Privacy Policy

Last updated: September 11, 2026

1. Introduction

PlanBatch ("we", "our", "us") is operated by Commerce Consulting Services SIA (registration number 40203320589, VAT LV40203320589), Ganību dambis 11a - 1, Rīga, LV-1045, Latvia. We are the data controller for personal data processed through our web application at planbatch.com (the "Service"). This Privacy Policy explains how we collect, use, share, and protect your personal data, and your rights under the GDPR.

2. Data We Collect

  • Account data: email address, display name, and company name (provided during registration or via Google sign-in)
  • Content data: templates, images, brand assets, article text, and post copy you create or upload. If you connect a website (see below), this also includes the post titles, excerpts, links and images that site sends us
  • Connected websites: if you connect a site to PlanBatch (for example with our WordPress plugin), we store the site's address and name, and an API key for it. The key is stored hashed; we keep only a short prefix so you can recognise it in Settings, along with when it was last used. You can revoke a key at any time from Settings
  • Images fetched from a connected site: when a connected site shares a post, we download the images it references and store our own copy. We do this rather than linking to your site so that a post already scheduled still publishes with its image if the original is later moved or deleted
  • Social media tokens: OAuth access tokens for the social accounts you connect (LinkedIn, Facebook, Instagram, Pinterest), and the account or page identifiers needed to publish, stored encrypted at rest
  • Usage data: generation counts, plan tier, and feature usage
  • How you found us: when you create an account we attach to it the domain of the website that linked you to us (for example google.com, never the full address and never any search terms), the path of the first page of ours you opened, and any campaign tags that were in the link you followed. We keep this so we can tell which pages and which sources actually help people find PlanBatch. The cookie that carries it is described in section 13
  • Billing data: your plan, subscription identifiers, and the purchase consent record (including timestamp, IP address, and browser information) captured when you buy a paid plan. Payment card details are collected and processed directly by our merchant of record, Freemius, and never reach our servers
  • Mailing list: if you give us your email address on our website without creating an account, we store that address and which page you gave it on. This is separate from an account; you can ask us to remove it at any time using the contact address below
  • Email preference record: if you opt in to hearing from us about PlanBatch, we store that choice together with the exact wording you were shown, when you made it, and the IP address and browser information at the time. We keep the same record when you opt back out, so that both the permission and its withdrawal can be evidenced
  • Technical data: browser type, IP address, and device information (collected automatically)

3. Legal Bases for Processing

We process your personal data on the following legal bases under Article 6(1) GDPR:

  • Performance of a contract (Art. 6(1)(b)): to create and operate your account, provide the Service, and publish content on your behalf at your direction
  • Legal obligation (Art. 6(1)(c)): to keep accounting and tax records
  • Legitimate interests (Art. 6(1)(f)): to secure the Service, prevent fraud and abuse, and maintain and improve the Service
  • Consent (Art. 6(1)(a)): where we ask for it, such as optional communications; you may withdraw consent at any time

4. How We Use Your Data

  • To provide the Service: generating content, managing templates, scheduling and publishing posts
  • To authenticate you and manage your account
  • To publish content to connected social platforms on your behalf and at your direction
  • To enforce usage limits based on your plan
  • To email you about PlanBatch, such as tips on using it and announcements of new features, where you have opted in. We ask separately for this and never assume it from having an account: you can withdraw at any time from your settings or from the unsubscribe link in any such email, and it stops immediately
  • To send you emails your account needs, such as confirming your address, resetting your password, and telling you when a scheduled post failed or a connection is about to expire. These are part of providing the Service, are not marketing, and are not affected by your email preference
  • To secure, maintain, and improve the Service and fix issues

5. Connected Social Accounts and Tokens

When you connect a social media account, the platform gives us an access token that lets us act only within the permissions you granted, namely publishing the posts and first comments you schedule or trigger. We never receive your platform password. Tokens are stored encrypted and used solely to publish content you direct. Access tokens are issued and controlled by the connected platform: they can expire or be revoked by the platform or by you at any time, and keeping a connection current is your responsibility.

We do not read your social media feeds, messages, or contacts, and we do not request access to them. For LinkedIn, we do not store or cache your LinkedIn profile or activity data; we store only the connection token and the account or organisation identifier required to publish. You can disconnect any account at any time in Settings, which revokes our access, and we delete the stored token.

6. Data Storage and Security

Your data is stored with our cloud hosting and database providers in reputable data centres, with encryption at rest. Files are stored with access controlled by row-level security policies. OAuth tokens are stored encrypted at rest. All data transfers use HTTPS/TLS.

7. Data Sharing and Processors

We do not sell your personal data. We share data only with:

  • Cloud infrastructure providers (Supabase — database, authentication, and file storage; Vercel — application hosting and cookieless website analytics): used to operate and measure the Service
  • Google: authentication, if you choose to sign in with Google
  • Freemius, Inc. (merchant of record for paid plans): if you purchase a paid plan, Freemius receives your name, email address, billing country, and VAT number where provided, and processes your payment as the seller of record. Freemius acts as an independent controller for payment processing; see the Freemius privacy policy at freemius.com for details
  • Social media platforms (LinkedIn, Meta, Pinterest): only the content you explicitly choose to publish

These providers act as our processors or as independent controllers for the content you publish, and they process your data only as needed to provide their services to us. A current list of our sub-processors is available on request.

8. International Transfers

Some of our providers are located outside the European Economic Area (for example, in the United States). Where personal data is transferred outside the EEA, we rely on appropriate safeguards, such as the EU-US Data Privacy Framework where applicable and the European Commission's Standard Contractual Clauses. You can request more information about these safeguards by contacting us.

9. Data Retention

We retain your account and content data for as long as your account is active. You can delete your generated content, templates, and scheduled posts at any time. OAuth tokens are retained until you disconnect the relevant account or delete your account. Upon account deletion, all associated data is permanently removed within 30 days, subject to any retention required by law. Purchase consent records and billing records are retained for as long as required for accounting obligations and the establishment, exercise, or defence of legal claims.

An email address given to us on our website without an account is kept until you ask us to remove it, or until we stop using the mailing list it was given for, whichever comes first.

Two kinds of short-lived record are deleted on a schedule rather than when you delete your account, because they are not tied to an account at all. Requests to rate limit our API record the calling site's address and IP address for one minute at a time, and an unfinished request to connect a site records that site's address and name. Both are deleted automatically after 24 hours by a daily job.

10. Your Rights (GDPR)

As we are based in the EU (Latvia), you have the following rights:

  • Right to access your personal data
  • Right to rectification of inaccurate data
  • Right to erasure ("right to be forgotten")
  • Right to restrict or object to processing
  • Right to data portability
  • Right to withdraw consent at any time, without affecting prior processing

To exercise these rights, contact us at info@planbatch.com. You also have the right to lodge a complaint with the supervisory authority in Latvia, the Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv), or with the authority in your country of residence.

11. Automated Decision-Making

We do not carry out solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

12. Data Deletion

You can request deletion of your data by contacting us at info@planbatch.com or by using the data deletion features within the application. For social media platform data deletion requests, we provide a callback endpoint that platforms can use to notify us, and we delete the associated stored data and tokens.

13. Cookies and Analytics

We use essential cookies for authentication and session management, one preference cookie that remembers your chosen colour theme so the correct one is shown as the page loads, and one measurement cookie described below. We do not use advertising cookies, and we do not track you across other websites.

To understand how the Service is used, we run Vercel Web Analytics, which is cookieless: it sets no cookies, does not track you across websites, and does not build a profile of you. It records aggregate page views and referrers, deriving a temporary, non-identifying visitor hash from your request data (such as IP address and browser) that is discarded and cannot be reversed or used to re-identify you. We process this on the legal basis of our legitimate interest (Article 6(1)(f) GDPR) in measuring and improving the Service.

When you first arrive we set a single first-party cookie (pb_src) that lasts 30 days. It records the domain of the website that linked you to us, the path of the first page of ours you opened, and any campaign tags in the link you followed. It contains nothing that identifies you, is never shared with anyone else, and is not used for advertising or to follow you across other websites. If you create an account, those values are attached to it so we can see which pages and sources help people find us; if you do not create an account, the cookie simply expires. We process this on the legal basis of our legitimate interest (Article 6(1)(f) GDPR) in understanding how people find the Service.

14. Google User Data

If you sign in with Google, we access basic profile information (such as your name and email address) to create and authenticate your account. PlanBatch's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this information or use it for advertising.

15. Changes to This Policy

We may update this Privacy Policy from time to time, including as the Service and its features and integrations evolve. We will notify registered users of significant changes by email. The "Last updated" date above reflects the most recent revision.

16. Contact

For privacy-related inquiries:
Commerce Consulting Services SIA
Email: info@planbatch.com