Plen - Privacy Policy
This Privacy Policy explains what personal data Wilb collects when you visit plen.work or use Plen, why we collect it, how long we keep it, and what rights you have under the General Data Protection Regulation (GDPR / AVG).
It should be read together with our Terms & Conditions. Where the two overlap, this Policy governs questions about personal data.
1. Who is responsible for your data
The data controller for the personal data described in this Policy is:
- Wilb (eenmanszaak)
- Wibautstraat 150 – 2.67, 1091 GR Amsterdam, the Netherlands
- KvK number: 64118908
- BTW-ID: NL002294521B05
- Email: info@plen.work
In this Policy, “we”, “us” and “our” mean Wilb.
2. The short version
In short: if you use Plen in your browser, the plannings you create are stored on our servers in the EU (Frankfurt) so they're there when you sign in from anywhere — along with your email address, subscription status, and any plannings you've shared. You can see everything, download your plannings, and delete everything from your dashboard or the app. We use no tracking, no analytics, and no advertising. (The legacy desktop app still runs entirely on your computer and sends nothing unless you use its Cloud features.)
3. Where your plannings live
Plannings stored for the browser version live in our EU database so we can show them back to you; we do not read, analyse, or use their contents for anything other than providing the service, and no one else has access. Plannings on your own computer (legacy desktop) never reach us at all unless you share them.
4. What we collect, why, and on what legal basis
4.1 Data we process for Plen
When you use Plen we process: your email address (your account identifier, for sign-in codes and service emails), your subscription status (from Paddle — we never see payment details), your signed-in devices and browser sessions (so you stay signed in and can sign out remotely), the plannings you create in Plen for the browser (stored so you can open them from any device, until you delete them), and the plannings you choose to share (stored as the generated HTML page with its settings). Server logs (IP address, request time) are kept briefly for security and troubleshooting.
The legacy desktop app without Cloud features processes no personal data and sends nothing to us.
4.2 Tax and accounting records
As a Dutch business we are legally required to keep records relating to our sales.
- Data: transaction and invoice data associated with your purchase.
- Purpose: to comply with our fiscal obligations.
- Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR), specifically the seven-year retention duty under Article 52 of the Algemene Wet inzake Rijksbelastingen (AWR). Note that Paddle, as Merchant of Record, holds the primary invoice and VAT records for your purchase.
4.3 Email you send us
If you email us — for example to ask a question or report a problem — we receive whatever you choose to put in that message.
- Data: your email address and the content of your message.
- Purpose: to respond to and handle your request.
- Legal basis: our legitimate interest in answering correspondence (Article 6(1)(f) GDPR).
4.4 Website visits
The Site is static and informational. It sets no tracking cookies and runs no third-party analytics (see our Cookie Policy). Our hosting provider may process limited technical server logs (such as IP address and request time) as a normal part of serving and securing a website; these are not used to identify or profile you.
5. Who helps us process this data
We use a small number of service providers, each bound by data processing agreements:
Paddle (merchant of record) — handles checkout, payment, VAT, and invoices; Paddle is an independent controller for payment data. Supabase — our database and file storage, hosted in the EU (Frankfurt, Germany). Vercel — hosts the website and the server functions that power Plen. Resend — sends our service emails (sign-in codes, subscription notices). We do not sell or share your data with anyone else, and we use no analytics or advertising services.
6. How long we keep things
Sign-in codes expire after 10 minutes and are then useless. Signed-in device records last until you sign that device out or delete your data. Shared plannings stay online while your subscription is active; after a subscription ends they remain stored for up to 90 days (so resubscribing can restore your links), then are permanently deleted. Plannings you create in the browser are kept while your account exists. Deleting a planning moves it to the trash; it is permanently erased 30 days later. “Delete all my online data” in your dashboard removes every planning, every shared page, every link record, and your signed-in sessions immediately. If your subscription ends, your plannings remain yours: you can still open, download, and delete them — only creating and saving new work requires an active subscription. If you delete your account, everything we store is removed immediately. Records of your payments (invoices, transactions) are kept by Paddle, our merchant of record, for their legal and tax obligations.
You have the usual GDPR rights (access, correction, deletion, objection, portability) — for anything the dashboard button doesn't cover, email info@plen.work. You can also complain to the Autoriteit Persoonsgegevens.
7. Your rights under the GDPR
You have the right to:
- access the personal data we hold about you;
- rectify data that is inaccurate or incomplete;
- erase your data (“right to be forgotten”), subject to our legal retention duties;
- restrict or object to our processing where it is based on legitimate interests;
- data portability, where processing is based on contract or consent and carried out by automated means; and
- withdraw consent at any time, where processing is based on consent (this does not affect processing already carried out).
To exercise any of these rights, email us at info@plen.work. We will respond within one month. We will not charge a fee unless a request is manifestly unfounded or excessive.
You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in your country of residence.
8. Cookies and analytics
The Site uses no tracking, analytics or advertising cookies. Two strictly functional mechanisms exist — the short-lived cookie that unlocks a password-protected share link, and the dashboard sign-in token — described in our Cookie Policy. Because they are strictly necessary for features you explicitly use, no consent is required under Article 11.7a of the Dutch Telecommunications Act.
9. Children
Plen is a productivity tool intended for general and professional use. It is not directed at children, and we do not knowingly collect personal data from children.
10. Changes to this Policy
We may update this Policy from time to time. We will publish the current version at plen.work with a clear effective date. Material changes affecting how we use your personal data will be reflected in the version and date shown above.
11. Contact
For any question about this Policy or your personal data, email us at info@plen.work.