Privacy Policy

1. Information We Collect

Account information: When you create an account, we collect your name, email address, organization name, and role. If you sign in through a third-party provider (e.g. Microsoft Entra ID), we receive the profile information that provider shares.

Workspace data: Content you create within Product Planner — including opportunities, solutions, experiments, assumptions, and notes — is stored to provide the service. This data belongs to you and your organisation.

Newsletter: If you subscribe, we keep your email address, when you subscribed and confirmed, and which page you signed up on. You only get the newsletter after confirming from the email we send, and every issue has a link to unsubscribe.

Usage data: We automatically collect technical information about how you interact with the platform:

• Device & browser: Browser type, operating system, screen resolution, and language preference.
• Interaction data: Pages visited, features used, click patterns, and time spent — all aggregated and anonymised wherever possible.
• Network data: IP address (truncated for analytics), referring URL, and approximate geographic region.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Product Planner service.
• Authenticate your identity and enforce access controls within your workspaces.
• Communicate with you about your account, billing, announcements, and support requests.
• Analyse aggregated usage patterns to improve features, performance, and reliability.
• Detect, prevent, and address technical issues, fraud, and security threats.
• Comply with legal obligations and enforce our Terms of Service.

We do not use your workspace content to train machine-learning models or for advertising purposes.

3. Cookies & Tracking

Product Planner uses cookies and browser storage to keep you signed in and remember your preferences. We categorise them as follows:

• Essential cookies: Required for sign-in, session management and security (for example the appSession session cookie). These cannot be disabled.
• Preferences (browser storage): Your theme, selected workspace and cookie choice are stored in your browser's local storage and never sent to third parties.
• Payment cookies: When you check out, our payment provider Stripe sets the __stripe_mid and __stripe_sid cookies to prevent fraud and process your payment securely. They are only set on the checkout page and are required to complete a purchase.
• Analytics cookies (optional): Microsoft Application Insights sets the ai_user and ai_session cookies, and keeps a short-lived queue of unsent telemetry in your browser's session storage, to help us understand how the platform is used. These are only used if you accept analytics in the cookie banner. Without consent we still collect cookieless usage statistics (pages viewed, which site or campaign link brought you here, and key steps such as signing up or creating a workspace) and technical diagnostics (errors and performance), to understand how the site is used and keep the service reliable. Nothing is stored in your browser for them, they are not used to identify you across sites, and your IP address is only used to derive your country and city.

You can change your choice at any time via Cookie settings in the site footer. We do not use third-party advertising cookies, and we do not participate in cross-site tracking or data broker networks.

4. Data Sharing & Disclosure

We do not sell your personal information. We may share data in the following limited circumstances:

• Service providers: With our two sub-processors, under data processing agreements: Microsoft (Azure hosting, database, file storage, Azure OpenAI, email delivery and monitoring) and Stripe (payments). See Security & data.
• Legal requirements: When required by applicable law, regulation, legal process, or government request.
• Safety: To protect the rights, property, or safety of Product Planner, our users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users.

5. Data Security

We protect your data with these measures:

• Encryption: TLS 1.2 or 1.3 in transit; AES-256 at rest in Azure Cosmos DB and Azure Storage. Application secrets are kept in Azure Key Vault.
• Access control: Role-based access for organizations and workspaces (owner, contributor, reader), checked by the server on every request.
• Sign-in: Passwords are hashed with BCrypt. Sign in with Microsoft and organization SSO use OpenID Connect.
• Monitoring: Errors and service health are monitored in Azure Application Insights.

More detail is on our Security & data page.

6. Data Retention

We retain your account data for as long as your account is active. When you ask us to delete your account, we delete your personal information and workspace content within 30 days. Database backups are kept for at most 8 hours, and usage analytics and logs are deleted automatically after at most 90 days.

Aggregated, anonymised analytics data may be retained indefinitely as it cannot be linked back to individual users.

7. International Data Transfers

Product Planner is hosted in the European Union, on Microsoft Azure in the Sweden Central region. If you access the service from outside the EU, your data is transferred to and processed in EU data centres. Stripe may process payment data outside the EEA; for any such sub-processor transfers we rely on Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request that we limit processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.

To exercise any of these rights, email privacy@product-planner.com from the address registered on your account, or use the contact form and choose Data / Privacy Request. Tell us which right you want to exercise (for example account deletion or a copy of your data). We may ask you to confirm your identity before acting on the request, and we will respond within 30 days. Data copies are provided as a machine-readable JSON export.

9. Children's Privacy

Product Planner is not intended for use by individuals under 16 years of age. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 16, we will delete it promptly.

10. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email or an in-app notification at least 30 days prior to taking effect. Your continued use of the service after changes become effective constitutes acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or complaints about this privacy policy or our data practices, please reach out:

• Email: privacy@product-planner.com
• Data controller: Empowered Technologies Sweden AB, Org.nr 559549-4500, Sweden

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority. In Sweden, that is the Swedish Authority for Privacy Protection (IMY).