Privacy Policy

Last updated:

Privacy Policy — PlacidPlan

Effective Date: October 20, 2025
Last Updated: October 20, 2026

This Privacy Policy explains what personal information PlacidPlan (“PlacidPlan“, “we“, “us“, or “our“) collects, why we collect it, how we protect and share it, and the choices and legal rights you have.

PlacidPlan is operated by Ascentir Management Consultancies FZCO, a company registered in the United Arab Emirates with its registered office at Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. If you have any questions about this Policy or our privacy practices, please reach us through our Contact Page.

Roles: Data Controller vs. Data Processor

Depending on how you interact with PlacidPlan, we act in two distinct capacities under applicable data protection laws, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the European Union / United Kingdom General Data Protection Regulation (GDPR):

  • Data Controller: We act as the Data Controller for the personal information of our direct account holders, workspace owners, and website visitors (such as your account registration details, subscription billing records, and support inquiries).
  • Data Processor: When you store third-party information inside your workspace—such as client names, client email addresses, invoice drafts, contractor payout details, project tasks, or client review annotations—you (or your organization) are the Data Controller, and we act strictly as a Data Processor operating on your instructions.

1. Information We Collect

1.1 Account Information

When you create a PlacidPlan account, we collect your name, email address, and workspace name. Your password is stored exclusively as a cryptographic one-way hash by WordPress; we cannot read or retrieve your plaintext password. When team members, external freelancers, or clients join a workspace or access a passwordless Client Portal, we record their display name, email address (where applicable), and assigned role or sign-off activity.

1.2 Workspace Content, Projects, and Invoicing

We store the content you create, upload, or manage within your workspace so that it can be returned to you, your authorized workspace collaborators, or the external apps you explicitly connect:

  • Tasks and Project Boards: Task titles, descriptions, statuses, Kanban/calendar schedules, due dates, and per-card editing session timers.
  • Contracts and Invoice Drafts: Client names, client email addresses, service descriptions, line-item amounts, currencies, e-signature logs, and invoice statuses that you enter or generate.
  • Client Portals and PlacidDrive Assets: Media files uploaded to PlacidDrive (such as video cuts, raw footage, LUTs, audio stems, and brand kits), version stacks, frame-accurate review comments, on-frame annotations, and client approval sign-off logs.

Each workspace is logically isolated and tied to your account. Workspace content is returned only to you, the collaborators or client guests you invite, or the connected applications you explicitly authorize.

1.3 Purchases and Billing

When you purchase a plan (such as our Solo, Creator, Studio, or Unlimited Agency tiers on PlacidPlan Pricing), we keep an order record containing the selected plan, billing cycle (one-time monthly or annual), price, currency, transaction date, and the billing details entered at checkout (such as billing name, billing address, and tax/VAT identification number where applicable).

All card payments and contractor payouts are processed directly by Stripe. We do not collect or store full credit or debit card numbers on our servers.

1.4 Contact and Support Messages

When you submit an inquiry through our Contact Page, your name, email address, selected topic, and message content are delivered directly to our support team by email so we can respond to you (typically within one business day). Contact form messages are not stored in our public website database.

1.5 Connected AI Apps (MCP Server) and PlacidAI

PlacidPlan allows you to connect external AI assistants (such as Claude, ChatGPT, Claude Code, Cursor, or custom Model Context Protocol clients) to our MCP endpoint (https://placidplan.com/mcp) as documented on our Developer Page, and provides built-in PlacidAI workspace tools:

  • Connection Metadata: When you connect an external AI app via OAuth 2.1 with PKCE (S256) or a personal access token, we record the application name, the specific permission scopes you approved (workspace:read for viewing workspace summaries, tasks, and invoice drafts; workspace:write for creating, updating, or deleting tasks), and the timestamp when the connection was last used.
  • Hashed Credentials & Token Rotation: Access tokens and personal tokens are stored strictly as one-way cryptographic hashes. OAuth access tokens expire after 1 hour, and refresh tokens rotate on every use. Changing your account email address or password immediately revokes all active tokens and disconnects all linked AI apps.
  • Zero AI Model Training: Neither PlacidPlan nor our underlying AI inference providers use your workspace content, tasks, invoice drafts, uploaded media, or AI prompts/outputs to train, fine-tune, or improve generalized artificial intelligence or machine learning models.
  • External AI Agent Policies: When an AI assistant you connected requests workspace data on your behalf, we return only the data covered by your approved scopes. Once that information is delivered to your external AI client, the AI provider’s own privacy policy and terms govern how that client stores or processes the response.

1.6 Technical and Rate-Limiting Information

To protect sign-in, registration, contact forms, and REST/MCP API endpoints (including our 300-requests-per-5-minutes MCP rate limit) against brute-force attacks and automated abuse, we maintain short-lived counters derived from your IP address stored as salted cryptographic hashes for a few minutes. Our cloud infrastructure and hosting providers also maintain standard, access-restricted server logs (such as IP address, request timestamp, HTTP status code, and user-agent string) for network security, diagnostics, and uptime monitoring.

2. How We Use Information

We use personal information strictly for the following purposes:

  • Service Delivery: To provision and operate your account, workspace, project boards, PlacidDrive storage, Client Portals, PlacidAI features, and connected MCP integrations.
  • Payments and Accounting: To process plan purchases, facilitate payouts, issue receipts, and maintain statutory tax and accounting records.
  • Transactional Service Emails: To send essential operational communications, including account verification links, passwordless sign-in links, password reset tokens, security alerts, and invoice or review notifications that you explicitly choose to send. We do not send unsolicited third-party promotional spam.
  • Customer Support: To investigate, troubleshoot, and respond to questions or requests submitted through our Contact Page.
  • Security and Abuse Prevention: To enforce rate limits, verify OAuth 2.1 / PKCE sessions, detect fraud or unauthorized access, and maintain the integrity of our infrastructure.

Where the EU/UK GDPR, the UAE Personal Data Protection Law, or similar data protection laws apply, we process your personal information on the following lawful bases:

  • Performance of a Contract: To provide the PlacidPlan services, workspaces, and plans you have registered for or purchased.
  • Legitimate Interests: To secure our platform, prevent abuse and fraud, enforce rate limits, and maintain reliable service operations.
  • Consent: When you explicitly authorize a third-party AI application via OAuth, connect an external integration, or submit a voluntary support inquiry (which you may withdraw at any time).
  • Legal Obligations: To comply with mandatory tax, accounting, and financial record-keeping laws in the United Arab Emirates and applicable jurisdictions.

3. How We Share Information

We do not sell, rent, or trade your personal information to third parties, and we do not share your information for cross-context behavioral advertising. We share personal information only with trusted service providers (sub-processors) necessary to operate PlacidPlan, bound by strict confidentiality and data protection terms:

Category Provider / Recipient Purpose of Processing
Payment Processing Stripe Processing checkout payments, subscription billing, fraud prevention, and contractor payouts.
Cloud Hosting & Storage Managed Cloud Infrastructure & CDN Providers Hosting the PlacidPlan web application, database, and PlacidDrive media storage with encryption in transit and at rest.
Transactional Email Enterprise SMTP / Transactional Email Providers Delivering sign-in links, password resets, account notices, and user-triggered invoice or review emails.
Connected AI Apps (MCP) User-Authorized AI Clients (e.g., Claude, ChatGPT, Cursor) Receiving workspace tasks and invoice drafts strictly within the workspace:read or workspace:write scopes you explicitly approve.
Optional Integrations User-Connected Platforms (e.g., Google Drive, YouTube, Trello, Asana, ClickUp, Notion) Importing boards/assets or syncing media only when you actively initiate a migration or integration sync.

We may also disclose personal information if required to do so by applicable law, regulation, subpoena, or court order, or when reasonably necessary to protect the vital rights, property, and safety of our users, the public, or PlacidPlan. If Ascentir Management Consultancies FZCO is involved in a merger, acquisition, or asset sale, we will notify account holders before personal information is transferred or becomes subject to a different privacy policy.

4. Cookies and Local Storage

PlacidPlan uses only strictly necessary cookies required for authentication, session security, and checkout functionality. We do not use advertising pixels, behavioral tracking cookies, or third-party analytics cookies.

Cookie Name Type Purpose Duration / Expiration
wordpress_logged_in_* Strictly Necessary Recognizes authenticated users and maintains your active workspace sign-in session. Session / up to 14 days (if “Remember Me” is selected)
wordpress_sec_* Strictly Necessary Secures authenticated session credentials over encrypted HTTPS connections. Session / up to 14 days
wordpress_test_cookie Strictly Necessary Verifies whether your web browser is configured to accept essential cookies at sign-in. Session (deleted when browser closes)
pp_guest Strictly Necessary Protects sign-in and registration forms against cross-site request forgery (CSRF) and automated bot abuse for unauthenticated visitors. Session (deleted when browser closes)
pp_pending_auth Strictly Necessary Carries a temporary state token for passwordless sign-in links or password-reset requests. Up to 15 minutes
woocommerce_*, wp_woocommerce_session_* Strictly Necessary Maintains plan selection, cart state, and checkout session integrity during plan purchases. Session / up to 48 hours

5. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy and comply with statutory obligations:

  • Account and Workspace Data: Retained while your account remains active. If you delete a task, invoice draft, or workspace, or request account deletion, we remove the data from active production systems promptly (with encrypted system backups overwritten within 30 to 90 days).
  • Order, Billing, and Tax Records: Retained for 7 years following the end of the relevant tax period to comply with mandatory corporate tax and accounting record-keeping obligations under Article 56 of UAE Federal Decree-Law No. 47 of 2022 and UAE Federal Decree-Law No. 28 of 2022.
  • Connected AI App Authorizations: OAuth access tokens expire automatically after 1 hour, and connection records end immediately when token authorization expires, when you disconnect the app from your account settings, or when you change your email address or password.
  • Security and Rate-Limit Counters: Salted IP hash counters expire automatically within a few minutes (typically 5 to 15 minutes).

6. Your Rights and Choices

Regardless of your location—and specifically under the UAE PDPL, EU/UK GDPR, and CCPA—you have the following rights regarding your personal information:

  • Self-Service Account Controls: You can update your name, email address, and password at any time on your account settings page, and view or revoke connected AI apps (MCP tokens) directly from your dashboard.
  • Access and Data Portability: You may request a copy of your personal information and workspace data in a structured, machine-readable format (and you can also retrieve your tasks and invoice drafts at any time via our MCP & API tools).
  • Correction (Rectification): You may update inaccurate or incomplete personal information directly in your account or by contacting us.
  • Deletion (Erasure): You may request permanent deletion of your account and workspace content, subject only to our statutory obligation to retain transaction invoices for tax compliance.
  • Restriction and Objection: You may object to or request restriction of processing based on legitimate interests, or withdraw consent where processing is based on your consent.
  • Supervisory Authority Complaint: You have the right to lodge a complaint with your local data protection authority (such as the UAE Data Office, an EU/EEA national Data Protection Authority, or the UK Information Commissioner’s Office).

To exercise any of these rights, please submit a request through our Contact Page. To protect your privacy and security, we will verify your identity (for example, by confirming control of your registered email address) before fulfilling a request and will respond within the timeframe required by law (within 30 days).

7. Security

We implement technical and organizational safeguards designed to protect your account and workspace content against unauthorized access, alteration, or loss:

  • Encryption: All traffic between your browser, connected AI clients, and PlacidPlan is encrypted in transit using HTTPS/TLS 1.2+.
  • Credential Hashing: User passwords, API keys, and MCP OAuth tokens are stored exclusively as one-way hashes—never in plaintext.
  • OAuth 2.1 with PKCE: External AI integrations require OAuth 2.1 authorization code grants with Proof Key for Code Exchange (S256), short-lived 1-hour access tokens, automatic refresh token rotation, and immediate session revocation upon password or email modification.
  • Workspace Isolation: Each customer workspace is logically segregated so that queries and connected tools can access only the resources belonging to your authenticated account.

For further architectural details on our authentication and MCP security controls, please visit our Developer & Security Documentation.

8. Children’s Privacy

PlacidPlan is a business and creative productivity platform and is not directed to children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided personal information to us, we will promptly delete the account and associated data.

9. International Data Transfers

Ascentir Management Consultancies FZCO is headquartered in the United Arab Emirates, and our cloud infrastructure, payment processor (Stripe), and service providers may process and store information in the United Arab Emirates, the European Economic Area (EEA), the United Kingdom, and the United States.

Where personal information is transferred outside your home jurisdiction (including transfers from the UAE, EEA, Switzerland, or the UK), we ensure that appropriate legal safeguards are in place—such as adequacy decisions, the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and equivalent cross-border contractual protections required under the UAE Personal Data Protection Law.

10. Changes to This Policy

We will update this Privacy Policy when our product features, sub-processors, or legal requirements change. When we make updates, we will revise the “Last Updated” date at the top of this page. If we make material changes that significantly affect how we handle your personal information, we will provide prominent notice on our website or send an email notification to registered account holders prior to the changes taking effect.

11. Contact Us

If you have any questions, concerns, or data subject requests regarding this Privacy Policy or how your information is handled, please contact us: