Privacy Policy

PlanBrix is operated by Minuk Weerakoon in Sri Lanka. Our website is https://www.planbrix.online. You can contact us at hello@planbrix.online.

This policy explains what personal data we collect, why, who we share it with, and your rights.

What we access

When you sign in with Google, we receive only your name, email address and profile picture (Google scopes: openid, email, profile). We do not access Gmail, Google Drive, Contacts or any other Google data.

How we use it

We use it to create your account and sign you in, to show your name and picture in the app, and to prefill your contact email. Nothing else.

Sharing

We do not sell Google user data, do not use it for advertising, and do not use it to train AI models. It is stored by our authentication and database provider, Supabase, only to run the service. We do not transfer it to anyone else, except as required by law.

Storage and retention

We keep it while your account is active and delete it within 30 days after you delete your account (backups are kept for up to 90 days).

Revoking access

You can remove PlanBrix's access to your Google account at https://myaccount.google.com/permissions, and request deletion of your data at hello@planbrix.online.

Limited Use

PlanBrix's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your account

Your name, email address and profile picture from Google sign-in (see Google user data).

Your business profile

Your business name, contact details, address and logo.

Data you enter about your clients

Names, email addresses, phone numbers, postal addresses and tax IDs of your clients and their contacts, as you choose to enter them.

Your work in PlanBrix

• Projects, items and deliverables, tasks, invoices and invoice templates, and payment records.
• Logs of emails sent through PlanBrix: recipient, subject and delivery status.
• Calendar feed settings.

Pola, the AI assistant (Pro and Premium)

When you use Pola, your voice recordings and typed messages are sent to an AI model provider (Google Gemini, directly or through OpenRouter) to be understood, together with the workspace data Pola needs to help (such as client names, contacts and your rate card). Recordings are sent only while you record and are never stored by us. Pola's transcripts and drafts are kept for 7 days so it can follow the conversation, then deleted automatically. You can delete your Pola history at any time in Settings.

Technical data

Server logs, IP addresses and device and browser information, used to keep the service secure and working.

• To provide PlanBrix and its features to you.
• To send the emails you ask us to send to your clients, such as invoices and payment reminders.
• To keep the service and your account secure and prevent abuse.
• To answer your questions and provide support.
• To understand how PlanBrix is used and improve it.

For data about your clients and contacts, you decide what is collected and why. You are responsible for having a lawful basis to collect it and to share it with us. We process that data on your behalf, only to provide PlanBrix to you.

We use trusted providers to run PlanBrix. They process data only to provide their service to us:

• Supabase: database, authentication and file storage (such as your logo).
• Vercel: hosting.
• Resend: delivery of the emails you send to your clients.
• Google: sign-in (see Google user data).
• OpenRouter and the AI model provider it routes to (for example Google Gemini): understanding your voice and messages, only when you use Pola, the AI assistant. Audio is not stored by us; Pola transcripts are kept for 7 days.

Planned, when these features launch:

• PayHere: subscription payments, when billing starts.

We do not sell your personal data.

Our providers may store or process data outside Sri Lanka. When they do, we rely on their contractual commitments and security measures to protect it.

We keep your data while your account is active. After you delete your account, we delete your data within 30 days, except for backups, which are kept for up to 90 days, and records we must keep by law. Pola transcripts and drafts are deleted after 7 days; Pola voice recordings are never stored.

• Data is encrypted in transit (HTTPS).
• Access controls, including database row-level security, so each account only sees its own data.
• Least-privilege access for the systems that run PlanBrix.

Under Sri Lanka's Personal Data Protection Act No. 9 of 2022, you can ask to access, correct or delete your personal data, object to how we use it, withdraw your consent, and receive a copy of your data.

To use these rights, contact hello@planbrix.online. We may need to confirm your identity first. If you are one of our users' clients, please contact that user first, since they decide how your data is used.

PlanBrix is not for anyone under 18, and we do not knowingly collect their data.

We only use essential cookies and browser storage. See our Cookie Policy.

We may update this policy. For material changes we will let you know, for example by email or in the app.

Questions about privacy, or want to use your rights? Contact Minuk Weerakoon at hello@planbrix.online or visit https://www.planbrix.online.