We do not sell your personal data or meeting content. Furthermore, your private audio recordings, video files, transcripts, and proprietary internal notes are NEVER used to train public foundational machine learning models. Your data is isolated to your organization’s workspace.
1. Overview & Privacy Roles
This Privacy Policy explains how Planfluence (“Planfluence”, “we”, “us”, or “our”) collects, stores, uses, discloses, and protects information gathered through planfluence.site, our web applications, the Planfluence Google Meet Chrome extension, and associated services (collectively, the “Service”).
Under European data protection laws (such as the EU/UK General Data Protection Regulation – “GDPR”) and similar privacy regimes:
- Planfluence as Data Controller: We act as a Data Controller for your account registration details, direct communications with support, and website navigation telemetry.
- Planfluence as Data Processor / Service Provider: For meeting audio and video recordings, transcripts, summaries, and action items created or uploaded by you or your workspace members (“Customer Content”), your organization or workspace administrator is the Data Controller, and Planfluence acts solely as a Data Processor processing data on your instruction.
2. Information We Collect
We collect information in three ways: information you provide directly, meeting content you record or upload, and technical information collected automatically.
A. Information You Directly Provide
- Account Registration: Your full name, email address, password hash, and optional profile picture/avatar.
- Organization & Workspace Data: Workspace name, slug, team member email invitations, and assigned role permissions (Admin, Member, Viewer).
- Billing & Payment Data: Subscription tier, transaction history, invoice status, and billing email. Note: All credit card processing is handled securely by our Merchant of Record, Lemon Squeezy. Planfluence does not store raw payment card numbers or security CVV codes on our servers.
- Communications: Inquiries, feedback, and support tickets sent to our team.
B. Meeting & Audio Content (Customer Content)
- Audio & Video Recordings: Meeting files uploaded manually (mp3, wav, m4a, mp4, webm) or captured through the Planfluence Google Meet recording extension.
- Transcripts & Timestamps: Speech-to-text transcriptions, speaker diarization tags, and associated timestamps.
- AI Summaries & Action Items: Automated meeting summaries, extracted key decisions, and proposed action item descriptions, priorities, and assignees.
C. Third-Party Integration Credentials & Metadata
- Jira: Base URL, Jira user email, API token, project key, and generated issue identifiers.
- Slack & Trello: Authorized webhooks, OAuth tokens, and target channel/list IDs for publishing approved action items.
D. Information Collected Automatically
- Technical Logs: IP address, browser type and version, operating system, timestamp of access, referral URLs, and pages viewed.
- Telemetry & Performance: Usage metrics, feature adoption, and system error logs (via Vercel Analytics and server telemetry).
3. How We Use Information
We process collected information strictly for legitimate business and operational purposes, including:
- Delivering Core Functionality: Processing audio/video recordings into text transcripts, generating concise summaries, extracting decisions, and structuring actionable tasks.
- Third-Party Publishing: Creating issues in Jira, cards in Trello, or notifications in Slack upon your explicit review and approval.
- Authentication & Workspace Access: Authenticating users, securing workspace tenant boundaries, and enforcing role permissions.
- Billing & Subscription Administration: Tracking plan quotas (transcription minutes and storage bytes), processing subscription changes, and managing Lemon Squeezy payment reconciliation.
- Customer Support & Maintenance: Diagnosing transcription worker errors, addressing bug reports, and sending important transactional notifications.
- Security & Legal Compliance: Detecting fraud, preventing unauthorized access, defending against malicious activities, and complying with statutory obligations.
4. AI Processing, Data Isolation & Model Safety
Planfluence processes meeting recordings and audio using enterprise API agreements (specifically Google Gemini multimodal AI infrastructure).
Zero Training on Customer Data: Under our enterprise configuration, your audio recordings, transcripts, company secrets, and meeting notes are NOT retained or used by AI providers to train, retrain, or fine-tune public foundational machine learning models. Data is processed in transient memory to generate transcription and analysis, and returned directly to your isolated workspace.
Tenant Isolation: Every recording, project, transcript, and action item in Planfluence is indexed and strictly isolated by Organization ID (`organizationId`). Workspaces cannot access or query data belonging to other organizations.
5. Third Parties & Subprocessors
We do not sell, rent, or monetize your personal information or meeting content. We share data only with trusted subprocessors and service providers necessary to operate the platform:
- Lemon Squeezy (Merchant of Record): Acts as the seller and Merchant of Record for subscription billing, payment card handling, fraud screening, and international sales tax/VAT remittance.
- Cloud Storage & Infrastructure (AWS / S3-compatible storage): Encrypted object storage for audio/video recordings and database infrastructure.
- Google Cloud / Gemini AI: Automated speech recognition, audio transcription, summarization, and action item extraction.
- Vercel: Web application hosting, edge CDN routing, and anonymous performance analytics.
- Third-Party Productivity Tools: Atlassian (Jira), Slack, Trello, and Google Meet – only when explicitly connected and authorized by you.
- Legal & Regulatory Authorities: We will only disclose customer data if strictly compelled by a valid court order, subpoena, or binding legal statute, and will provide advance notice to affected customers unless prohibited by law.
6. Data Retention, Archiving & Permanent Deletion
We retain personal information and Customer Content only as long as necessary to provide the Service, maintain active subscriptions, and comply with legal obligations:
- Free Plan Retention: Free workspace accounts are entitled to store their 5 most recent meeting recordings. When a new recording is uploaded beyond this quota, the oldest unmaintained recording is automatically pruned from server storage.
- Paid Plan Retention: While your paid subscription remains active, all meeting recordings and transcripts are preserved indefinitely within your plan’s storage quota.
- Cancelled Subscription Lifecycle: When you cancel a paid plan, you keep paid features until the end of your paid billing cycle. Once the cycle ends, your workspace enters a 4-day grace period. Thereafter, recordings exceeding the Free plan’s 5-meeting limit are hidden/archived for thirty (30) days.
- Permanent Purging: If the workspace does not resubscribe within the 30-day archive period, all hidden recordings and associated audio files are permanently and irreversibly destroyed from our object storage and database.
- User-Initiated Deletion: You may delete individual meetings, action items, or projects at any time. When deleted by a user, the corresponding media files and database records are immediately purged from our active systems.
7. Security Safeguards
Planfluence implements robust technical, organizational, and physical security measures designed to protect your information:
- Encryption in Transit: All communications between your browser, our servers, and third-party APIs are encrypted using Transport Layer Security (TLS 1.3 / HTTPS).
- Encryption at Rest: Meeting audio and video files stored in object storage and database records are protected with industry-standard AES-256 encryption.
- Access Control: Strict least-privilege administrative access, tokenized API authentication, and multi-tenant isolation safeguards prevent unauthorized cross-tenant data access.
- Vulnerability Monitoring: Automated continuous dependency scanning, secret leakage prevention, and code security auditing.
While we employ state-of-the-art safeguards, no electronic transmission over the internet or storage system can be guaranteed to be 100% impenetrable. If you suspect a vulnerability or security issue, please contact us immediately at security@planfluence.site.
8. Your Privacy Rights (GDPR, CCPA/CPRA)
Depending on your geographic location, you may have statutory rights regarding your personal information:
A. Rights under the GDPR (European Economic Area & United Kingdom)
- Right of Access: Request a copy of the personal information we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete personal data.
- Right to Erasure (“Right to be Forgotten”): Request deletion of your personal account data, subject to legal recordkeeping requirements.
- Right to Data Portability: Request export of your customer data in a structured, machine-readable format.
- Right to Restrict or Object to Processing: Object to our processing of your information under certain conditions.
B. Rights under the California Consumer Privacy Act (CCPA / CPRA)
- Right to Know & Access: Learn what categories of personal information we collect, sources, purposes, and third parties with whom it is shared.
- Right to Delete: Request deletion of personal information collected from you.
- No Sale or Sharing of Personal Information: We do NOT sell your personal information, nor do we share it for cross-context behavioral advertising.
- Non-Discrimination: We will never discriminate against you, deny services, or charge different prices for exercising your statutory privacy rights.
To exercise any of these privacy rights, please email us at privacy@planfluence.site. We will verify your request using your account credentials and respond within thirty (30) days.
10. International Data Transfers
Planfluence operates servers and cloud infrastructure located in the United States and globally distributed regions. If you access the Service from the European Economic Area, United Kingdom, or other regions with laws governing data collection, your personal data may be transferred to and processed in countries outside your jurisdiction.
When transferring data across international borders, we ensure adequate protections are in place in compliance with applicable law, including utilizing European Commission-approved Standard Contractual Clauses (SCCs) and data protection agreements with our infrastructure subprocessors.
11. Children’s Privacy
The Service is strictly designed for business organizations, software development teams, and professional adults. We do not knowingly collect, solicit, or maintain personal information from individuals under the age of 18 (or the age of majority in your jurisdiction). If we learn that we have inadvertently collected personal information from a minor, we will take immediate steps to delete that data from our servers.
12. Changes to this Privacy Policy
We may revise this Privacy Policy periodically to reflect enhancements to our features, changes in legal requirements, or updates to our infrastructure. When we make material changes, we will update the “Last Updated” date at the top of this page and, where appropriate, notify you via email or a conspicuous banner in the web application.
Your continued use of Planfluence following the posting of an updated Privacy Policy signifies your acknowledgment and acceptance of the revised terms.
13. Contact Our Privacy Team
If you have questions, comments, or requests regarding this Privacy Policy, our data practices, or our compliance with applicable privacy regulations, please contact our Data Protection and Privacy team:
Planfluence Privacy & Data Protection
Email: privacy@planfluence.site or hello@planfluence.site
Security Reports: security@planfluence.site