Privacy Policy
Last updated: Monday, 19 October 2026
This policy explains what information PlanoraHub collects, why we collect it, who we share it with, and what rights you have over it.
PlanoraHub is run by Web Hub Studio, a business name registered in Ontario, Canada ("we"). The owner is accountable for privacy at info@planorahub.com. Send all questions and requests there.
Because we operate from Canada, we handle personal information under Canada's PIPEDA. Users in Serbia also receive the rights given to them by the Serbian Personal Data Protection Act.
This policy applies to every user, wherever they are and whether they read the Serbian or the English version — both mean the same and grant the same rights. If the law of your country gives you more, tell us and we will act on it.
1. What we hold, why, and for how long
| Data | Why | Basis | How long |
|---|---|---|---|
| Account: company name, email, password (stored only as a hash), language; optionally city, address, phone, tax and registration numbers; the dates your account was created, your email confirmed and you last signed in | running your account, building quotes | contract | until you ask us to delete it |
| Sections and items: names, descriptions, notes, due dates | tracking deadlines and sending reminders | contract | until you ask us to delete it |
| Email addresses of reminder recipients who have no account | sending the reminders a user set up | legitimate interest: providing the service the user asked for | while they remain on an item, and at most while that user's account exists |
| Tokens for email confirmation and password reset (hash only) | confirming email, resetting password | contract | at most as long as your account exists |
| IP address in the sign-in attempt counter | protection against abuse | legitimate interest: security | a few minutes to one hour |
| Hosting logs: time, path, response status, device and browser the request came from | running and securing the service | legitimate interest: security | 1 hour |
| Database backups, encrypted | recovery after a failure | legitimate interest | up to 30 days |
| Page statistics: page visited, time, where you came from, approximate location (country and city), device and browser type | seeing which pages are used | legitimate interest | kept in aggregate; the marker for an individual visit is discarded after 24 hours |
Only the company name, email, password and language are required — without them we cannot open an account. Everything else is your choice.
We do not store your password. We keep only a cryptographic hash of it, which cannot be turned back into the password. That is why we cannot tell you your password if you forget it; we can only let you set a new one.
We do not store card or payment details (the service is free), or the quotes and PDF documents you create (they are built in your browser and never sent to our server). The app does not keep the content of the emails it sends.
We send three kinds of email only: email confirmation, password reset, and deadline reminders. We send no marketing email, we do not sell your data and do not share it with others for marketing, and we do no profiling or automated decision-making.
Names, descriptions and notes are free-text fields and we do not check what you put in them. Please do not enter health, religious, political or similar sensitive information.
2. Other people's email addresses
A reminder can go to the address of your employee, colleague or client. We use that address only for the reminders you set up, and for nothing else. For those addresses we are the controller, on the basis of our legitimate interest in providing the service you asked for.
If you enter someone else's address, you are responsible for having a basis to give it to us and for that person knowing about it. Reminders must not be used for marketing or unsolicited messages.
If you receive reminders and have no account with us: your address was entered by one of our users. You have the right to object. Just write to info@planorahub.com from that address, and we will:
- stop sending reminders;
- remove the address from the items it appears on;
- tell the user who entered it;
- on request, tell you who that was.
We act without delay, and within 30 days at the latest. The address may remain in encrypted backups for up to 30 days more; no reminders are sent from backups.
3. Who else sees the data, and where it is
The app runs on other companies' infrastructure, so the following also process data:
| Provider | For what | Where |
|---|---|---|
| Vercel | hosting, logs, page statistics | Ireland (Dublin), plus a global network of servers that deliver the pages |
| Supabase | database | Ireland (European Union) |
| Upstash | attempt counters (IP address) | Ireland (European Union) |
| Asura Hosting | the mail server we send from | United Kingdom (London) |
| GitHub | creating and storing encrypted database backups | United States |
The app and the database run in Ireland, email is sent from a server in the United Kingdom, and in the United States an encrypted backup of the database is created and kept for 30 days through GitHub; only we hold the password that decrypts it. Your data is therefore transferred and processed outside Serbia and outside Canada. While it is there it is subject to that country's laws and may be accessible to its authorities. On request we will tell you what safeguards apply.
Only we have access to the database. We may also hand data to a public authority where the law requires it.
4. Deleting your account
There is no delete button in the app yet. Send a request from your account's email address to info@planorahub.com and we delete the account and everything in it within 30 days.
After that, data may remain in encrypted backups for up to 30 more days. Those copies exist only to restore the service after a failure. From your request to complete deletion, then, up to 60 days may pass.
5. Your rights
You can ask for:
- a copy of your data;
- correction;
- deletion;
- restriction of processing;
- transfer of your data to another provider.
You can also object to processing based on legitimate interest. Most account details you can change yourself in settings.
Everything goes to info@planorahub.com and is free of charge. We answer within 30 days. If a request is complex we may extend that by at most 30 days more and will tell you. We may check that the request is really yours.
If you think we are doing something wrong, tell us first. You can also complain to a supervisory authority:
- Canada: Office of the Privacy Commissioner of Canada, priv.gc.ca
- Serbia: Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, Belgrade, poverenik.rs
- elsewhere: the supervisory authority of your country.
6. Cookies
We use two cookies and both are necessary:
- one keeps you signed in: it lasts 7 days, cannot be read by scripts in your browser and is only sent over an encrypted connection;
- the other remembers whether you use the Serbian or the English version. It is set only if you switch language yourself and lasts until you close your browser.
For page statistics we use Vercel Analytics. It uses no cookies and collects nothing that would let us recognise you — visitors are told apart by a marker computed from the request itself, which is discarded after 24 hours. We have no advertising cookies, no Google Analytics and no social media pixels, and we do not track you across other websites.
7. Security
Passwords are stored only as a cryptographic hash. All traffic travels over an encrypted connection. An email address must be confirmed before an account can be used. The number of sign-in attempts is limited. Backups are encrypted, and only we have access to the database.
No system on the internet is completely secure and we cannot guarantee that unauthorised access will never happen. If it does, we will tell you and the competent authority, as the law requires, and act to limit the harm.
8. Changes
A new version goes on this page with a new date. We will tell you about significant changes by email at least 15 days in advance.