Privacy Policy

1. Introduction

PlanBatch ("we", "our", "us") is operated by Commerce Consulting Services SIA (registration number 40203320589, VAT LV40203320589), Ganību dambis 11a - 1, Rīga, LV-1045, Latvia. We are the data controller for personal data processed through our web application at planbatch.com (the "Service"). This Privacy Policy explains how we collect, use, share, and protect your personal data, and your rights under the GDPR.

2. Data We Collect

• Account data: email address, display name, and company name (provided during registration or via Google sign-in)
• Content data: templates, images, brand assets, article text, and post copy you create or upload
• Social media tokens: OAuth access tokens for the social accounts you connect (LinkedIn, Facebook, Instagram), and the account or page identifiers needed to publish, stored encrypted at rest
• Usage data: generation counts, plan tier, and feature usage
• Billing data: your plan, subscription identifiers, and the purchase consent record (including timestamp, IP address, and browser information) captured when you buy a paid plan. Payment card details are collected and processed directly by our merchant of record, Freemius, and never reach our servers
• Technical data: browser type, IP address, and device information (collected automatically)

3. Legal Bases for Processing

We process your personal data on the following legal bases under Article 6(1) GDPR:

• Performance of a contract (Art. 6(1)(b)): to create and operate your account, provide the Service, and publish content on your behalf at your direction
• Legal obligation (Art. 6(1)(c)): to keep accounting and tax records
• Legitimate interests (Art. 6(1)(f)): to secure the Service, prevent fraud and abuse, and maintain and improve the Service
• Consent (Art. 6(1)(a)): where we ask for it, such as optional communications; you may withdraw consent at any time

4. How We Use Your Data

• To provide the Service: generating content, managing templates, scheduling and publishing posts
• To authenticate you and manage your account
• To publish content to connected social platforms on your behalf and at your direction
• To enforce usage limits based on your plan
• To secure, maintain, and improve the Service and fix issues

5. Connected Social Accounts and Tokens

When you connect a social media account, the platform gives us an access token that lets us act only within the permissions you granted, namely publishing the posts and first comments you schedule or trigger. We never receive your platform password. Tokens are stored encrypted and used solely to publish content you direct.

We do not read your social media feeds, messages, or contacts, and we do not request access to them. For LinkedIn, we do not store or cache your LinkedIn profile or activity data; we store only the connection token and the account or organisation identifier required to publish. You can disconnect any account at any time in Settings, which revokes our access, and we delete the stored token.

6. Data Storage and Security

Your data is stored with our cloud hosting and database providers in reputable data centres, with encryption at rest. Files are stored with access controlled by row-level security policies. OAuth tokens are stored encrypted at rest. All data transfers use HTTPS/TLS.

7. Data Sharing and Processors

We do not sell your personal data. We share data only with:

• Cloud infrastructure providers (Supabase — database, authentication, and file storage; Vercel — application hosting and cookieless website analytics): used to operate and measure the Service
• Google: authentication, if you choose to sign in with Google
• Freemius, Inc. (merchant of record for paid plans): if you purchase a paid plan, Freemius receives your name, email address, billing country, and VAT number where provided, and processes your payment as the seller of record. Freemius acts as an independent controller for payment processing; see the Freemius privacy policy at freemius.com for details
• Social media platforms (LinkedIn, Meta): only the content you explicitly choose to publish

These providers act as our processors or as independent controllers for the content you publish, and they process your data only as needed to provide their services to us. A current list of our sub-processors is available on request.

8. International Transfers

Some of our providers are located outside the European Economic Area (for example, in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards, such as the EU-US Data Privacy Framework where applicable and the European Commission's Standard Contractual Clauses. You can request more information about these safeguards by contacting us.

9. Data Retention

We retain your account and content data for as long as your account is active. You can delete your generated content, templates, and scheduled posts at any time. OAuth tokens are retained until you disconnect the relevant account or delete your account. Upon account deletion, all associated data is permanently removed within 30 days, subject to any retention required by law. Purchase consent records and billing records are retained for as long as required for accounting obligations and the establishment, exercise, or defence of legal claims.

10. Your Rights (GDPR)

As we are based in the EU (Latvia), you have the following rights:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent at any time, without affecting prior processing

To exercise these rights, contact us at info@planbatch.com. You also have the right to lodge a complaint with the supervisory authority in Latvia, the Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv), or with the authority in your country of residence.

11. Automated Decision-Making

We do not carry out solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

12. Data Deletion

You can request deletion of your data by contacting us at info@planbatch.com or by using the data deletion features within the application. For social media platform data deletion requests, we provide a callback endpoint that platforms can use to notify us, and we delete the associated stored data and tokens.

13. Cookies and Analytics

We use essential cookies only, for authentication and session management. We do not use tracking, advertising, or analytics cookies.

To understand how the Service is used, we run Vercel Web Analytics, which is cookieless: it sets no cookies, does not track you across websites, and does not build a profile of you. It records aggregate page views and referrers, deriving a temporary, non-identifying visitor hash from your request data (such as IP address and browser) that is discarded and cannot be reversed or used to re-identify you. We process this on the legal basis of our legitimate interest (Article 6(1)(f) GDPR) in measuring and improving the Service.

14. Google User Data

If you sign in with Google, we access basic profile information (such as your name and email address) to create and authenticate your account. PlanBatch's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this information or use it for advertising.

15. Changes to This Policy

We may update this Privacy Policy from time to time, including as the Service and its features and integrations evolve. We will notify registered users of significant changes by email. The "Last updated" date above reflects the most recent revision.

16. Contact

For privacy-related inquiries:
Commerce Consulting Services SIA
Email: info@planbatch.com