Privacy Notice

Last updated: June 5, 2026

1. Who we are

GRAPHENE ROCK CAPITAL (trading as PlannasHub) ("we", "us", "our") is the data controller for personal data processed in connection with the PlannasHub platform, websites, APIs and applications (the "Service").

2. Personal data we collect

Account data — name, email, login credentials, profile information, workspace and role.
Content data — content you create, upload or store in the Service (contacts, tasks, projects, proposals, messages, files, AI prompts and outputs).
Communications — support requests, feedback, survey responses.
Usage & telemetry — features used, events, error logs, performance data.
Device & network — device identifiers, browser, operating system, IP address, approximate location derived from IP.
Cookies and similar technologies — see the Cookies section below.

Payment-card data is collected and processed by Paddle as Merchant of Record; we do not store full card numbers.

3. Why we use personal data (purposes) and legal basis

Create and manage your account, and provide the Service — performance of a contract.
Secure the Service and prevent fraud and abuse — legitimate interests.
Provide customer support and respond to enquiries — performance of a contract / legitimate interests.
Improve and develop the Service, including analytics — legitimate interests.
Send service-related notices — performance of a contract.
Send marketing communications, where lawful — consent (you can withdraw at any time).
Comply with legal obligations and enforce our Terms — legal obligation / legitimate interests.

4. Who we share personal data with

Paddle.com — our Merchant of Record, for the sale of the Service, subscription management, payments, tax compliance and invoicing.
Service providers / subprocessors — hosting, database, email delivery, analytics, error monitoring and customer-support tooling, all under written contracts requiring appropriate safeguards.
Professional advisers — legal, accounting and audit advisers, where necessary.
Authorities — where required by law, court order or to protect rights, safety or property.
Successors — in connection with a merger, acquisition or asset sale.

5. International transfers

Where personal data is transferred outside the UK / EEA we rely on appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or adequacy decisions.

6. Retention

We retain personal data only as long as needed for the purposes described above, to comply with legal obligations, resolve disputes and enforce our agreements. Account and content data are deleted or anonymised within a reasonable period after account closure.

7. Your rights

Subject to applicable law (including the UK GDPR / EU GDPR where relevant), you have rights to: access, rectify, erase or restrict processing of your personal data; data portability; object to processing based on legitimate interests; withdraw consent at any time; and lodge a complaint with a data-protection supervisory authority. We will respond within one month.

8. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, role-based permissions, audit logging and regular security reviews. No system is 100% secure.

9. Cookies

We use essential cookies for authentication and security, analytics cookies to understand usage, and marketing cookies only with your consent. You can manage preferences in your browser settings; blocking essential cookies will break parts of the Service.

10. Children

The Service is not directed to children under 16 and we do not knowingly collect their personal data.

11. Changes

We will post material changes here and, where appropriate, notify you by email.

12. Contact

Questions or to exercise your rights: support@plannashub.com.