Plank Privacy Policy

Plank Privacy Policy

1. Who We Are

The operator is LLP "PLANK MD" — legal name under Kazakhstan law: Товарищество с ограниченной ответственностью "Планк МД" — BIN 260640029319, 13A, 22 Liniya Street, Bostandyk District, Almaty, 050046, Republic of Kazakhstan.

Privacy contact: support@plank.md.

2. Scope

This Policy applies to the Plank website, product, registration, workspace invitations, support, billing, legal acceptance records and user communications.

B2B workspace data is also governed by the Data Processing Terms or a separate DPA. Paddle and other payment providers process payment data under their own terms when they are the merchant of record.

3. Data We May Collect

We may process account data, business billing data, product usage data, technical data, support communications and connected-service data authorized by the user or customer.

Current product data categories include email address, name, hashed password, locale preference, onboarding information such as role, industry and work type, workspace files, chat messages, AI outputs, workspace settings, API keys or OAuth tokens for third-party AI providers, usage events, session information, device/browser type, payment metadata, photos or videos, audio data, other user content, user ID and product interaction events.

We should not collect identity document copies, biometric, medical, banking, state-secret, classified or other sensitive data unless there is a specific lawful basis and written agreement.

4. Legal Basis and Consent

We process personal data with consent, to perform a contract or public offer, to provide the service, to comply with accounting and tax duties, for security and support, to protect rights, and to comply with law.

Consent may be given by checkbox, registration, workspace invitation acceptance, payment, signed document, written confirmation or another method that allows confirmation.

Users may withdraw consent by contacting support@plank.md, unless continued processing is required by law, contract, accounting, taxes, security or legal defense.

5. Purposes

We process data to create and manage accounts, provide Plank workspaces and features, run AI functions, provide support, secure accounts, process billing and direct B2B documents, record legal acceptance, improve the product, send service and legal notices, comply with law and protect rights.

6. AI and Providers

Plank may use cloud infrastructure, databases, AI model providers, search providers, monitoring, support, payment, analytics and integration providers.

Plank uses the following providers (subprocessors): Serverspace (Kazakhstan, Almaty) for the servers that host the database, authentication, file storage and compute infrastructure; Paddle (UK) for payment processing and billing as merchant of record; PostHog (EU) for product analytics; Cloudflare for browser-automation infrastructure used when the agent operates a browser on your instruction; and AI model providers configured by the user, including OpenAI, Anthropic, MiniMax, DeepSeek, Google, xAI, Groq and OpenRouter.

An up-to-date list of subprocessors is available at https://plank.md/dpa.

Plank does not use Customer Data to train third-party public models, and our AI model providers are prohibited from training their public models on Customer Data, unless expressly disclosed and agreed by the customer.

7. Google User Data

This section explains how Plank accesses, uses, stores, shares, protects, retains and deletes data received from Google APIs ("Google user data"). It applies only when you connect a Google account to a Plank workspace. Plank does not offer "Sign in with Google", so signing up for Plank never gives Plank access to your Google account.

Data we access. When you connect Google, you approve access on Google's own consent page; Plank never sees your Google password. Depending on what you approve, Plank can access:

• Gmail (gmail.readonly, gmail.modify, gmail.send): the content and metadata of your email messages and threads (sender, recipients, subject, date, body, attachments, labels); creating drafts, changing labels and read status, and sending messages you ask the assistant to send;
• Google Drive (drive): your files and folders, their names, content and metadata, and creating, updating, moving and sharing files you ask the assistant to work with;
• Google Docs, Sheets and Slides (documents, spreadsheets, presentations): reading, creating and editing the contents of documents, spreadsheets and presentations;
• Google Calendar (calendar): your calendars and events (title, time, location, description, attendees), and creating, changing and deleting events you ask for;
• your Google account email address, used to label the connection so you can tell your accounts apart.

How we use it. Plank uses Google user data only to provide and improve the user-facing features you use in your workspace — that is, to carry out the tasks you, or automations you set up, ask the Plank assistant to perform: for example, to summarise or answer an email, find a file, fill in a spreadsheet, prepare a document or add a calendar event. Plank does not use Google user data for advertising, retargeting or interest-based ads, does not sell it, does not use it to determine creditworthiness or for lending, and does not build user profiles from it for any other purpose.

Generalised AI/ML models. Plank does not use Google user data, including Google Workspace data, to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models. Plank also does not allow its AI model providers to do so: the providers listed in Section 6 process the data only to return a response to your request, under terms that prohibit training their models on it.

How we share it. Plank shares Google user data only as needed to provide the feature you asked for, with: (a) the AI model provider that processes your request (Section 6 lists them), which receives the parts of an email, file or event the assistant needs for that task; (b) Serverspace (Kazakhstan, Almaty), which hosts Plank's servers and storage; and (c) other members of a workspace, only when you choose to connect a Google account as a shared team account for that workspace or place results in a shared workspace. Plank may also disclose data where required by law, or as part of a merger, acquisition or sale of assets with notice to users. Plank does not transfer Google user data to anyone else, including data brokers or advertising platforms.

Human access. Plank staff do not read your Google user data unless you give explicit permission for specific messages or files (for example, in a support request), it is necessary for security purposes such as investigating abuse or a vulnerability, it is required to comply with applicable law, or the data has been aggregated and anonymised for internal operations.

Storage and protection. The OAuth token that lets the assistant reach your Google account is stored encrypted (AES-GCM) in your Plank Credentials, and a token stored there is never returned to the AI model. A workspace connected before Credentials existed may still keep its token in a file in the workspace's storage on Plank's servers until the account is connected again. Google data the assistant reads for a task, and anything it produces from it, is stored in your workspace on Plank's servers in Kazakhstan, protected by TLS in transit, encryption of credentials at rest and access controls that limit it to you and the workspace members you share it with. To count how many Google accounts have connected (a limit Google sets), Plank keeps a one-way hash of the connected account, not the address itself.

Retention and deletion. Plank keeps the OAuth token until you disconnect. You can disconnect at any time by deleting the Google item in Plank Credentials, or by revoking Plank's access at https://myaccount.google.com/permissions; after either, Plank can no longer access your Google account. Copies of Google data saved in your workspace (for example a downloaded attachment or a chat that quotes an email) stay until you delete them, or until your account is deleted, in which case they are deleted within 30 days as described in Section 11. You may also ask support@plank.md to delete Google user data Plank holds about you.

Limited Use. Plank's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Storage, Security and Cross-Border Transfers

Data is stored on servers in the Republic of Kazakhstan (Almaty), on infrastructure provided by Serverspace.

Plank uses TLS encryption in transit and encryption at rest for sensitive data, including credentials, API keys and OAuth tokens. Plank applies database-level access controls so users can access only their own data and workspace data they belong to.

Data may be transferred or made available outside Kazakhstan when Plank uses AI providers, payment providers, analytics, browser-automation infrastructure, support and connected services. Such transfers should have a lawful basis, required consent where applicable, and reasonable safeguards.

9. Disclosures

We may disclose data to service providers, payment providers, accountants, auditors, lawyers, government authorities, courts, regulators, direct B2B counterparties where necessary, and successors in a merger, sale, financing or reorganization subject to confidentiality and law.

10. Cookies and Analytics

Plank may use cookies, local storage and similar technologies for login, security, preferences, analytics and product improvement.

Plank uses essential cookies for authentication and session management and PostHog analytics cookies.

On its public website plank.md, Plank also uses the Meta Pixel (Meta Platforms Ireland Ltd.) to measure the effectiveness of its advertising on Facebook and Instagram. The pixel records page visits and clicks on registration buttons and may set Meta cookies. The Plank application (app.plank.md) does not use advertising cookies. You can block these cookies in your browser settings.

Plank does not sell user data to third parties.

11. Retention

We retain data for as long as needed for the purposes in this Policy, unless a longer period is required by law, accounting/tax duties, security, backups, disputes or contracts.

When you delete your account, we delete your account and associated personal data within 30 days of your request, except where longer retention is required by law or for accounting, tax, security or legal-defense duties. Residual copies in backups are removed on the normal backup lifecycle. Workspace data shared with other members may remain in those workspaces after a user leaves.

12. Security

Plank uses reasonable legal, organizational and technical measures, including access control, TLS encryption in transit, encryption at rest for sensitive credentials such as API keys and OAuth tokens, logs, permission management, row-level database security, backups, vendor review and confidentiality controls.

Users must protect their passwords, devices, access keys, browser sessions and connected accounts.

13. User Rights

Users may request information, access, correction, deletion or blocking, consent withdrawal, data export in a portable format, restriction or objection where applicable, and information about third-party or cross-border transfers. Requests go to support@plank.md.

We aim to respond to requests within 30 days. Plank may verify identity and may refuse or limit a request where required or permitted by law, contract, security or retention duties.

14. Children

Plank is intended for business and professional use and is not intended for users under 18. Plank does not knowingly collect children's personal data. If a child has provided personal data, contact Plank so it can be deleted.

15. Changes

Plank may update this Policy at https://plank.md/privacy. Material changes may be notified through the website, product, email or another reasonable channel.

16. Contact

Operator: LLP "PLANK MD" BIN: 260640029319 Address: 13A, 22 Liniya Street, Bostandyk District, Almaty, 050046, Republic of Kazakhstan D-U-N-S: 374534304 Email: support@plank.md Website: https://plank.md