Privacy by Design: How Planily Protects Your Family's Data

When you use Planily, you are sharing some of the most personal parts of your family's life: your children's names and schedules, the emails from their schools, the routines that keep your household running. That is a significant amount of trust to place in any piece of software.

This article explains how Planily is designed to earn and protect that trust not as an afterthought, but as a foundation.

Privacy is not a feature we added

The short version is this: Planily was designed from the ground up by a cyber-security professional. Privacy and security are not features we added once the product was built. They are the principles we built on from the very first line of code.

That means the decisions about what data to collect, how to store it, how long to keep it, and who can see it were not made late in the product process. They were made first.

What Planily collects and what it does not

Planily collects the information you choose to give it: your account details, your family profile, your calendar and task entries, the school letters you upload or forward, and the meal and routine preferences you add over time. It also collects standard technical data browser type, error logs, session data that any web service generates.

What Planily does not do is equally important:

• We do not connect directly to your email inbox. If you want Planily to process a school letter, you forward it or upload it. You are always in control of what comes in.

• We do not track your location continuously. If you choose to add your postcode for weather information, that is the only location data we hold.

• We do not use your family's data for advertising. Planily is subscription-funded. There are no advertisers and no data monetisation.

• We do not use your documents, messages or household content to train public or third-party AI models.

Children's data handled with extra care

Because Planily is a family product, children's information is central to how it works. That makes the protections around children's data particularly important.

Planily applies heightened protections in line with the ICO's Children's Code (Age Appropriate Design Code) and UK GDPR. In practice, that means:

• Only adults aged 18 or over can create a Planily household.

• Children under 13 do not have direct login accounts. They are represented within a parent or carer's family profile.

• Young people aged 13–17 may be invited as limited-access family members for example to view their own schedule but only under the supervision and responsibility of the adult account holder.

• Children's data is never used for advertising, never sold, and never shared with third parties beyond what is strictly necessary to deliver the service.

• School documents containing children's information are stored securely and the original file is automatically and permanently deleted after seven days. The structured data extracted from them calendar entries, tasks is retained only for the period your account is active.

How the AI features work and what they do not do

Planily uses AI to reduce the admin burden on families: reading school letters, interpreting voice commands, suggesting meals and routines. It is worth being clear about exactly how that works.

When you upload a school letter or forward an email, the AI reads the content to extract dates, tasks and events. The structured information is added to your family plan for your review. You are always in control of what gets confirmed. The AI does not make decisions on your behalf it suggests, and you confirm.

Voice commands are processed to identify intent and extract relevant details. Voice recordings are not stored after processing.

All AI outputs are drafts that require your review. Planily does not make any decisions about you or your family that produce significant effects without human involvement. You are never subject to solely automated decision-making.

Policy as code enforcing controls inside the product

Writing a clear privacy policy is necessary, but it is not sufficient on its own. Policies need to be enforceable inside the product itself, not just readable on a website.

Planily uses policy-as-code principles to turn privacy rules into enforceable technical controls. Instead of scattering rules across documentation, we define them once and use them to govern what the system is actually permitted to do at a technical level.

In practical terms this means:

• Only the minimum data needed for a specific feature is processed data minimisation is built into the rules, not left to developer discretion.

• High-risk actions involving children's data are guarded, logged and auditable.

• Third-party integrations are tightly scoped. A calendar integration gets OAuth access to write Planily-generated events to a nominated calendar. It does not get access to read your existing calendar history or any other data.

Your rights clearly stated

Under UK GDPR, you have eight rights over your personal data. Planily is committed to making them easy to exercise:

• Access: You can request a copy of everything we hold about you at any time.

• Rectification: You can ask us to correct inaccurate or incomplete data.

• Erasure: You can ask us to delete your data. Deleting your account triggers deletion of your profile, schedule, uploaded documents and meal data within 30 days.

• Restriction: You can ask us to pause processing while a dispute is resolved.

• Objection: You can object to processing based on legitimate interests, including analytics.

• Portability: You can receive your data in a structured, machine-readable format and ask us to transfer it elsewhere.

• Withdraw consent: Where processing is based on your consent, you can withdraw it at any time.

• Complain: If you believe we have handled your data unlawfully, you have the right to contact the ICO at any time.

To exercise any of these rights, contact our Data Protection Officer at dpo@planily.co.uk.

The full documents

Planily's Privacy Policy and Terms of Service are published on the website and written in plain language. They explain exactly what we collect, why we collect it, who we share it with, how long we keep it, and what happens when you close your account.

If you have any questions about how your family's data is handled, please get in touch. We are happy to talk through anything in detail.