PlayablePlanBack to PlayablePlan

Legal

Privacy Policy

Effective and last updated: 24 August 2026 · privacy update

This policy explains how PlayablePlan handles personal data when you visit the website, join the newsletter or use the service.

1. Data controller

PlayablePlan is responsible for the personal data processing described in this policy. For privacy requests or questions, email [email protected].

2. Data we process

  • Account data: name, email address, password hash, studio membership and role.
  • Workspace data: projects, tasks, milestones, comments, notifications, files, build links and activity history supplied by users.
  • Security data: session, CSRF, invitation, password-reset and MCP access-token records. Secret tokens are stored as cryptographic hashes where supported by the feature.
  • Newsletter data: email address, consent time and the version of this notice shown at sign-up.
  • Billing data: Studio billing contact, Stripe customer and subscription identifiers, selected price, subscription status, billing period and payment-success or payment-failure status. Card and payment-method details are collected and stored by Stripe, not PlayablePlan.
  • Technical and aggregate usage data: ordinary server and security logs generated when the service is requested, plus daily page-view totals by public page. The aggregate counter does not store an IP address, user agent or visitor identifier.

3. Why we use data and legal bases

  • To create and operate accounts, studios and collaborative workspaces, and to provide support: performance of the service agreement or steps requested before entering it.
  • To secure the service, prevent abuse, keep backups, understand aggregate service usage and establish or defend legal claims: our legitimate interests in operating a safe, useful and reliable service.
  • To comply with tax, accounting, regulatory or lawful authority requests: compliance with legal obligations.
  • To send launch news or other newsletter messages: consent. You may withdraw it at any time without affecting earlier processing.

Data required to provide an account or a requested feature is necessary for that purpose. If it is not supplied, we cannot provide the relevant service.

4. Service providers and disclosures

We use suppliers where needed to run the service, including IONOS for infrastructure and hosting, Brevo for transactional email delivery and Stripe for payment collection, subscription management and billing support. Stripe receives payment and billing information under its own legal responsibilities; see the Stripe Privacy Policy. Data may also be disclosed to professional advisers, authorities or other parties where required by law or necessary to protect legal rights. Workspace data is visible to the members of the studio selected by the user according to their role.

5. International transfers

If a supplier processes personal data outside the European Economic Area, we use an applicable adequacy decision or appropriate safeguards under Chapter V GDPR. You may contact us for information about the safeguards relevant to your data.

6. Retention

Account and workspace data is kept while the account or studio is active and afterwards only as needed for deletion requests, legal obligations, disputes, security and limited backup cycles. Newsletter data is kept until consent is withdrawn. Authentication sessions expire no later than 12 hours after issue; password-reset links expire after one hour and are single-use. Some security and transaction records may be retained longer where necessary to protect the service or comply with law.

7. Your rights

Subject to the conditions in applicable law, you may request access, correction, deletion, restriction, portability or object to processing. Where processing is based on consent, you may withdraw it at any time. Send requests to [email protected]. You may also lodge a complaint with the data-protection supervisory authority responsible for your country.

8. Children

The service is not directed to children. Account holders must be at least 18 years old.

9. Changes

We may update this notice when the service or its data practices change. Material changes will be highlighted in the service or communicated by email where appropriate.