How your data is handled.

What we collect, why we process it, how long we keep it, and how you can exercise your rights.

These Terms of Use and Privacy Policy apply to your use of Plannk and all our associated services ("Services"). By using our Services, you agree to these terms.

This document is divided into two parts: Terms of Use and Privacy Policy.

About Us

Plannk is a technology company specializing in artificial intelligence. Our mission is to broaden access to advanced AI tools and increase the productivity and creativity of individuals, companies, and governments.

Definitions

For the purposes of these Terms, the following definitions apply:

  • "Services": all tools, features, APIs and applications offered by the Plannk platform.
  • "Inputs": data, prompts, files, images and any content provided by the user to the Services.
  • "Outputs": content, texts, images, code and any results generated by AI in response to Inputs.
  • "Personal Data": information related to an identified or identifiable natural person, pursuant to Art. 5, I of LGPD (Brazil) and "Personal Information" as defined in CCPA/CPRA (USA - California).
  • "Individual Account": account created by an individual for personal or individual professional use.
  • "Business Account": account linked to a private legal entity, identified by CNPJ (Brazil) or EIN - Employer Identification Number (USA).
  • "Government Account": account linked to direct or indirect public administration bodies and entities (Brazil) or federal, state or local government agencies (USA).
  • "Authorized User": person designated by the account holder to access and use the Services on their behalf.
  • "Administrator": user with permissions to manage the account, add or remove authorized users and configure permissions.
  • "Subprocessor": third party contracted by Plannk to process data on its behalf.
  • "Prohibited Content": any material that violates these Terms, applicable laws or third-party rights.
  • "API": Application Programming Interface that allows programmatic integration with the Services.

Last updated: October 25, 2026

Privacy Policy

At Plannk, we respect your privacy and are committed to protecting your personal data. This Privacy Policy describes how we collect, use and protect your information.

1. Personal data we collect

Data provided by you:

  • Account information (name, email, password, phone).
  • Personal identifiers, when necessary: CPF (Brazil) or SSN/ITIN (USA) for individuals.
  • Business identifiers, when applicable: CNPJ (Brazil) or EIN (USA) for legal entities.
  • Content you create (prompts, files, images, documents).
  • Payment information (processed by PCI-DSS certified third parties).
  • Communications with us (support, feedback, complaints).
  • Organization data (for business and government accounts).
  • Data from the Google and Microsoft accounts you connect for files, email, calendar and meeting synchronization, according to granted authorizations and section 4.
  • Content of the pages you place in the Plannk Chrome extension group, only when you use the extension, as described in section 5.

Note on sensitive identifiers: we collect CPF, CNPJ, SSN, EIN or other tax/government identifiers only when strictly necessary for billing, tax compliance or identity verification required by law. This data receives additional protection.

Automatically collected data:

  • Usage and interaction data with the Services (features used, frequency, duration).
  • Device information (model, operating system, unique identifiers).
  • Browser information (type, version, language settings).
  • IP address and approximate location (country, state, city).
  • Cookies and similar technologies (as per specific section).
  • Access and security logs.

2. How we use your data and legal bases

Purposes and legal bases:

  • Service provision: performance of a contract (LGPD Brazil: Art. 7, V).
  • Billing and payments: performance of a contract and legal obligation.
  • Technical support: performance of a contract.
  • Security and fraud prevention: legitimate interest (LGPD Brazil: Art. 7, IX).
  • Service improvements and AI training: legitimate interest with anonymized data (LGPD Brazil: Art. 7, IX and Art. 12).
  • Direct marketing: consent (LGPD Brazil: Art. 7, I) - you can opt out.
  • Legal compliance: legal obligation (LGPD Brazil: Art. 7, II).

For users in the United States (CCPA/CPRA - California and applicable state laws):

  • We do not sell your personal information ("sale" as defined in the CCPA).
  • We do not share your information for cross-context behavioral advertising ("sharing" per CPRA).
  • You can exercise your rights of access, deletion, correction and opt-out according to applicable state legislation.

Important about AI training:

  • Identifiable personal data: not used for training without specific consent.
  • Anonymized data: we may use them to improve our models and Services, as they are not considered personal data by LGPD (Brazil) or "Personal Information" by CCPA/CPRA (USA).
  • Benefits: the use of anonymized data allows us to improve the quality, accuracy and security of our services for all users.
  • Connected services data: information received through Google or Microsoft APIs (such as calendar events) is never used to train, improve or develop generalized artificial intelligence models, not even in anonymized form.

3. Data sharing

Your data may be shared with:

  • Service providers: hosting, payment processing, technical support, data analysis, marketing, security, cloud.
  • Business partners: only as necessary and always in compliance with LGPD (Brazil) and applicable privacy laws.
  • Legal authorities: for compliance with legal obligations, court orders or defense of rights.
  • Corporate transfers: in case of merger, acquisition, sale or restructuring.
  • Third parties indicated by you: only with consent or express instruction.
  • Other users: when you choose to share content publicly.

The Plannk production infrastructure, including the database and authentication, is hosted on Hostinger servers.

Important: we do not sell your personal data (as defined by LGPD Brazil and CCPA/CPRA USA). All sharing strictly follows applicable data protection legislation and is limited to the minimum necessary.

4. Connected services: Google and Microsoft 365

You connect each Google or Microsoft account through a single flow that brings files, email, calendar actions and meeting synchronization together. The connection is optional and belongs to your individual account. Review the account and requested permissions on the provider’s screens; available features depend on the permissions granted and account rules. You can revoke access at any time.

4.1. Google Calendar for meetings

The Google connection lets you list calendars and read, create, edit or delete events in the Plannk Calendar and through the assistant, according to your authorization. Where the calendar supports it, it can also create Google Meet links. For these features, we access calendar names and identifiers and event data such as titles, dates and times, time zones, recurrence, organizers, attendees, meeting links, locations and descriptions, as well as the authorized account’s email address. This authorization is completed within the same Google connection flow.

We keep the change requests, results and receipts needed to confirm and reconcile actions and prevent repetition. These records may remain associated with your account after you delete an event or disconnect the account. In the local Plannk calendar, deleting an event removes it from the view, but its record may remain internally. The synchronization window and the 24-hour period for temporary files do not apply to these records. Completed account deletion removes them from operational databases; deletion requests can be made through the channels in section 7. Linked meetings and their notes have their own history: deleting the Google event does not automatically delete them from Plannk. Use the platform’s history and deletion controls for that content.

4.2. Microsoft 365 for meetings

Microsoft meeting synchronization uses the same authorization as the connection described in section 4.4. It reads events from your Outlook/Microsoft 365 calendar and the authorized account’s address. The connection’s broader permissions support the assistant actions described below, subject to the approval required for each change.

Connecting an account includes meeting synchronization when authorized and available for your account. Automatic recording is a separate preference, starts off for new connections and only operates when you enable it and the feature is available.

Use, storage, and disconnection of meeting calendars:

  • Identify online meetings (Google Meet, Microsoft Teams and Zoom) and, when you enable automatic recording, send an assistant to record and transcribe the meeting.
  • Display synchronized meetings in your meetings area and link recordings, transcripts and summaries to the corresponding event.
  • Link the connection to the identity confirmed by the provider, using email as the account’s visible label.
  • Meeting synchronization covers approximately 7 days in the past and 60 days ahead. This window applies only to meeting synchronization; the Calendar view queries the calendars and period you select. We keep the fields needed for the purposes described in this section.
  • We share with service providers only what is strictly necessary for the feature, such as the meeting link with the service that operates the recording assistant.
  • When the owner disconnects the complete account, we also end linked synchronization and remove synchronized events for that connection. The effect on future meetings and scheduled recording assistants is shown in the confirmation. Organization administrators can stop synchronization within their administrative scope; this does not give them authority to revoke the owner’s global file and email access. Past meetings and recordings remain subject to the platform’s history and deletion controls.

4.3. Google connection: files, email and calendar

The Google connection lets the assistant work with files, emails and events from the account you authorize, within the permissions granted, and includes meeting synchronization. Assistant and synchronization access use separate Google applications and projects, with their own authorizations presented in sequence within the same flow. Complete the steps with the same account; if an authorization is interrupted or denied, Plannk indicates that the connection needs to be completed.

Data and actions available with your authorization:

  • Identification: verified email address and Google account identifier, to bind authorization to the correct account.
  • Drive: search and read files and folders, their names, metadata, and content; download files and export Google documents; create folders, upload files, change metadata or the content of regular files, move items, and send them to the trash. The connector does not directly edit text in Google Docs documents or cells in Google Sheets spreadsheets.
  • Gmail: search and read messages, threads, and attachments; create, edit, and delete drafts; send and reply to emails; create labels and apply them to or remove them from messages, mark messages as read or unread, and move them to the trash. Permanent deletion is available only for drafts, not for received or sent messages.
  • Calendar: list calendars and read, create, edit, or delete events, including participant details and the notification options shown for the action.
  • The permissions actually granted determine which actions are available. Changes to files, messages, or events require explicit human approval bound to the account, action, content, and destination presented for review.

How we use and share connector data: we use the data needed to fulfill your requests. Relevant content may be sent to our servers and to the AI provider of the model used in the conversation to produce the response or prepare the requested action, as described in section 3. Google authorization does not grant access to other users’ accounts.

Temporary files and history: copies of files downloaded or exported by the connector have their content and filename encrypted in the database. Downloading requires authentication by the connection owner and active membership in the organization where the file was obtained; we do not create a public link automatically. These copies remain available for up to 24 hours, then expire and are deleted by the cleanup routine. Messages, results, and content excerpts incorporated into the conversation follow the normal history retention described in section 6, rather than the temporary-file period.

Disconnecting the Google account: when you disconnect the account in Plannk, we end assistant access and linked synchronization, request revocation of both authorizations, delete local tokens and invalidate access to associated temporary files. Synchronized events for that connection are removed from Plannk. This does not delete the original files, emails or events in the Google account, or automatically remove conversation, meeting and recording history. To delete historical content, use the platform’s deletion controls.

4.4. Microsoft connection: files, email and calendar

The Microsoft connection uses the same authorization for the assistant to work with OneDrive files, Outlook messages and calendar events and to synchronize meetings from the authorized account. Features depend on the permissions granted and your organization’s rules. Automatic recording remains a separate preference and starts off for new connections.

Data and actions available with your authorization:

  • Identification: Microsoft account and organization identifiers, name and account address available in the profile, to associate the authorization with the correct identity.
  • OneDrive: search and read files, folders, names, metadata and content; download files; create folders, upload files, rename or move items within the same drive and send them to the recycle bin. Replacing the content of an existing file is available only in OneDrive Personal. Plannk does not offer this replacement in OneDrive Business or SharePoint, and this connector does not directly edit cells or the internal structure of Office documents. The connection does not grant general administrative access to the organization’s sites.
  • Outlook Mail: search and read messages and file attachments; create and edit drafts; change read status, categories and follow-up status; delete messages using Outlook’s normal deletion behavior; send new messages and send a copy of the approved content of a draft, preserving the original. The connector does not use permanent deletion. Microsoft accepting a submission does not confirm delivery to the recipient.
  • Calendar: list calendars and read, create, edit or delete events, occurrences or series, according to the target presented. Microsoft may send invitations, updates and cancellations to attendees as a consequence of these actions; these recipients and effects are included in the review.

Changes require explicit human approval tied to the account, action, content and destination presented. Plannk checks the permissions actually granted. If the outcome of a change is uncertain, we do not automatically repeat it just to try to obtain a response.

How we use and share connector data: we use the data needed to fulfill your requests. Relevant content may be processed by our servers and sent to the AI provider of the model used in the conversation to produce responses or prepare actions, as described in section 3. Authorizing a Microsoft account does not grant access to other users’ accounts. Access to each service remains limited to the authorized account, permissions and context.

Temporary files and history: copies of files and attachments downloaded through the connector have their content and names encrypted in the database. Downloads require authentication by the connection owner, an active connection and active membership in the organization where the file was obtained; use by the assistant is also tied to the original conversation. We do not automatically create a public link. These copies remain available for up to 24 hours, then expire and are deleted by the cleanup process. Messages, results and excerpts incorporated into the conversation follow the normal history retention described in section 6.

Disconnecting the connector: when you disconnect the account in Plannk, we end file, email and calendar access and linked synchronization, delete local credentials and invalidate access to associated temporary copies. Synchronized events for that connection are removed from Plannk. This does not automatically revoke consent in the Microsoft portal. You can manage or revoke that consent in your Microsoft account settings or, where applicable, through your organization’s administrator. Disconnecting does not delete the original files, messages or events, or automatically remove conversation, meeting and recording history from the platform.

Protection and limits on connection data use: access and refresh tokens are stored encrypted and used only by our servers to perform authorized features; they are not shown in the interface or sent to the AI model. Data received from Google or Microsoft APIs is not sold, used for advertising, passed to data brokers, or used to train, improve, or develop generalized artificial intelligence models, even in anonymized form.

You can also revoke access at any time in the security settings of your Google Account or your Microsoft account.

Plannk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Plannk extension for Chrome

The Plannk extension for Chrome is optional and places the assistant in a browser side panel. It works only with a Plannk account connected through the extension itself and does not use your Chrome Google account to identify you.

Data the extension accesses:

  • Pages in the Plannk group: address, title, text, elements and screenshots only of the tabs in the Plannk group, that is, the tab where you open the panel, the tabs you add to the group and the tabs the assistant opens at your request.
  • Actions on pages: clicks, form filling and navigations the assistant performs in the group tabs to complete the requested task, with the result of each action.
  • Conversation content: messages, attachments, references and instructions you send in the panel.
  • The extension does not send tabs outside the Plannk group as context, does not access internal browser pages and does not run in incognito windows.

How we use this data: solely to respond to your requests in the panel. The content of the group pages and of the conversation is sent to Plannk servers and to the AI provider of the model chosen for the conversation to generate the response and carry out the actions you requested.

Storage and deletion: the extension conversation history stays in your account until you delete it. The extension keeps the session, preferences, group tabs and the log of actions in progress in the browser itself; this local data is erased when you remove the extension.

Limits on use: data obtained through the extension is not sold, not used for advertising, not used to determine creditworthiness, and is transferred to third parties only when necessary to provide the feature (such as the AI provider of the conversation), to comply with the law or in corporate transactions. Members of our team read this content only with your consent, to investigate security and abuse, or to comply with legal obligations.

The use of information obtained through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

6. Data retention and deletion

Retention periods:

  • Account data: during the relationship and up to 6 months after termination.
  • Tax data: 5 years according to Brazilian tax legislation (CTN) or 7 years according to IRS (USA), whichever applies.
  • Security logs: 30-180 days (extendable if there is an investigation).
  • Conversations/content: until you delete the content or close your account.
  • Action records and local calendar events follow the specific retention described in section 4.
  • Support: 3 years after resolution.
  • Anonymized data: indefinite period (may be used for training and improvements).

The previous Supabase project was not deleted during the migration and retains a copy of the data from before the hosting change.

Deletion: after the deadlines, we perform secure deletion or irreversible anonymization, except for retentions required by law or for defense in proceedings.

7. Your rights as a data subject

Rights guaranteed by LGPD (Brazil):

  • Confirmation and access: verify if we process your data and obtain a copy.
  • Correction: update incomplete or incorrect data.
  • Deletion: delete unnecessary or irregularly processed data.
  • Portability: receive your data in a structured format.
  • Anonymization/blocking: for excessive or irregular data.
  • Information: know with whom we share your data.
  • Revocation: withdraw consent at any time.
  • Objection: contest processing based on legitimate interest.
  • Review: request human review of automated decisions.

Additional rights for California residents (CCPA/CPRA - USA):

  • Right to Know: know what personal information we collect, use and share.
  • Right to Delete: request deletion of your personal information.
  • Right to Correct: correct inaccurate personal information.
  • Right to Opt-Out: refuse the sale or sharing of your information.
  • Right to Limit Use: limit the use of sensitive personal information.
  • Right to Non-Discrimination: not be discriminated against for exercising your rights.

Rights for residents of other US states: if you reside in Colorado, Connecticut, Virginia, Utah or other states with privacy laws, you may have similar rights. Contact us to exercise them.

How to exercise: send a request to [email protected] with identification.

Response time: up to 15 days (extendable by 15 more with justification).

8. Children and adolescents

Our Services are not directed to children under 13 and we do not intentionally collect data from children in this age group.

Minors between 13 and 18 years old need express authorization from parents or legal guardians to use the Services.

If we become aware that we have collected data from a child under 13 without verifiable parental consent, we will take steps to delete that information.

9. Cookies and similar technologies

Types of cookies we use:

  • Essential: necessary for basic operation (authentication, security, session preferences). Do not require consent.
  • Functional: user personalization and preferences (language, theme). Require consent.
  • Analytics: understand how the Services are used for improvements. Require consent.
  • Marketing: relevant advertising and campaign measurement. Require consent.

Management: you can manage your cookie preferences in your profile or browser settings.

10. Security and international transfer

Security measures:

  • Encryption in transit (TLS 1.3) and at rest (AES-256).
  • Secure authentication with bcrypt hash.
  • Principle of least privilege for data access.
  • Continuous security monitoring.
  • Regular backups with geographic redundancy.

International transfer: your data may be processed in countries where our suppliers operate (USA, EU). We use appropriate safeguards, including standard contractual clauses when applicable.

11. Changes to this Policy

We may update this Policy periodically. We will notify you of significant changes 30 days in advance via email and/or in-app banner.

We recommend reviewing this Policy periodically. The update date at the top indicates when the last modification was made.

Final provisions

These Terms of Use and Privacy Policy constitute the entire agreement between the user and Plannk, superseding any prior understandings. If any provision is deemed invalid, the others shall remain in full force and effect.

Responsible vulnerability disclosure: we value security researchers who act in good faith. Report vulnerabilities to [email protected] with detailed description, reproduction steps and potential impact. Do not take actions that could harm our users or systems.

Contact:
For questions, requests or exercise of rights: [email protected]
For security issues: [email protected]
For business opportunities and partnerships: [email protected]

Reach the right team.

Choose the channel that matches your subject so your request arrives with the context it needs.

Contact support