Your family's data.
Protected. Always.

Planily is a UK-built family operating system, operated by Planily Ltd, a private limited company registered in England and Wales.

For the purposes of UK GDPR, Planily Ltd is the Data Controller in respect of the personal information you provide to us.

Planily is intended for use by adults aged 18 or over, who act as the primary account holder for their household. Children may appear within a family profile or (from age 13) have a limited-access account, but always under the supervision and responsibility of an adult account holder.

We collect two types of information: what you choose to give us, and what is automatically generated when you use the service.

Planily is designed for families, which means children's information is central to how the service works. We apply heightened protections in line with the ICO's Children's Code (Age Appropriate Design Code) and UK GDPR.

Who can use Planily

• Adults aged 18 or over are the primary account holders. Only an adult may create a Planily household.
• Children under 13 do not have direct login accounts. They are represented within a parent or carer's family profile as named household members.
• Young people aged 13 to 17 may be invited as limited-access family members. The adult account holder is responsible for supervising any such account.

Special category data: dietary and health information

Dietary restrictions, allergies, and food preferences that relate to a health condition constitute special category data under Article 9 of UK GDPR. Where you enter such information into Planily, we process it on the basis of your explicit consent, solely to personalise meal suggestions for your household. You may delete or update this information at any time from your account settings.

School documents

School documents and letters containing children's data are stored securely and retained for 7 days as an input log. After that, the original input is deleted. Structured data extracted from those documents (calendar entries, tasks) follows the retention rules in Section 10.

Planily uses AI and natural language processing to reduce your family's admin burden. Here is exactly how it works:

WhatsApp Virtual Concierge

Planily includes a WhatsApp-based Virtual Concierge that allows you to manage your family plan through natural conversation. You can send text messages, voice notes, documents and photos directly to your Planily WhatsApp number, and the AI will handle the rest. Text messages and voice notes are processed by the AI and are not stored beyond what is needed to create the calendar or task entry. WhatsApp message content is never used for advertising or profiling.

Note: WhatsApp messages are transmitted via Meta's infrastructure. Please refer to Meta's Privacy Policy for information on how WhatsApp handles messages in transit.

Calendar Integration (Google and Outlook)

If you choose to connect Google Calendar or Microsoft Outlook, we only request the OAuth permissions needed to write Planily-generated events to a calendar you nominate, and to update or remove those events if you change them in Planily. We do not read or mine your pre-existing calendar entries for any other purpose. You can disconnect the integration at any time from your Planily settings.

AI Training

We do not use your family's documents, messages, or other personal content to train public or third-party AI models, and we do not permit our AI service providers to use your data for their own model training beyond what is strictly necessary to deliver the service to you.

We only collect personal information where we have a clear and legitimate reason. We use it to:

• Create and manage your account and family profile
• Deliver core features: scheduling, task management, meal planning, routines, and shopping lists
• Parse documents and emails you upload or forward to extract events and tasks
• Process voice commands via the Say It Once feature
• Provide weather information based on your location
• Operate the WhatsApp Virtual Concierge
• Sync Planily-generated events to Google or Outlook calendars at your request
• Respond to support enquiries and provide customer service
• Analyse usage patterns to improve features (using anonymised or aggregated data where possible)
• Monitor and maintain the security and stability of our services
• Send important service-related communications
• Conduct internal research and development
• Meet our legal and regulatory obligations

UK GDPR requires us to have a lawful basis for each type of processing. Here is how this applies to Planily:

Our website and web app use cookies and similar technologies to make the service work and to understand how it is used.

Non-essential cookies are only set with your consent. You can change your choices at any time through your browser settings.

We share data only with carefully selected service providers who help us deliver Planily. We do not sell your data to third parties.

All providers are engaged as data processors under written agreements that require them to protect your data and use it only to deliver services to Planily.

Business transfers: If Planily or its assets are acquired, user data may form part of that transfer. Any acquirer would be required to honour this privacy policy or seek fresh consent before changing how data is used.

Law enforcement: We may disclose personal data where required to do so by law, court order, or a valid request from a law enforcement agency or regulator. Where legally able to, we will notify you before disclosing your information.

Some of our service providers process data outside the United Kingdom. Where this occurs, we ensure transfers are protected by appropriate safeguards, such as UK International Data Transfer Agreements (IDTAs), the UK Addendum to the EU Standard Contractual Clauses, or adequacy decisions.

If you would like details of the specific safeguards applied to any international transfer, please contact us using the details in Section 14.

We keep your data only for as long as we need it:

Under UK GDPR, you have eight rights over your personal data. To exercise any of them, contact our Data Protection Officer using the details in Section 14. We will respond within one calendar month and will not charge a fee for reasonable requests.

We apply layered security controls, including encryption in transit and at rest, access controls, least-privilege roles for staff, secure development practices, continuous monitoring, and regular review of our suppliers.

No system is 100% secure. We recommend you use a strong, unique password and enable multi-factor authentication where available in Planily.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected users without undue delay, as required under UK GDPR.

We may update this policy to reflect changes in our service, technology, or the law. When we make material changes, we will notify you by email or in-app message and update the "Last Updated" date at the top of this page.