1. Who is responsible for your information?
SupportCheck.ie is an independent Irish support-navigation project. For the present pre-pilot service, SupportCheck.ie is responsible for the personal data described here. Privacy enquiries and requests may be sent to privacy@supportcheck.ie.
Where a council, employer or other organisation offers a branded pilot, the parties' roles may differ. Before it starts, an organisation-specific notice will identify whether each party acts as controller, joint controller or processor and who is responsible for each data use.
2. The short version
- The public checker does not require an account, name, PPS number, exact date of birth, home address or bank details.
- Your checker state travels with each request but is not saved as a case file in the SupportCheck database.
- Progress, estimates, watched supports and language choices are saved on your own device when you choose those features.
- AI helps interpret words and select relevant verified records. It does not make an official eligibility decision or award a payment.
- Staff accounts and public issue reports are stored because those services cannot operate without them.
- SupportCheck does not sell personal information and currently uses no advertising or behavioural-tracking cookies.
3. Information processed and why
| Activity | Information | Purpose and proposed legal basis | Retention |
|---|---|---|---|
| Public guide and calculators | Answers and circumstances such as household composition, broad age band, income, work, housing, caring or disability-related facts. | To provide the check requested and protect the service. Legitimate interests under Article 6(1)(f): operating a privacy-minimised support navigator. The Article 9 condition for any deliberately provided health information must be confirmed in the DPIA before a pilot. | Held in the active journey and sent with the request; not written to the case database. Infrastructure security logs may still contain technical request information. |
| AI-guided text | Text typed and a limited set of candidate SupportCheck records. Common direct identifiers are blocked. | To understand the user's words or rank relevant evidence. Legitimate interests under Article 6(1)(f), subject to the DPIA and provider contract. | SupportCheck does not save the conversation as a case record. Model requests are sent with storage disabled; provider security and abuse-monitoring rules may still apply. |
| Saved plan and device features | Support identifiers, completed actions, watched supports, saved estimates, selected council and language. | To remember choices on the user's device, at the user's request. See the cookie notice. | Until the user clears them, assisted mode clears them, or browser storage is deleted. |
| Anonymous outcome feedback | A fixed outcome choice, support identifier, council code, language and time. No free-text case answer. | To measure whether routes helped and improve the service. Legitimate interests under Article 6(1)(f). | Organisation reporting is presently configured for 730 days by default. The period must be confirmed in each pilot agreement. |
| Correction reports | Report type, message, selected support and optional official-source link. | To investigate and correct inaccurate, outdated or inaccessible content. Legitimate interests under Article 6(1)(f). | Until resolved and for the subsequently approved audit period. The final period must be set before pilot launch. |
| Staff and organisation access | Name, work email, organisation, role, login records, actions and invitations. | To authenticate staff, administer access, secure organisation areas and maintain an audit trail. Contract and legitimate interests under Articles 6(1)(b) and 6(1)(f). | For the account relationship and an approved security/audit period afterwards. Invitations normally expire after seven days. |
| Security and rate limiting | IP address used transiently to create a one-way hash, timestamps, request counts and technical logs. | To prevent abuse, protect users and control service costs. Legitimate interests under Article 6(1)(f). | Only as long as operationally required; provider logs follow the contracted hosting period. Both must be recorded in the final retention schedule. |
4. Sensitive information and data minimisation
SupportCheck may need a limited fact such as whether a disability or long-term condition affects daily life. It does not need a diagnosis, medical record or named person. Do not enter names, PPS numbers, contact details, bank details, application documents or detailed medical information into the public guide or correction form.
5. AI and automated decisions
AI is used only as a constrained language tool. It may extract a proposed fact from free text or rank records already held in the controlled directory. Facts requiring confirmation are shown to the user. Eligibility logic and monetary estimates come from deterministic, source-linked rules—not the model. SupportCheck does not make a decision having legal or similarly significant effect; the relevant public body makes every official decision.
6. Who receives information?
Depending on the feature used, information may be processed by:
- Vercel, which hosts and delivers the website and may process technical request and security logs;
- Supabase, which provides the database and staff authentication;
- OpenAI, which processes limited guided-AI requests with model storage disabled; and
- an authorised pilot organisation, only for the expressly agreed service and never as an individual's hidden case file.
Service providers must act under appropriate data-protection terms. The final DPIA and contracts must record processing locations, sub-processors and any transfer outside the EEA, together with the applicable adequacy decision or Article 46 safeguards.
7. Anonymous organisational statistics
Pilot dashboards are designed to show grouped service statistics, not an individual's answers. Small-number suppression reduces re-identification risk. An employer or council should not be able to see what a named person asked or which supports that person may need. A materially different analytics use requires an updated notice and, where required, consent before it starts.
8. Your rights
Subject to the GDPR's conditions and exemptions, you may ask for access, correction, erasure, restriction or portability of personal data, or object to processing based on legitimate interests. Where consent is relied upon, you may withdraw it without affecting earlier lawful use. Email privacy@supportcheck.ie. Identity may be verified proportionately.
Because most public use is deliberately anonymous and saved only on the user's device, SupportCheck may be unable to identify or retrieve it. On-device information can be removed using the site's clear controls or browser settings.
You may complain to the Irish Data Protection Commission at dataprotection.ie.
9. Children
The service is designed for adults seeking information for themselves, their household or an organisation. It is not intended to collect a child's name, contact details or direct account. An adult may enter only the minimum non-identifying facts needed to check family supports.
10. Security, links and changes
SupportCheck uses access controls, encrypted connections, input validation, rate limits and audit controls. No online service can promise absolute security. Official external websites operate under their own privacy and cookie notices; SupportCheck does not submit an application to them for you.
This notice will be reviewed when the service, providers, law or pilot arrangements change. Material changes will be highlighted before new processing begins where required.
11. Cookies and device storage
Read the separate cookie and device-storage notice. SupportCheck currently uses no advertising or behavioural analytics cookies and therefore does not display a misleading “accept all” banner.
Version 1.0 · Effective 10 September 2026 · Legal and DPIA approval pending before pilot launch