Privacy Policy

This privacy policy describes how Planium AB, a Swedish company ("we", "us"), processes personal data when you use Planium ("the Service"). The short version: you own your data, everything you put into Planium is private by default, we never use your content to train AI models, and we never sell it. Your data is processed and stored within the EU, on servers in Sweden and EU-based storage, and kept separate and private. The longer version follows below.

1. Information we collect

Information you provide

• Account details: name, email address, password (stored as a salted hash), and optionally your company or organization.
• Project material: documents, drawings, files, specifications, tenders, PDFs, notes, meeting recordings (audio/video) and their transcripts, and anything else you upload or create in the Service.
• Payment details: processed by Stripe; we never see or store full card numbers.
• Correspondence: messages you send through the contact form or by email.
• Sign-in with Google or Microsoft: if you choose it, we receive your name and email address from the provider, nothing else.
• Comments on shared pages: when someone shares material with you through a link, you can comment without an account. We then store the name you enter, your comment and, if you provide it, your email address. Your name and comment are visible to everyone who has the link; the email address is shown only to the person who shared the page, so they can reply. The person who shared the page can remove the comment, and you can ask us to.
• Questions on our public pages: on some public pages you can ask the AI a question without an account. The question and the text of the page you are reading are then sent to our AI provider to produce the answer. We do not store the question or link it to you; your IP address is used briefly to limit the number of questions.

Information collected automatically

• Device and usage information: browser type, IP address, time zone, pages visited, and how you interact with the Service, collected through log files and strictly necessary cookies.

2. How we use information

• To provide the Service: store your material, run the AI requests you initiate, transcribe recordings you upload, compile documents, and sync the integrations you connect.
• To operate accounts: authentication, email verification, support, and service notices.
• To protect the Service: fraud and abuse checks (e.g. via IP address) and security monitoring.
• To improve the Service: analysis of which features are used and where they fall short. The analysis does not include your project material, is never used for advertising, and is never sold.
• To handle payments and subscriptions.

We do not use your project material to train AI models neither our own nor third parties'. AI providers process your requests under API terms that exclude training on customer data. We do not sell personal data, and there is no advertising on the platform.

Product analytics

We use OpenPanel, which we run ourselves on our own server in the EU, for product analytics: events such as "document compiled" or "flow created", tied to your account, so we can see which features help construction professionals and which need improvement. The analytics never include your project material, are never used for advertising, and are never sold. On the public website (planium.se's marketing pages), analytics run only if you accept the consent banner if you decline, nothing is tracked there. Inside the signed-in workspace, this processing is part of operating and improving the Service (legitimate interest and contract, Art. 6(1)(b) and (f)); you can object at any time via team@planium.se.

Support and troubleshooting

If you contact support, or if something goes wrong in the Service, authorized personnel at Planium may need to look at the material the fault concerns: the question you asked, the error log it produced, or the document that failed to load. This is done solely to reproduce and fix the fault. Access is given only to the personnel who need it for that purpose, covers only what the fault concerns, and the material is never used for any other purpose. We do not review your project material routinely or at random. The legal basis is providing the Service (Art. 6(1)(b)) and our legitimate interest in keeping it working and secure (Art. 6(1)(f)).

3. Legal basis (GDPR)

• Contract: providing the Service you signed up for (Art. 6(1)(b)).
• Legitimate interests: security, fraud prevention, and improving the Service (Art. 6(1)(f)).
• Legal obligation: bookkeeping and tax requirements (Art. 6(1)(c)).
• Consent: marketing emails, which you can withdraw at any time (Art. 6(1)(a)).

We never train AI models on your content. For AI processing, we use an enterprise version of the models via API, where the providers are contractually barred from using your traffic for training. Your material is stored within the EU and processing is governed by data processing agreements (DPAs) to ensure GDPR compliance.

4. Sharing and subprocessors

We only share personal data with the subprocessors required to operate the Service, each for a single documented purpose:

• TensorX primary AI provider for text generation and analysis, and for embeddings (search index). For chat and analysis, your request and the excerpts needed are sent; to make uploaded documents searchable, their text is sent. All traffic goes via API and is not used for model training.
• Berget AI and Inceptron backup AI providers used during outages. Berget is a Swedish provider with EU-based operations.
• OpenAI / Microsoft Azure OpenAI backup AI provider, plus image analysis. Enterprise access via API, your traffic is excluded from model training.
• Stripe payment processing and VAT calculation (PCI-DSS Level 1).
• Lettermint (EU, Netherlands): delivery of transactional email (verification, invitations, support replies).
• Microsoft (Graph API) file and calendar integration (SharePoint/OneDrive, calendar), only when you connect your Microsoft account.
• Hostup AB server hosting in Sweden (application and database). Meeting-recording transcription and the meeting bot also run on these servers, with open models; the audio is not passed on to any other provider.
• Bunny.net European company; storage of uploaded files in data centers in Sweden.
• Staan (EU), web search; only the search query is sent, never your documents.
• Black Forest Labs (EU, Germany), image editing in the Visualization tool; only the image and instruction you submit, and only when you run the tool.

If you connect optional integrations, data flows to those providers only when you use the integration, under their terms. We may also disclose information where required to comply with applicable law, regulation, or a valid legal request.

Integrations you connect yourself

Some integrations fetch data from an account you connect to Planium yourself. The provider is then not our subprocessor: we send them no data, we only read what you have allowed Planium to read. You can disconnect an integration at any time under Settings → Integrations, and we then delete the stored access tokens.

• Google Calendar (read-only): we read your upcoming and recent meetings (title, time, location, meeting link, organizer and attendees) to show them in Planium's calendar, link meetings to the right project and let you create meeting minutes. We never change, create or delete anything in your calendar.
• Google Drive (only files you pick): when you import from Google Drive you choose the files in Google's own file picker. Planium only gets access to those files, downloads them and stores a copy in your project so they become searchable and usable by the AI. We cannot see any other files in your Drive.

Planium's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is only used to provide the features above, is never used for advertising or to train AI models, and is never sold or passed on.

5. Storage, security, and international transfers

Data is stored on GDPR-compliant, encrypted infrastructure within the EU. Stored integration tokens are additionally encrypted at the application level and shown only in masked form. Passwords are hashed, transport is encrypted (TLS), and access to production systems is restricted. Where a subprocessor processes data outside the EU/EEA, transfers are protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses. We offer the same level of protection to users outside the EU (including under the CCPA and the Australian Privacy Act); data processing agreements (DPAs) are available on request.

6. Retention and deletion

We keep your content for as long as your account exists. When you delete content, it is removed from the active Service and ages out of backups on a rolling basis. If you delete your account, or ask us to at team@planium.se we delete your account and associated content from our systems, keeping only what bookkeeping or other law requires (e.g. invoices). Subscription records are kept until you ask us to delete them, subject to those legal requirements. You can export your material (PDF, Word) at any time; there is no data lock-in.

7. Your rights

Under the GDPR (and similar laws elsewhere), you have the right to:

• access the personal data we hold about you;
• have it corrected, updated, or deleted;
• receive a portable copy of the data you provided;
• restrict or object to certain processing;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a supervisory authority, in Sweden, the Swedish Authority for Privacy Protection (IMY).

To exercise any of these rights, email team@planium.se. We respond within the time frames the GDPR requires.

8. US privacy rights (CCPA/CPRA)

If you are a California resident (or a resident of another US state with a comparable privacy law), you have the right to know what personal information we collect and how it is used (described above), to access and receive a copy of it, to have it corrected or deleted, and not to be discriminated against for exercising these rights. We do not sell or share personal information as defined by the CCPA/CPRA, and we do not use it for cross-context behavioral advertising. To exercise these rights, email team@planium.se you can also export your data directly from Settings → Account, and an authorized agent may submit a request on your behalf.

9. Cookies

Planium only uses strictly necessary cookies: a session cookie that keeps you signed in, and local storage for preferences such as your theme and your analytics consent choice. Product analytics (see above) use local storage rather than cookies, and on the public website only after you have consented. We do not use advertising cookies. General information on managing cookies is available at allaboutcookies.org.

10. Children

The Service is not directed at children under 16, and we do not knowingly collect their personal data without a guardian's consent.

11. Changes to this policy

We may update this privacy policy from time to time for operational, legal, or regulatory reasons. Material changes are announced in the Service or by email before they take effect.

12. Contact

Privacy questions and requests: team@planium.se or the contact form. See also our terms of service and our compliance and security overview.