Privacy notice

Who is responsible

Plana is a service operated from Georgia, and is the controller of the personal data described here. For anything in this notice, including a copy of your data or a data processing agreement, write to hello@planacad.com.

What we collect

• From the request-access form: your name, email, company, sector, the volume you mention, and your message.
• From working with you: the floor plans you send, the CAD software you tell us about, and our email correspondence.
• From the website: the page you arrived on, the referrer and any campaign tag, so we know which entry points work.

We never see your full card details. Payments are taken by Paddle.com, our reseller and the merchant of record for every order.

Why we use it, and on what basis

• To deliver the vectorization you asked for, and to support it afterwards: performance of our contract with you.
• To reply to your request for access and to follow up on the pilot: our legitimate interest in reaching people who asked about the product. One reply saying stop ends it.
• To improve the service using your plans: only if you have separately opted in, and you can withdraw that at any time.
• To keep records of what was sold: our legal obligation under Georgian tax law.

Who else handles it

• Supabase stores your files and the order records that go with them, in eu-west-1.
• Vercel hosts planacad.com and serves the pages you visit, including the request logs that come with serving them.
• Zoho carries our correspondence with you.
• Google Analytics measures how the site is used, on our behalf.
• Our AI model provider processes the plan images to generate the vector output.
• Paddle.com takes your payment and issues your receipt, and is the seller of record for your order. It is the exception below, because it acts on its own account rather than on our instructions.

The first five act on our instructions and nothing more.

Paddle.com is different: as merchant of record it is the seller to you, and it handles your payment and billing data as its own controller under its privacy policy at paddle.com/legal/privacy. We receive from Paddle only what we need to reconcile an order: transaction id, date, amount, your email and, where you gave one, your business name and tax id.

Legal requirements. We also disclose data where the law requires it: order and payment records to the Georgian tax authorities as part of our record-keeping duty, and anything a court or authority lawfully demands. We tell you when that happens unless we are forbidden from doing so.

Where it goes

Our providers operate outside Georgia, including in the EU and the US, so your data is transferred and stored there. Where the data comes from the EEA or the UK, those transfers rely on the standard contractual clauses in each provider's data processing terms.

How long we keep it

• Plans and generated files: kept for as long as we need them to provide the service (delivering your order, re-running a plan, and settling any refund claim), and deleted once that is no longer necessary. Ask us to delete them sooner and we will.
• Contact details and correspondence: until you ask us to remove them, or 12 months after the pilot ends.
• Order and payment records: six years, which is what Georgian tax record-keeping requires.

Your rights

You can ask what we hold, get a copy, have it corrected or deleted, object to us contacting you, or ask us to restrict what we do with it. Email hello@planacad.com and we will answer within 30 days. If you are in the EEA or the UK you can also complain to your data protection authority.

Cookies and local storage

• Google Analytics sets _ga and _ga_C4R9ZLMZF2, which last about two years, and tells us how many people visit, which pages they read and which entry point brought them. We see counts and trends, not individuals.
• Local storage: your browser keeps a timestamp under plana:access-request-last-sent so the request-access form cannot be sent twice by accident. It stays on your device and we never receive it.
• Paddle sets its own cookies when a checkout opens, under its privacy policy.

You can delete or block all of these in your browser. Nothing on the site stops working if you do.