We don't keep personal data longer than we need it.
| Data | Where it lives | We keep it for |
|---|---|---|
| Lead — email, property reference, source | lead table | 24 months from your last interaction, then deleted or anonymised. If you withdraw consent or ask us to delete sooner, we act on that promptly. |
| Analytics events — event type, property reference, lead link, event properties, timestamp | event table | 14 months in identifiable form (long enough for year-on-year usage comparison), then aggregated/anonymised or deleted. |
| Assessment / report-unlock records (the figures we generated for a property) | assessment, report_unlock tables | Retained while needed to support a case you've asked us about, and otherwise aligned to the lead above. These hold a property reference and may link to a lead, but no contact details of their own. |
| API account — email, intended use, plan, terms acceptance | api_account, api_key tables | While your account is open; deleted when you close it, apart from billing records we must keep for tax (6 years). |
| API request log — key, operation, lookup settings (area, filters, sort, topic), status, credits, response time | api_request_log table | 90 days, then deleted automatically. Daily usage totals are kept with the account for billing. |
| Purchase record — email, property, price, date, terms accepted, payment references, refund | report_purchase table | 6 years from the end of the financial year of the purchase, as financial records must be kept for HMRC; then deleted. |
| Access links (stored only in scrambled form) | report_access_token table | Until your 12 months' access ends or the purchase is refunded, when they are cancelled. |
| Purchase emails | Our email provider, Resend | Delivery logs only, for the period Resend keeps them; we keep no copy of the email or the PDF. |
If you have an open enquiry or case with us, we may keep the relevant records for as long as that case is live plus a short period afterwards, even if the windows above would otherwise have elapsed.
Stripe keeps its own payment records under its own legal duties; see its privacy policy.
We use a small number of strictly necessary items needed to run the site and to remember your consent choice — these don't need your permission.
Reports you have bought. When you buy a full report, or open the private link we email you, we set a cookie called rr_access that remembers, on that browser only, which reports you have bought. It holds the private access link(s) and nothing else, cannot be read by any other website, and lasts up to 12 months. It is strictly necessary to give you the report you paid for, so it does not need your consent. If you clear it, use the link in your email or "Email me my link" to get back in.
Payments. Our payment form is provided by Stripe. Stripe may set its own cookies in that form to process the payment and prevent fraud. Their use is governed by Stripe's cookie policy.
Non-essential analytics that rely on cookies or similar technologies only run after you accept on our cookie banner. If you reject, we don't set them and we fall back to privacy-light, essential measurement only. You can change your mind at any time via the cookie settings link in the footer. The analytics tools we use are Google Analytics and Microsoft Clarity.
Advertising measurement (Microsoft Advertising). We advertise on Microsoft's search network (Bing). If you accept on our cookie banner, we load Microsoft's Universal Event Tracking (UET) tag, which records the pages you visit on our site and, if you buy a report, that a purchase happened and the price paid. This tells us whether our adverts lead to visits and purchases. We do not send Microsoft your name or email address. Microsoft may set its own cookies to do this, and its use of the data is governed by the Microsoft Privacy Statement. If you reject, the tag is not loaded.
Trustpilot reviews. Some pages display our Trustpilot star rating and reviews. This is functional content shown to help you judge whether to trust us — it is not analytics or advertising. Trustpilot is an independent third party and may set its own cookie to display the widget; their use of any data is governed by Trustpilot's own privacy policy.
Under UK GDPR you have the right to:
To exercise any of these, contact us (section 8). We'll respond within one month. There's normally no charge.
If you're unhappy with how we've handled your data you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk — though we'd appreciate the chance to put things right first.
If we change this policy we'll update the date at the top and, for material changes, flag it on the site.
BusinessRateChecker compares your property against the official published rating listThe public register listing every business property's Rateable Value. The current list is the '2026 list', based on rental values from 1 April 2024.. We are an independent service. The Valuation Office AgencyThe government body that sets every property's Rateable Value. From April 2026 the VOA is part of HMRC (see below), but 'VOA' is still the common name for the valuation side of the work. (now part of HMRCHis Majesty's Revenue and Customs — the UK tax authority. Since 1 April 2026 it also includes the VOA's valuation function.) does not endorse, back or verify this site, and our estimates are not official VOA figures. This note is about the source data — it's not personal-data processing — but we include it here so it's easy to find.