Privacy Notice

This notice explains what personal data Thinking Plans collects, why we collect it, how long we keep it, who else touches it, and what you can make us do about it. It covers the website, the planning engine, share links and exports.

We apply one standard everywhere rather than the minimum each country allows. That means data minimisation by default, purpose limitation, no sale or sharing of personal data, no advertising profiling, and the same export and deletion rights for every user regardless of where they live.

Where a specific law gives you stronger rights than this notice describes, that law wins and we will honour it.

We do not ask for special-category data (health, biometrics, beliefs, sexual orientation) or government identifiers, and we ask you not to upload them. If your planning material contains personal data about other people — staff, customers, investors — you are the controller of that material and must have a lawful basis for including it.

We do not run advertising trackers, we do not build behavioural profiles, and we do not make automated decisions that produce legal or similarly significant effects about you.

To generate a document we send the relevant parts of your profile, brief, uploads and scan results to a large-language-model provider acting as our processor. To research your market we send derived search queries — not your raw profile — to a public web search service.

• Model providers are contractually barred from using your content to train their models.
• Prompts and completions are retained by providers only for the short abuse-monitoring period their terms require, then deleted.
• We send the minimum context a section needs, not your whole library.
• Search queries are derived from business attributes (industry, region, market) rather than personal identifiers.

Two of these are self-service and immediate, from your account page: download everything we hold in one machine-readable file, and permanently delete your account and its contents. We think rights you have to request are weaker than rights you can simply exercise.

• Access — obtain a copy of your data. Self-service export.
• Portability — receive it in a structured, commonly used, machine-readable format. The export is JSON.
• Erasure — delete your account and content. Self-service, immediate, irreversible.
• Rectification — correct inaccurate data by editing your profile, or ask us.
• Restriction and objection — ask us to pause or stop processing based on legitimate interests.
• Withdraw consent — change your cookie choice at any time from the footer, without affecting prior lawful processing.
• Non-discrimination — exercising any right never degrades the Service you receive.
• Complain — to your local data-protection or privacy authority, at any time, without contacting us first.

Where you ask us to act rather than doing it yourself, we respond within 30 days and never charge for a first request. We may ask you to confirm control of your account email before acting on a request.

Our infrastructure, model providers and search providers operate across multiple countries, so your data may be processed outside the country where you live. Where data leaves a jurisdiction that restricts transfers, we rely on recognised safeguards — adequacy decisions where they exist, otherwise standard contractual clauses with the receiving processor, together with encryption in transit and at rest.

Each is bound by a written processing agreement, may act only on our documented instructions, and may not use your data for their own purposes. We do not sell personal data, we do not share it for cross-context behavioural advertising, and we have never received payment for access to it.

If our business is ever sold or reorganised, your data may transfer to the successor — bound by this notice, with advance notice to you and the chance to delete your account first.

• Traffic is encrypted in transit; stored data is encrypted at rest by our platform provider.
• Row-level access rules mean one account cannot read another account's profiles or plans, enforced in the database rather than only in the interface.
• Share links are unguessable identifiers, served read-only, revocable instantly by the owner.
• Access to production data by our people is limited to what is needed to fix a reported fault.

No system is perfectly secure. If a breach is likely to result in a risk to your rights, we will notify you and the relevant authority without undue delay, and tell you what happened and what to do.

The Service is not directed at children under 16. We do not knowingly collect their data; if we learn we have, we delete it. Educational users below that age should access the Service through an institution that has obtained the necessary consents.

We version this notice and show its effective date. Material changes are announced in the product at least 14 days before they take effect, so you can export or delete first if you disagree.

Privacy questions and rights requests can be raised through the contact route published in the product; we answer within 30 days. You may also complain directly to the privacy regulator where you live, whether or not you have contacted us.