Privacy Policy

This privacy policy describes how Avidnote AB, a Swedish company ("we", "us"), processes personal data when you use Planium ("the Service"). The short version: you own your data, everything you put into Planium is private by default, we never use your content to train AI models, and we never sell it. Your data is processed within the EU in our own, newly established data centers and kept separate and private. The longer version follows below.

1. Information we collect

Information you provide

• Account details: name, email address, password (stored as a salted hash), and optionally your company or organization.
• Project material: documents, drawings, files, specifications, tenders, PDFs, notes, meeting recordings (audio/video) and their transcripts, and anything else you upload or create in the Service.
• Payment details: processed by Stripe; we never see or store full card numbers.
• Correspondence: messages you send through the contact form or by email.

Information collected automatically

• Device and usage information: browser type, IP address, time zone, pages visited, and how you interact with the Service, collected through log files and strictly necessary cookies.

2. How we use information

• To provide the Service: store your material, run the AI requests you initiate, transcribe recordings you upload, compile documents, and sync the integrations you connect.
• To operate accounts: authentication, email verification, support, and service notices.
• To protect the Service: fraud and abuse checks (e.g. via IP address) and security monitoring.
• To improve the Service: aggregated, de-identified usage analytics.
• To handle payments and subscriptions.

We do not use your project material to train AI models — neither our own nor third parties'. AI providers process your requests under API terms that exclude training on customer data. We do not sell personal data, and there is no advertising on the platform.

Product analytics

We use Mixpanel with EU data residency for product analytics: events such as "document compiled" or "flow created", tied to your account, so we can see which features help construction professionals and which need improvement. The analytics never include your project material, are never used for advertising, and are never sold. On the public website (planium.com's marketing pages), analytics run only if you accept the consent banner — if you decline, nothing is tracked there. Inside the signed-in workspace, this processing is part of operating and improving the Service (legitimate interest and contract, Art. 6(1)(b) and (f)); you can object at any time via team@avidnote.com.

3. Legal basis (GDPR)

• Contract: providing the Service you signed up for (Art. 6(1)(b)).
• Legitimate interests: security, fraud prevention, and improving the Service (Art. 6(1)(f)).
• Legal obligation: bookkeeping and tax requirements (Art. 6(1)(c)).
• Consent: marketing emails, which you can withdraw at any time (Art. 6(1)(a)).

We never train AI models on your content. For AI processing, we use an enterprise version of the models via API, where the providers are contractually barred from using your traffic for training. Your material is stored in our own, newly established data centers and governed by data processing agreements (DPAs) to ensure GDPR compliance.

4. Sharing and subprocessors

We only share personal data with the subprocessors required to operate the Service, each for a single documented purpose:

• OpenAI / Microsoft Azure OpenAI — AI text generation and analysis for the requests you make. Enterprise access via API — your traffic is excluded from model training. Material is stored in our own, newly established data centers under data processing agreements (DPAs) that ensure GDPR compliance. For business customers who want Azure data centers within the EU, we can set that up separately.
• AssemblyAI (EU endpoint) — transcription of meeting recordings (audio/video), processed within the European Union.
• Stripe — payment processing (PCI-DSS Level 1).
• SMTP2GO — delivery of transactional email (verification, invitations, support replies).

If you connect optional integrations or add your own API keys, data flows to those providers only when you use the integration, under their terms. We may also disclose information where required to comply with applicable law, regulation, or a valid legal request.

5. Storage, security, and international transfers

Data is stored on GDPR-compliant, encrypted infrastructure within the EU. Stored API keys and integration tokens are additionally encrypted at the application level and shown only in masked form. Passwords are hashed, transport is encrypted (TLS), and access to production systems is restricted. Where a subprocessor processes data outside the EU/EEA, transfers are protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses. We offer the same level of protection to users outside the EU (including under the CCPA and the Australian Privacy Act); data processing agreements (DPAs) are available on request.

6. Retention and deletion

We keep your content for as long as your account exists. When you delete content, it is removed from the active Service and ages out of backups on a rolling basis. If you delete your account — or ask us to at team@avidnote.com — we delete your account and associated content from our systems, keeping only what bookkeeping or other law requires (e.g. invoices). Subscription records are kept until you ask us to delete them, subject to those legal requirements. You can export your material (PDF, Word) at any time; there is no data lock-in.

7. Your rights

Under the GDPR (and similar laws elsewhere), you have the right to:

• access the personal data we hold about you;
• have it corrected, updated, or deleted;
• receive a portable copy of the data you provided;
• restrict or object to certain processing;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (IMY).

To exercise any of these rights, email team@avidnote.com. We respond within the time frames the GDPR requires.

8. US privacy rights (CCPA/CPRA)

If you are a California resident (or a resident of another US state with a comparable privacy law), you have the right to know what personal information we collect and how it is used (described above), to access and receive a copy of it, to have it corrected or deleted, and not to be discriminated against for exercising these rights. We do not sell or share personal information as defined by the CCPA/CPRA, and we do not use it for cross-context behavioral advertising. To exercise these rights, email team@avidnote.com — you can also export your data directly from Settings → Account, and an authorized agent may submit a request on your behalf.

9. Cookies

Planium only uses strictly necessary cookies: a session cookie that keeps you signed in, and local storage for preferences such as your theme and your analytics consent choice. Product analytics (see above) use local storage rather than cookies, and on the public website only after you have consented. We do not use advertising cookies. General information on managing cookies is available at allaboutcookies.org.

10. Children

The Service is not directed at children under 16, and we do not knowingly collect their personal data without a guardian's consent.

11. Changes to this policy

We may update this privacy policy from time to time for operational, legal, or regulatory reasons. Material changes are announced in the Service or by email before they take effect.

12. Contact

Privacy questions and requests: team@avidnote.com or the contact form. See also our terms of service and our compliance and security overview.