Privacy Policy

Until the operating company is registered, the controller is Panteleimon Thomaidis, contact info@planest.app. On registration of the Estonian company being established to operate Planest, it becomes the controller and this clause will be updated.

• Account data — name, business email, password (stored only as a secure hash), account category, company name, country.
• Profile and business data — company details, description, logo, addresses, website, authorisation numbers, contact person's name, telephone, email and photograph where you provide them, aircraft and fleet details.
• Postings — requests and availability you publish, including routes, dates, capacity and free text.
• Messages — what you send to other members through the platform.
• Subscription and credits — your package, free period, credit balance and how credits were spent. Card details are never seen or held by us; payment is handled by our payment provider.
• Usage data — how the platform is used: pages viewed, posts opened, matches shown, clicks on promotions, and technical data such as IP address, browser and device.
• Correspondence — what you write to us, and our replies.

We rely on one of the following, depending on the purpose:

• To perform our contract with you — creating and running your account, publishing your postings, matching, messaging, managing your subscription and credits, and supporting you.
• Our legitimate interests — keeping the platform secure and free of abuse, understanding how it is used so we can improve it, developing features including matching and search, and telling existing members about the service. We balance these against your interests, and you may object (clause 8).
• Legal obligation — accounting and tax records, and responding to lawful requests.
• Consent — where we ask for it, for example for optional analytics or for using a photograph of an identifiable person. You may withdraw consent at any time.

Planest exists so that businesses can find one another. Your company profile, aircraft and postings are visible to other members, and in part to anyone visiting the site, including people who are not signed in. Business contact details you publish are visible in the same way. Please do not put anything in a profile or posting that you would not want seen publicly.

We do not sell personal data. We share it only with those who help us run Planest, under contract and only as needed:

• Supabase — database, authentication and file storage, hosted in South Korea (Seoul).
• Our hosting and content-delivery providers — to serve the site.
• Cloudflare — a bot check (Turnstile) on sign-up and sign-in, which helps keep automated abuse out. It processes technical data such as your IP address and browser details.
• Our email provider — to send account and service emails.
• Paddle — payment processing, once paid subscriptions begin. Paddle acts as merchant of record and handles card data; we never receive it.
• Professional advisers and authorities — where the law requires, or to establish or defend legal claims.

Our database, sign-in and file storage are hosted in South Korea. The European Commission has decided that South Korea provides an adequate level of data protection. Where a provider processes data elsewhere outside the EEA, we rely on an adequacy decision or on Standard Contractual Clauses approved by the European Commission, together with appropriate safeguards.

• Account, profile and posting data: while your account is open, and up to 12 months after closure, so an account can be restored and disputes resolved.
• Messages: while your account is open, and up to 12 months after closure.
• Accounting and tax records: 7 years, as required by law.
• Usage and technical logs: normally up to 24 months.
• Correspondence: up to 3 years after the matter is closed.

Content you published and others have shared, or which appears in material already issued, may persist beyond these periods where withdrawal is not reasonably possible.

Under the GDPR you may ask us to:

• give you a copy of your personal data, or provide it in a portable form;
• correct data that is wrong or incomplete;
• delete data, where there is no continuing basis to keep it;
• restrict how we use it, or object to use based on legitimate interests — including profiling and use of your content for developing or training models;
• withdraw consent where we relied on it, without affecting what was done beforehand.

Write to info@planest.app. We answer within one month. You may also complain to a supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon), or the authority where you live or work.

We use cookies and similar technologies that are strictly necessary to run the site — keeping you signed in and keeping the platform secure, including the bot check on sign-up and sign-in. These do not require consent.

• Service messages — account confirmations, password resets, notifications you have chosen, and important changes — are part of running your account and are not marketing.
• Marketing emails about Planest are sent on the basis of legitimate interest to business contacts, or with consent where required. Every marketing email carries a one-click unsubscribe, and you may also object at any time by writing to us.

We use encryption in transit, hashed passwords, access controls and hosting with reputable providers. No system is perfectly secure; if a breach occurs that is likely to put your rights at risk, we will notify you and the supervisory authority as the law requires.

Planest is a business platform and is not intended for anyone under 18. We do not knowingly collect data about children.

We may update this policy. If a change materially affects how we use your data, we will tell you by email or through the platform at least 15 days before it takes effect. The version and date at the top always show the current one.

Panteleimon Thomaidis · info@planest.app