Privacy Notice

1. Who is responsible for your data

Planewalker acts as controller for website, sales, billing, account-administration, security, and direct support data that we determine how to use.

For personal data contained in a customer workspace—such as tasks, documents, comments, objectives, and member records—the organisation that controls the workspace is generally the controller and Planewalker acts as its processor. If you have a request about workspace content, contact your workspace administrator first.

2. Data we collect

• Profile and workspace data: names, work email addresses, roles, team membership, workspace settings, and invitation status.
• Customer Content: projects, issues, comments, documents, objectives, reports, labels, updates, and other information submitted through the Service.
• Billing data: plan, subscription status, billing cycle, Stripe customer and subscription identifiers, and payment-event status. Payment card details are collected and handled by Stripe rather than stored by Planewalker.
• Sales and support data: name, email, team size, message content, and correspondence.
• Technical and usage data: requests, timestamps, sync cursors, activity records, integration identifiers, error and security information, and device or browser information made available through normal web requests.
• Local device data: the application may store workspace snapshots, queued offline changes, theme choice, and other interface preferences in browser storage to provide offline and responsive behaviour.

3. How we use data and our legal bases

• Provide the Service and fulfil our contract: operate workspaces, synchronise content, process requested actions, provide support, and administer subscriptions.
• Legitimate interests: secure and troubleshoot the Service, prevent abuse, understand reliability, communicate about the product, and improve features where those interests are not overridden by your rights.
• Legal obligations: maintain tax, accounting, compliance, and security records and respond to lawful requests.
• Consent: where required, for optional communications or technologies. You may withdraw consent at any time without affecting earlier lawful processing.

We do not use Customer Content to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

4. How we share data

We disclose personal data only as needed to operate the Service, complete a requested transaction, comply with law, or protect rights and security. Recipients may include:

• workspace owners, administrators, members, and integrations according to workspace configuration;
• cloud hosting, database, email-delivery, monitoring, and support providers;
• Stripe for checkout, subscription management, payment processing, and fraud prevention;
• professional advisers, auditors, insurers, or authorities where reasonably necessary;
• a successor in a merger, financing, reorganisation, or sale, subject to appropriate confidentiality protections.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising.

5. International transfers

Service providers may process data outside your country, including outside the European Economic Area. Where required, we use an approved transfer mechanism, such as an adequacy decision or standard contractual clauses, together with supplementary safeguards where appropriate.

6. Retention

We retain personal data only as long as reasonably necessary for the purposes described in this notice. Workspace content is generally retained while the workspace is active and for a limited period after termination to support recovery, export, backups, dispute resolution, and legal obligations. Billing, transaction, security, and audit records may be retained longer where required by law or necessary to establish or defend legal claims.

Retention periods may differ where the customer controlling a workspace instructs us to delete data, or where technical backups cycle out on a delayed schedule.

7. Security

We use technical and organisational measures designed to protect personal data, including access controls, transport encryption, restricted service credentials, logging, and data-integrity controls. No internet service can guarantee absolute security. Customers are responsible for managing workspace permissions and safeguarding API, MCP, and other integration credentials.

8. Your privacy rights

Depending on your location and the circumstances, you may have rights to be informed; access personal data; correct inaccurate data; request deletion or restriction; receive portable data; object to processing; withdraw consent; and receive human review of certain automated decisions.

To exercise a right regarding data controlled directly by Planewalker, email sales@exponential.app. We may need to verify your identity. For Customer Content, contact the organisation that controls your workspace; we will assist that organisation where required.

You may also lodge a complaint with your local data protection authority. We encourage you to contact us first so we can address your concern.

9. Cookies and browser storage

The Service uses browser storage required for application functionality, including theme preferences, offline workspace snapshots, mutation queues, and interface state. If we introduce non-essential analytics or advertising technologies, we will update this notice and provide consent controls where required.

10. Children

The Service is intended for organisations and people aged 18 or older. We do not knowingly collect personal data directly from children. Contact us if you believe a child has provided personal data inappropriately.

11. Changes to this notice

We may update this notice as the Service or legal requirements change. We will revise the date above and provide additional notice when a change materially affects how we process personal data.

12. Contact

Privacy questions and requests may be sent to sales@exponential.app. The legal name and postal address of the contracting Planewalker entity are provided in the applicable order form or commercial agreement.