Privacy Policy

Account data — the email address, first and last name, and password (stored as a salted hash, never in plain text) you give us when you sign up; whether you're signed up as a customer or a vendor; and, if you register a passkey instead of (or alongside) a password, the public-key credential your device creates for that passkey. We never receive or store your fingerprint, face data, or device PIN — that stays on your device, and is part of how passkeys are designed to work.

Profile data — your avatar photo if you upload one, and, for Vendors, your business details: business name, description, address and postcode, phone number, website, social media handles, categories and tags, portfolio photos, pricing packages, any deals or offers you list, and credentials you declare such as public liability insurance or VAT registration.

Occasion data — if you're planning a wedding or event as a Customer, the details you give us about it: type of occasion, date, and who else you invite to help plan it.

Communications — the content of inquiries and messages you send through the Service between Customers and Vendors, and any messages you send us directly (for example, a support request).

Technical and security data — your IP address and the time of each sign-in, a rough "last seen" timestamp we use to show whether you're currently online to people you're in conversation with, and standard web server logs.

Cookies — we use one essential cookie to keep you signed in and to protect the Service against cross-site request forgery. We don't currently use analytics, advertising, or tracking cookies.

To provide the Service — creating and running your account, showing your listing or search results, delivering inquiries between Customers and Vendors, and showing presence and notifications. This is necessary to perform our contract with you (our Terms of Service).

To verify Vendor listings, as described in our Terms of Service. This is necessary for our contract with Vendors, and is also in our legitimate interest, and that of Customers, in keeping listings trustworthy.

To send you transactional emails — confirming your account, resetting a forgotten password, notifying you of a new inquiry or message, and similar service messages. This is necessary to perform our contract with you. We don't send marketing email unless you've separately opted in (for example, by joining our waitlist before launch).

To keep the Service secure — detecting and preventing fraud, abuse, and unauthorised access, including using your sign-in records for that purpose. This is in our legitimate interest in running a secure service, balanced against your rights.

To comply with our legal obligations, for example responding to a lawful request from a regulator or law enforcement.

We do not sell your personal data, and we do not share it with advertisers or data brokers.

We share the minimum necessary with a small number of service providers who help us run Plannative, under contracts that require them to protect it: our hosting provider (DigitalOcean), who stores the servers and database the Service runs on and the photos you upload; postcodes.io, a free UK postcode lookup service, which receives only the postcode or partial postcode you search with — never your name, email, or any other personal data — in order to turn it into an approximate location for search; and, once we've configured one, a transactional email provider, to deliver the emails described in Section 2.

If you're a Customer, the content of an inquiry you send is shared with the Vendor you send it to (and vice versa) — that's the whole point of the feature. We're not responsible for what a Vendor or Customer subsequently does with information you've chosen to share with them directly in a message.

We may disclose data if required to by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Plannative, our users, or the public.

Plannative is built for the UK market and our infrastructure providers may process data outside the UK. Where that happens, we take reasonable steps to make sure your data is protected to a standard consistent with UK data protection law, such as relying on a provider's Standard Contractual Clauses or an adequacy decision where applicable.

We keep account and profile data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we need to keep something longer — for example, to resolve a dispute, enforce our Terms, or comply with a legal obligation.

Waitlist sign-ups made before launch are kept until we've contacted you about the launch, or until you ask us to remove them, whichever is sooner.

We use industry-standard measures to protect your data, including encrypting traffic to the Service over HTTPS, storing passwords as salted hashes rather than plain text, and supporting passkeys — a phishing-resistant sign-in method where no shared secret is ever sent to or stored by us. No system is perfectly secure, but we take reasonable technical and organisational steps to protect your data and to limit staff access to what's needed to operate the Service.

Under UK GDPR, you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data deleted in certain circumstances; restrict or object to certain processing; receive a copy of your data in a portable format; and withdraw consent at any time where we rely on consent (for example, marketing email).

To exercise any of these rights, email legal@plannative.co.uk. We'll respond within one month, as required by law. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to sort it out directly first.

Plannative isn't directed at, and isn't intended for use by, anyone under 18. We don't knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we'll remove it.

We may update this Privacy Policy from time to time, for example if the Service changes or the law requires it. If a change is material, we'll take reasonable steps to let existing users know before it takes effect.

For anything in this policy, or to exercise your rights, email legal@plannative.co.uk. Our registered address is [insert registered address].