Privacy Policy (GDPR)

§1Our commitment

This policy describes precisely what data Plaany collects, why, who it is shared with, how long it is kept and how to exercise your rights.

It applies to the site plaany.com (including the waitlist), the web app and the Plaany mobile apps.

§2Data controller

The company that will operate Plaany is being incorporated. Until then, the controller within the meaning of Article 4(7) GDPR is the founder of Plaany, publisher of the site, reachable at hello@plaany.com; the publisher's details are in the Legal Notice. Once incorporated, the company will take over this role and this policy will be updated.

For any question about your data: hello@plaany.com (subject: "GDPR").

Plaany is not required to appoint a data protection officer (Article 37 GDPR): processing data is not its core activity and does not involve large-scale systematic monitoring.

§3Applied GDPR principles

In line with Article 5 GDPR, every processing operation follows these principles:

• Lawfulness, fairness and transparency: you know what we do with your data.
• Purpose limitation: we only use your data for the stated purposes.
• Data minimisation: we collect the minimum needed for the service.
• Accuracy: you can correct inaccurate data at any time.
• Storage limitation: periods set out in §9.
• Integrity and confidentiality: encryption, restricted access, logging.
• Accountability: we keep a record of processing activities (Article 30).

§4Data collected

4.1. Provided by you

4.2. Collected automatically

4.3. Payment data

Payment data (card number, IBAN) is entered and processed by Stripe. Plaany neither sees nor stores it: we only receive a payment identifier, its amount and its status. For Providers, identity and bank account verification is carried out by Stripe; Plaany keeps no identity documents.

§5Purposes of processing

• Providing the service: account, matching, messaging, payment, reviews.
• Waitlist: sending you a welcome email, two updates before opening, then the launch announcement; counting sign-ups by language and by profile.
• Security, moderation and fraud prevention: bot protection, hiding contact details before payment, detecting prohibited content, handling reports (see §16).
• Legal obligations: accounting, tax, anti-money laundering, responses to authorities.
• Product improvement: measuring key steps in the app, fixing errors.
• Site audience measurement: only with your consent.
• Service communications: offer received, payment, event reminder, review request.
• Support and disputes: answering your requests, examining a reported problem.

§6Legal bases (Article 6 GDPR)

You can withdraw your consent at any time ("Unsubscribe" link in every email, "Cookie settings" link at the bottom of the page), without affecting the lawfulness of past processing.

§7Recipients & processors

Your data is only shared with the technical providers the service needs, each bound by a data processing agreement that complies with Article 28 GDPR:

Plaany never sells your data, and does not share it for advertising purposes.

Between users: your public profile, your offers and your reviews are visible to other users; your contact details are only shared with the other party once an offer has been accepted and paid.

Data may be passed on to a public authority (police, courts, tax administration) upon a reasoned legal request, strictly to the extent required by law.

§8Transfers outside the European Union

Some of the providers in §7 process data outside the European Union, mainly in the United States: Vercel (delivery network), OpenAI, Mapbox, Cloudflare, Google, Apple, Expo and Unsplash. These transfers rely on the EU–US Data Privacy Framework when the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (Decision 2021/914), supplemented where necessary by technical measures (encryption, hiding contact details before analysis).

§9Retention periods

§10Data security

Plaany implements appropriate technical and organisational measures (Article 32 GDPR):

• Encryption in transit: HTTPS connections only (HSTS).
• Encryption at rest: encrypted database and backups.
• Passwords: stored hashed and salted, never in plain text.
• Two-factor authentication: by authenticator app or email code, recommended for providers.
• Internal access: limited to the people who need it; any viewing of a conversation by the team is logged.
• Abuse protection: limits on login attempts and bot protection.
• Backups: daily encrypted backups of the database.

§11Personal data breach

In the event of a data breach that poses a risk to your rights and freedoms, Plaany undertakes to:

• notify the Belgian Data Protection Authority (DPA) within 72 hours of discovering it (Article 33 GDPR);
• inform you without undue delay if the risk is high (Article 34), by email and in the interface;
• take every measure to contain and remedy the breach, and document it.

§12Your GDPR rights

Under Articles 15 to 22 GDPR, you have the following rights:

Access (Art. 15)

Find out whether your data is processed and receive a copy.

Rectification (Art. 16)

Have inaccurate or incomplete data corrected (directly from your profile).

Erasure (Art. 17)

Have your data deleted, subject to legal retention obligations.

Restriction (Art. 18)

Have processing suspended while a check is carried out.

Portability (Art. 20)

Receive your data in a structured, machine-readable format.

Objection (Art. 21)

Object to processing based on legitimate interest.

Automated decisions (Art. 22)

Not be subject to a decision based solely on automated processing that produces legal effects for you or significantly affects you.

Withdrawal of consent

Withdraw consent you have given, at any time.

§13How to exercise your rights

From your profile, you can correct your information and delete your account. To receive a copy of your data or exercise another right, write to hello@plaany.com (subject: "GDPR"), stating the right concerned and your account email address.

We reply within one month, which can be extended by two months for a complex request (we will tell you if so). If we cannot reasonably verify your identity, we may ask you for proof.

§14Supervisory authorities

If you believe your rights are not being respected, you can lodge a complaint with the Belgian Data Protection Authority (DPA), or with the authority of the EU country where you live, for example:

• France: CNIL
• Netherlands: Autoriteit Persoonsgegevens

§15Cookies & storage on your device

15.1. On the plaany.com site

The site sets no cookies. It uses your browser's local storage for two settings, and two audience measurement tools that only start if you accept them:

You can change your mind at any time with the "Cookie settings" link at the bottom of every page. Refusing does not stop you from using the site.

15.2. In the Plaany app

The app only uses cookies and storage that are necessary for it to work:

§16Moderation, artificial intelligence and automated decisions

To keep exchanges safe, an artificial intelligence service from OpenAI automatically analyses:

• messages exchanged before an offer is accepted, to hide contact details and prohibited language;
• the texts of offers, event projects and profiles, each time they are saved;
• published images (profile photos, portfolio, event covers);
• the text you submit to the offer writing assistant, if you use it.

Automatic processing can only hide a passage of text or delete a prohibited image, and you are notified when it does. Any sanction (suspension, ban, freezing of a payment) is decided by a member of the team. To handle a report, a dispute or a fraud risk, the team may view a conversation; each viewing is logged.

Plaany takes no decision based solely on automated processing that produces legal effects concerning you (Article 22 GDPR), and does no advertising profiling.

§17Minors

The Platform is reserved for adults (18 or over). We do not knowingly collect data about minors. If you think a minor has given us data, write to us: we will delete it without delay.

§18Changes to this policy

Plaany may change this policy to keep up with changes in the law, the service or its providers. Significant changes are announced by email at least 30 days before they take effect, and the update date at the top of the page is changed accordingly.

§19Contact

Any question about your data or this policy: hello@plaany.com (subject: "GDPR").