Privacy Policy

Effective date: 2026-10-20

This policy explains how the Planify application processes personal data, including data obtained from Google APIs, when you use it to plan visits in Google Calendar and send SMS reminders to your clients.

1. Data controller and contact

The application is operated by Łukasz Bieszczad, <adres ukryty> (the “Operator”). For any privacy matters contact us at [email protected].

2. Data we process

2.1. Users of the application

• Google account data: e-mail address and name (Google sign-in with the openid, email and profile scopes).
• Registration form data: full name and phone number.
• Phone number confirmation: we send an SMS with a one-time code to the number you provide. We store only a hash of the code (not the code itself), the number, the time it was sent and the number of attempts – to confirm the number and prevent abuse.
• Google OAuth tokens (access token, refresh token and their expiry time), needed to access your calendar, also when you are not signed in (sending reminders).
• Account data: role, account status (pending, active, blocked), the reason for blocking the account if the administrator blocks it, creation and modification dates.
• Acceptance of the Terms: the date and the version (effective date) of the Terms accepted with the registration.
• Packages and payments: the chosen package, its price, validity and SMS usage, and the time of the request to start the service before the withdrawal period ends. For payments by bank transfer: the data of the transfer (payer, account number, amount, title) in the Operator’s bank account history and sales records.

2.2. Google Calendar data

• Events from your primary calendar (title, start and end time, description, location, reminders) – read to display them in the application.
• Events are created, changed and deleted only on your explicit action in the application, or when your client answers through the link in the SMS reminder: a confirmed visit is marked green, a cancelled one is deleted.
• In events created or edited in the application we store additional hidden fields (private extended properties): the client’s phone number, the client identifier, the SMS reminder time and whether the client confirmed the visit.

2.3. Your clients’ data

• Client name and phone number that you enter in the application.
• SMS queue entries: the client’s phone number, visit date and time, visit title and location, sending status and the SMS gateway message identifier.
• Answers from the links in SMS reminders: the client’s name, the visit date and time and whether the client confirmed or cancelled it, and your notifications about them in the application. The link page shows the client only the date, time and place of the visit.

2.4. Technical data

• Server logs: requested address, time, response code and error details, used to keep the service running and secure.

3. How we use data from Google APIs

• We do not sell Google user data and do not use it for advertising.
• We do not use Google user data to develop, improve or train generalised AI or machine learning models.
• We transfer Google user data to third parties only as described in section 5, to provide the features you use.
• People do not read your calendar data, unless you ask us to (e.g. support), it is necessary for security purposes or required by law.
• You can revoke the application’s access at any time at myaccount.google.com/permissions.

4. Purposes and legal bases

• Providing the service – account, calendar, client list, SMS reminders (Art. 6(1)(b) GDPR – performance of the contract).
• Security, error diagnostics and handling of requests (Art. 6(1)(f) GDPR – legitimate interest).
• Proof of the contract and of your statements (acceptance of the Terms, request to start the service), establishing and defending claims (Art. 6(1)(f) GDPR – legitimate interest).
• Issuing and keeping sales documents and handling complaints (Art. 6(1)(c) GDPR – legal obligation).
• Your clients’ data: you are the controller of your clients’ data and the Operator processes it on your behalf as a processor (Art. 28 GDPR) under the Terms of Service, only to store the client list and send SMS reminders.

Providing the data is voluntary, but without it you cannot create an account and use the Service.

5. Recipients of data

• Google LLC – sign-in and Google Calendar (data exchanged with your calendar).
• Digital Virgo Polska Sp. z o.o. (JustSend SMS gateway, Warsaw) – the client’s phone number and the SMS content (date, time and location of the visit, and the link to confirm or cancel it), the user’s phone number with the client’s name when a client cancels a visit, and during registration the user’s phone number and the verification code.
• Functional Software, Inc. (Sentry) – technical reports of application errors (error messages and the address of the page where the error occurred), stored in the European Union. Phone numbers and e-mail addresses are masked before sending.
• mikr.us (hosting) – the server the application runs on and the database.
• Cloudflare, Inc. – the network the traffic to the application passes through: the IP address of the browser and the content of the requests, including the pages of the links in SMS messages.

Google, Cloudflare and Sentry may process data outside the European Economic Area; such transfers are based on the EU–US Data Privacy Framework or standard contractual clauses.

6. Retention

• Account data (with the acceptance of the Terms and the packages) and client data – while your account exists. You can delete the account yourself in “Moje konto” (My account) or ask us to – then we delete it without undue delay, no later than within 14 days.
• The SMS queue – pending messages until they are sent; sent and cancelled ones for 90 days.
• Links in SMS reminders, the client answers and your notifications about them – 90 days after the visit.
• Phone verification codes – 7 days.
• A rejected registration is deleted immediately.
• Calendar events are not copied permanently to our database – except the data in the SMS queue described in section 2.3.
• Server logs – up to 31 days; error reports in Sentry – up to 90 days.
• Sales documents – 5 years from the end of the year in which the tax payment deadline passed (tax law).
• Database backups (made before every update of the application, the last 14 are kept) – deleted data disappears from them as they are overwritten.

7. Your rights

You have the right to access, rectify, erase and restrict processing of your data, to data portability and to object. Send requests to [email protected]. You may also lodge a complaint with the supervisory authority – in Poland the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw.

8. Cookies

We use only cookies necessary for the application to work. We do not use analytics or marketing cookies.

9. Security

The application uses an encrypted connection (HTTPS), access to the database is restricted, and administrators can block accounts. Access to the application is granted only to accounts activated by an administrator. Google tokens are stored in the database encrypted.

10. Did you receive an SMS from Planify?

The controller of your data (name, phone number, date of the visit) is the business or person you have the visit with – they entered it into Planify, so send your requests to them (e.g. to delete your number). The Operator of Planify processes the data on their behalf, only to send the reminders and to handle the link for confirming or cancelling the visit. If you received an SMS you did not expect, or one with illegal content, write to us at [email protected] (Terms, section 6).

11. Changes

We will publish changes to this policy on this page and update the effective date.