itsaplan
Privacy Policy
This Privacy Policy explains how itsaplan collects, uses, shares, retains and protects personal data.
Our approach to your data. We collect only what we need to help groups make plans. We do not sell personal data, show behavioural advertising, process payments, or continuously track your location.
Please read this Policy together with our Terms and Conditions. By joining the waiting list or using the Service, you acknowledge that you have been given this information about how itsaplan handles personal data.
1. Who we are and the scope of this Policy
This Privacy Policy applies to the itsaplan website, waiting list, web application, mobile application, APIs and related features (together, the "Service").
itsaplan is a social-planning service operated by the itsaplan team, based in Dublin, Ireland. The itsaplan team is the "controller" of your personal data, which means we decide why and how it is processed. Our contact details appear in section 21.
This Policy applies to waiting list members, account holders, event organisers, invited participants, user-testing participants and anyone who contacts us or otherwise uses the Service. It does not cover the independent data practices of venues, calendar providers, map providers, AI providers or other third-party services.
2. Privacy at a glance
- We collect only the information needed to run the waiting list and provide the social-planning features you use.
- If you connect a calendar, we use free/busy availability only. We do not share your calendar event titles, descriptions, attendees or notes with other group members.
- Information you submit to a group event is used to find overlapping availability, compare preferences and suggest a plan. Some event information is visible to other participants.
- Natural-language availability and recommendation features may send limited text and event context to an AI provider. You can review and edit AI-interpreted results before submitting them.
- We do not sell personal data, use it for behavioural advertising, process payments, or make reservations on your behalf.
- The Service is intended for adults aged 18 or over.
- You can ask to access, correct or delete your data, and use the other rights described in section 16.
3. Personal data we collect
3.1 Waiting list information
When you join the waiting list, we collect your email address and any other details requested on the sign-up form, such as your name or city, along with the date you signed up, your invitation status and your email preferences.
3.2 Account and identity information
Depending on the sign-in method you use, we may collect your email address, display name, account identifier, authentication-provider identifier, password hash or session identifier, account status, and records showing your acceptance of the Terms or your privacy choices. We never store a readable copy of your password.
3.3 Group-event and planning information
When you create or join an event, we may process the event title, event ID or invite code, organiser and participant roles, invitation status, proposed date range, preferred area, attendance status, availability blocks, preference selections, votes, ranked recommendations, confirmed plan and timestamps.
Preference selections may include budget range, activity type, atmosphere or "vibe", desired busyness, distance, dietary or accessibility-related venue preferences, and similar planning choices. Accessibility selections are used to filter venue attributes, not to collect health information. Please do not enter medical details or other unnecessary sensitive information.
3.4 Calendar connection information
If you connect a calendar, we may receive an account identifier from the calendar provider, permission scopes, selected calendar identifiers, access or refresh tokens, and free/busy time blocks. We do not retain calendar event titles, descriptions, invitees or private notes.
3.5 Free-text and AI-related information
If you type your availability in natural language, we may process the text you submit, the structured time blocks produced from it, your edits or confirmation, and limited context needed to generate a recommendation or explanation. Please do not include confidential, highly personal or sensitive information that is not needed for planning.
3.6 Technical and usage information
When you use the Service, our hosting, authentication, database and security systems may automatically record information such as IP address, date and time, device and browser type, operating system, request and response metadata, session identifiers, page or feature interactions, crash information, error logs and security events.
3.7 Communications, support and feedback
If you contact us, report a problem or take part in user testing, we may collect your message, contact details, screenshots, device information, survey or interview responses, consent records and follow-up correspondence. We only collect audio, video or screen recordings with your separate, specific consent.
3.8 Information we do not collect
We do not collect payment-card information, government identifiers, continuous or background precise location, medical records, biometric data, private calendar content, or data for advertising profiles. If this changes, we will update this Policy before any such collection begins.
4. Where personal data comes from
- Directly from you when you join the waiting list, register, create or join an event, submit availability or preferences, vote, contact us, or take part in testing.
- From another participant or organiser when they enter your email address or send you an invitation. We use that information only to deliver or manage the invitation.
- From your calendar or sign-in provider when you choose to connect it and approve the permissions shown by that provider.
- From your device, browser and service providers through security logs, session cookies, diagnostics and similar technical records.
- From public and licensed sources used for venue, weather, transport, map, neighbourhood, event and busyness information. These sources provide information about places rather than personal data about users.
5. Waiting list and launch updates
We use your waiting list information to keep track of your place on the list, invite you to the Service when access becomes available, and send you updates about itsaplan's launch and early access.
Joining the waiting list does not create an account. If you accept an invitation and create an account, your waiting list record may be linked to your new account so we know your invitation has been used.
You can stop receiving updates or leave the waiting list at any time by using the unsubscribe link in any of our emails or by contacting us. We will then delete your waiting list information, apart from a minimal record needed to make sure we do not email you again.
6. Calendar connection and availability data
Connecting a calendar is optional, and you can enter your availability manually instead. Before connecting, please review the permission screen provided by the calendar provider.
We use only the minimum information needed to work out whether time periods are free or busy. Other group members cannot see your calendar event titles, descriptions, attendees, locations or notes. They see only the availability or participation information needed to coordinate the group event.
Calendar access tokens and identifiers are stored securely and used only to provide the calendar feature. You can revoke access through the calendar provider and, where available, through the Service. Revoking access stops future calendar requests but does not automatically remove availability already submitted to an event; you can delete that event data or contact us.
Do not connect another person's calendar or submit their availability without permission. Free/busy data is a planning aid and does not prove that a person is willing or able to attend.
7. AI-assisted input and recommendations
The Service may use generative AI or other automated tools to:
- interpret natural-language availability and convert it into proposed time blocks;
- generate short recommendation explanations or summaries; and
- help rank or present possible times, activities or venues based on group data.
When you use these features, we send the text you submit and minimal event context to the Google Gemini API. We do not send your email address, account identifiers or calendar content to the AI provider.
AI output may be incorrect, incomplete or based on a misunderstanding. You will be shown the interpreted availability or recommendation and can review, edit or reject it before relying on it.
The AI features are used only to assist with social planning. They are not used to make legal, employment, credit, medical, insurance, education-admission or similarly significant decisions.
For more information about how Google handles data, please review the Google Privacy Policy and the Gemini API Additional Terms of Service.
8. Group events and information shared with participants
itsaplan is a collaborative service. Information needed to coordinate a group event may be shown to the organiser and other participants. This may include your display name, organiser or participant role, whether you have joined, whether you have submitted availability or preferences, your availability overlap or response status, votes or selected options, and the final proposed plan.
We never reveal private calendar content to group members. Where possible, we use individual preference choices to calculate a group result without showing each person's detailed selections to everyone else.
Event organisers are responsible for inviting only people they are entitled to contact. Do not post private invite codes or links publicly. If an invitation has been shared without permission, contact the organiser or us so access can be restricted where possible.
Once information has been seen or copied by another participant, deleting it from itsaplan cannot remove copies that person has made outside the Service.
9. How we use personal data and our lawful bases
Under the GDPR, we must have a lawful basis for each purpose for which we use personal data. These are set out below.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Manage the waiting list and invite you to the Service when access becomes available. | Waiting list information, sign-up date and invitation status. | Steps taken at your request before entering a contract (Article 6(1)(b)). |
| Send launch news and product updates by email. | Email address, name and email preferences. | Consent (Article 6(1)(a)), which you can withdraw at any time using the unsubscribe link. |
| Create and manage accounts; authenticate users; provide event creation, joining, availability, preferences and recommendations. | Account data, event data, availability, preferences, votes and plan data. | Performance of a contract or steps requested before entering a contract (Article 6(1)(b)). |
| Provide an optional calendar or AI feature that you actively choose to use. | Calendar identifiers, tokens and free/busy data; free text and interpreted output. | Performance of a contract for the requested feature, together with any permission required by the calendar provider. |
| Protect accounts, prevent misuse, troubleshoot, maintain logs and improve reliability. | Technical logs, IP address, device data, error and security records. | Legitimate interests in security, service integrity and improving the Service (Article 6(1)(f)), balanced against your rights. |
| Send essential service messages and respond to support, deletion or rights requests. | Contact details, account and correspondence records. | Performance of a contract; legitimate interests; and, where applicable, legal obligation. |
| Run optional surveys, interviews, recorded testing sessions or similar feedback activities. | Consent records, feedback, recordings and survey responses. | Consent (Article 6(1)(a)). Withdrawing consent does not affect earlier lawful processing. |
| Use non-essential analytics or similar tracking. | Cookie identifiers and usage analytics. | Consent (Article 6(1)(a)). Non-essential analytics are not enabled until you consent. |
| Comply with law, handle disputes and establish or defend legal claims. | Relevant account, event, communication and security records. | Legal obligation (Article 6(1)(c)) or legitimate interests (Article 6(1)(f)), depending on the circumstances. |
Where we rely on consent, you can withdraw it at any time, and doing so is as easy as giving it.
10. User testing, surveys and feedback
From time to time, we may invite you to take part in a survey, interview, recorded testing session or other feedback activity to help us improve itsaplan. Taking part is always optional. We will explain the purpose, what data we collect, who sees it, how long we keep it and how to withdraw before asking for your consent.
Declining to take part will not affect your access to the Service, and consent for testing is never bundled into joining the waiting list, creating an account or accepting the Terms.
When we share findings from testing, for example in internal reports or public updates about the product, we use aggregated or anonymised information unless you have separately agreed otherwise.
11. Cookies, local storage and similar technologies
The website and app use strictly necessary cookies, tokens or local storage to keep you signed in, protect your session, remember security choices, maintain an event workflow and provide features you request. These are necessary for the Service to work and are never used for advertising.
Any optional analytics, performance, personalisation or third-party tracking technologies are disabled until you have been given clear information and have consented. You can withdraw that consent at any time.
12. Who we share personal data with
We do not sell personal data or share it with advertisers or data brokers. We may share limited data with the following recipients where necessary:
- Other participants in the same event, as described in section 8.
- Hosting, database, authentication, email, notification, storage, monitoring and security providers that process data on our instructions.
- Calendar and identity providers when you choose to connect or sign in through them.
- AI providers when you use an AI-assisted feature, as described in section 7.
- Map, venue, weather, transport or event-data providers when a query must be sent to provide a result you requested. We avoid sending direct identifiers where they are not needed.
- Professional advisers, regulators, courts, law enforcement or other parties where disclosure is required by law or reasonably necessary to protect rights, security or users.
We have data-processing terms in place with service providers where required, and each provider receives only the information necessary for its role. You can contact us to request a list of our current service providers.
13. International data transfers
Some of our service providers may process personal data outside Ireland or the European Economic Area. Where personal data is transferred to a country without a European Commission adequacy decision, we use an approved safeguard such as the European Commission's Standard Contractual Clauses and assess whether additional protections are needed.
You can contact us to request more information about the safeguards used for a particular transfer.
14. How long we keep personal data
We keep personal data only for as long as we need it to run the Service.
Waiting list information is kept until you create an account, leave the waiting list or unsubscribe, or until we close the waiting list, whichever comes first.
Account information is kept while your account is active. Events and their basic information are kept until they are deleted by a user or the account that created them is deleted.
After an event or account is deleted, related information is removed or anonymised within a reasonable period, although limited copies may remain temporarily in protected backups or where retention is required for security or legal reasons.
15. Security
We use technical and organisational measures appropriate to the nature of the data we hold. These include encrypted connections, password hashing or secure third-party authentication, limited access based on need, protected secrets and tokens, separate development and production environments, access logging, regular dependency updates, backups, and procedures for responding to incidents and deletion requests.
Only team members and service providers who need access for development, support or security purposes can access identifiable data.
No online service can guarantee absolute security. If we become aware of a personal-data breach, we will assess the risk and notify affected individuals and the Data Protection Commission where required by law.
16. Your data-protection rights
Subject to the conditions and limits in data-protection law, you have the right to:
- receive clear information about how your personal data is used;
- access a copy of personal data held about you;
- correct inaccurate or incomplete data;
- request deletion of personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- object to direct marketing at any time;
- receive certain data in a structured, commonly used and machine-readable format and transmit it to another controller;
- withdraw consent at any time where consent is the lawful basis; and
- complain to the Data Protection Commission or another competent supervisory authority.
To exercise a right, contact us using the details in section 21 and describe the account, event or data concerned. We may ask for information needed to verify your identity. We will respond without undue delay and normally within one month, subject to lawful extensions for complex or numerous requests.
Withdrawing consent does not affect processing that was lawful before withdrawal. Some rights are not absolute, and we will explain any lawful reason for refusing or limiting a request.
17. Children
The Service is intended for people aged 18 or over and is not directed to children. We do not knowingly allow anyone under 18 to join the waiting list, create an account or be invited to an event, or collect their personal data.
If you believe that a person under 18 has provided us with personal data, please contact us. We will investigate and delete or restrict the information where appropriate.
18. Automated decision-making and profiling
itsaplan automatically compares availability, combines group preferences, ranks venues or times, estimates area-level busyness and generates recommendation text. These processes produce social-planning suggestions only and do not have legal or similarly significant effects on you.
You can always review the proposed availability and plan, correct your inputs, reject suggestions and make the final decision yourself. We do not use the Service to evaluate anyone's creditworthiness, employability, health, insurance risk, education eligibility or access to essential services.
The busyness feature uses area-level historical and indirect signals such as transport activity, time and weather. It does not build an individual behavioural profile or track where you go.
19. Third-party links, venues and services
The Service may show links, maps, venue details, opening hours, ratings, accessibility attributes, ticketing pages or other information supplied by third parties. Visiting a third-party site, contacting a venue, using a calendar provider or signing in with an external account is subject to that third party's own privacy notice and terms.
itsaplan does not control how a venue, map provider, calendar provider or external website handles data you provide directly to it. Please review their privacy information before sharing personal data or granting permissions.
20. Changes to this Policy
We may update this Policy when the Service, legal requirements, service providers, retention periods or data flows change. The updated version will show a revised effective date.
For material changes, we will give you reasonable notice through the Service, our website or by email where practical. Where the law requires it, we will ask for fresh consent rather than treating continued use as consent.
21. Contact us and complaints
Please contact us first if you have a privacy question, wish to exercise a right, or believe your personal data has been handled incorrectly. We will try to resolve your concern promptly.
You also have the right to raise a concern or make a complaint to the Irish Data Protection Commission. The DPC's postal address is Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland. The DPC recommends using its online contact form for data-protection concerns.