Privacy
Your information, plainly
Last updated 1 November 2026
HeyPenny is run by Kinch Press, a sole trader, the data controller for the information described here. Contact us at info@heypenny.ie.
The short version
- The calculators send your answers to our server to work out the answer. We don't keep them, unless you buy a PDF or an application pack, or save to your records.
- We never ask for, or store, your PPS number.
- If a grant pack needs health or care details, we say which ones first, and you tick a box to agree before we use them.
- We count searches that find nothing, without anything that identifies you.
- What we do store is encrypted, kept in the EU, and only used to give you your PDF and your records.
- We never send anything to Revenue. We don't sell or share your information for marketing, and we don't use advertising or tracking cookies.
- You can download or delete everything at any time.
What we collect and why
| What | Why | Legal basis | How long |
|---|---|---|---|
| Your answers to a calculator, while you use it | To work out your answer | Legitimate interests | Not kept: used for that answer only, and never logged |
| Your answers to a calculator, when you buy a PDF | To make your PDF and let you download it again | Contract | 30 days as a guest; for as long as you keep your account |
| For a grant application pack: the details the official form asks for, such as names, addresses, Eircodes, date of birth, phone number and facts about the property | To fill in the form and make your pack, and let you download it again | Contract. For health and care details, your explicit consent (see below) | Kept only in your browser until you buy. Then 30 days as a guest; for as long as you keep your account |
| Your email address | To send your PDF or pack, sign-in codes and, if you turn reminders on, deadline reminders, a note when new rules change a figure you saved, and a January re-check | Contract | As above |
| Saved calculations, PDFs and documents you upload | To keep your tax records ready if Revenue asks | Contract | Until you delete them. We suggest at least six years after the tax year, Revenue's record-keeping period |
| Your answers to “What could you get?”, if you press “Keep these details in my records”. They can include health, disability and welfare details | So the finder and each checker open filled in, and for the January re-check email | Your explicit consent, which you can take back by removing them | Until you remove them, or delete your account |
| Your contact details for grant packs (name, business name, address, Eircode, council, email, phone), if you choose to keep them. Never a PPS number | So your next pack starts with them filled in | Your consent | Until you remove them, or delete your account |
| What you agreed to when you bought: that your answers are true, the date of our terms, and your consent for any health and care details | To show what you agreed to, if there's ever a question | Legitimate interests | With your order: 30 days as a guest; for as long as you keep your account |
| A record of activity on your account (sign-ins, downloads) | Security, and so you can see who accessed your records | Legitimate interests | For as long as you keep your account |
| Searches that find nothing: up to four words of what you typed, never with a number, an email address, an Eircode or a PPS number. For something not on HeyPenny yet, only which one it was | To see what people need that we don't have yet, and build that next | Legitimate interests | 90 days, as a count for each day. Never with your IP address, a cookie or your account |
| Your IP address, as a one-way hash | To stop abuse, such as repeated sign-in attempts | Legitimate interests | One day |
| A record of each sale: amount, date and email | Our own accounts | Legal obligation | Six years |
Payments are taken by Stripe. Your card details go to Stripe, not to us. Stripe tells us whether the payment succeeded.
Health and care details
Some grant packs hold health and care details, because the official form asks for them: the Housing Adaptation Grant, Housing Aid for Older People, the Mobility Aids Grant and Warmer Homes. They can show a disability, that the work is urgent because of a health condition, who gives care, or a disability or carer's payment. The law calls these special category data.
We use them only to fill in the form and make your pack. The pack page says which details the form needs before you start, and you tick a box to give your explicit consent before you pay. We can't make the pack without them. We never ask for a diagnosis: your doctor fills in the medical part of the form. You can take your consent back at any time by emailing us, or with “Delete my account”. We then delete the pack and its answers. That doesn't affect what we did before.
Details about other people
Packs and some calculators ask about other people: someone applying with you, the person a grant is for, your children, or someone you care for. Only give details you have the right to give. Tell them we have them, and point them to this page. They have the same rights as you.
Do you have to give us anything?
No. The calculators work without an account or an email address. To make a PDF or a pack, we need the details the form asks for and an email to send it to. Without them, we can't make it.
No decisions about you by computer
The calculators and checks work out figures from your answers, for you to use. We don't make decisions about you by automated means. Revenue, the Department of Social Protection, the HSE, your council or SEAI makes every decision about your tax, payments and grants.
How we protect it
Your answers, PDFs and documents are encrypted on our server before they are stored, each with its own key. Our database only shows each account its own records. Downloads need your sign-in or a private, expiring link.
Who else handles it
We use these processors, under contracts that require them to protect your information:
- Hetzner Online GmbH: hosting, on our own server in Helsinki, Finland, in the EU.
- Hetzner Online GmbH: storage of encrypted records, on the same server.
- Stripe: payments.
- Google Cloud Translation: translating pages when you choose a language other than English. Only the page's words are sent, from our server. Amounts, dates, other numbers and personal details are taken out in your browser first, so your figures never go to Google.
- Resend: sending email.
Some of these companies are based in the United States. Where your information could be accessed from outside the EEA, it is protected by the EU's Standard Contractual Clauses or the EU–US Data Privacy Framework.
Cookies and your browser
We set one cookie, and only when you sign in: it keeps you signed in for up to 30 days. Calculator drafts are kept in your browser's own storage so you can come back to them. Each time you change an answer, it's sent to our server to work out the result, and not kept there. Details you type for an application pack are kept in your browser the same way, for up to 30 days, and “Forget my details on this device” clears them at once. Before you buy, only the yes-or-no answers that decide the next question are sent to us, and they're not kept either. If you choose another language, that choice and the lines already translated are kept in your browser too. We use no analytics or advertising cookies, so there is no cookie banner.
When a search finds nothing
The site search works in your browser. If it finds nothing for what you typed, or finds something not on HeyPenny yet, your browser sends us a short note once you stop typing. We count searches that find nothing, without anything that identifies you. It tells us what to build next.
- The note has only your words, cut down to four at most, with small words like “my” and “the” taken out. If what you typed has a number, an @, or anything like an Eircode, a PPS number or a web address, nothing is sent at all.
- For something not on HeyPenny yet, we keep only which one it was, not what you typed.
- No cookie goes with it. We don't keep your IP address, your account or the time with it: just a count for each day, like “widow: 12 searches on 20 October”. To stop anyone flooding the counts, your IP address is checked as a one-way hash, kept apart from the count and deleted within a day.
- Only we see the counts, and we delete them after 90 days.
If you let us ask how your application went
When you buy an application pack, there's a box to say we can email you later to ask how it went. That's when an answer usually comes: 8 weeks for most grants, and the box says when. It stays unticked unless you tick it, and the pack is the same either way.
If you tick it, we keep your email, the grant, and the council or Local Enterprise Office it goes to, until we've asked. This can be after a guest order is deleted. We ask once, and a second time (at twice the wait) only if you tell us you're still waiting. Each link works for 8 weeks, and then your email comes off the list. “Don't ask me again”, or deleting your account, takes it off at once.
Your answer is kept with the grant, the office and the day: whether you sent it, what happened, the amount, how many weeks it took, the main reason if it was turned down, and whether they asked you for more. Those last two are choices you tick, never words you type. Never your name, address, email or anything you put in the pack. A coded reference to your order stops one answer being counted twice. It's deleted when we stop asking, and from then on the answer can't be linked to you. We show totals on a grant's page only when 10 or more people are behind a figure. Your answers never go to Stripe, into our logs or into page addresses. The legal basis is your consent, and you can take it back at any time.
Your rights
You can ask for a copy of your information, have it corrected, deleted or moved, limit how we use it, or object to how we use it. Where we rely on your consent, you can take it back at any time. Most of this you can do yourself: the “Download audit pack” button gives you everything for a tax year, and “Delete my account” removes it all. Otherwise, email us, and we'll reply within a month.
You can complain to the Data Protection Commission at dataprotection.ie.