This policy explains what personal information Islarium Ltd collects when you use Plan-Zero, why, who we share it with, how long we keep it and the rights you have. We've tried to keep it short and in plain English.
Who we are. Plan-Zero is run by Islarium Ltd, a company registered in England and Wales (company number 17525132), registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. We are the "controller" of your personal information. Questions or requests: privacy@plan-zero.com.
This policy covers our websites (plan-zero.com and islarium.com) and the Plan-Zero app (app.plan-zero.com), together "the Service".
1. What we collect
- Account details. Your email address, your name if you give it, and sign-in records (for example, when you last signed in). Sign-in is handled for us by Clerk.
- Organisation details. Which organisation you work for in Plan-Zero, if any — set by your organisation's Clerk invitation, or matched by your work email address — so we can show you the right product libraries.
- Your content. The projects, units, products, 3D files, artwork, images and CSV files you create or upload. When you're signed in these are stored in your account; when you're not, they stay in your browser on your device.
- Library requests. If you send products to be added to a shared library: your name, company, email address, the product files and their details, and your account.
- Camera, photos and videos in AR. When you use augmented reality, the camera picture is used on your device only. Photos and videos you take in AR stay on your device unless you choose to save or share them — they are not sent to us.
- Technical information. Your IP address, browser and device type, and records of requests to our servers, kept by our hosting providers for security and to fix problems.
- Usage statistics. We use Vercel Web Analytics to count visits and popular pages. It doesn't use cookies and can't follow you between days or websites (it uses an anonymous code that resets every day).
- Payments (once paid plans start). Payments are taken by Stripe; we never see your full card number. We keep your billing name and address, VAT number if you give one, and your plan and invoice history.
- Messages. What you tell us when you email us or ask for support.
2. Why we use it, and our lawful basis
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Provide the Service: your account, saving and syncing your work, organisation libraries, exports and AR | Contract — it's needed to provide what you signed up for |
| Keep the Service secure: preventing misuse, enforcing storage and request limits, investigating problems | Legitimate interests — keeping the Service safe and working for everyone |
| Answer support requests and messages | Contract, or legitimate interests where you're not yet a customer |
| Review library requests and let you know the outcome | Legitimate interests — building the shared libraries |
| Send service emails: beta invitations, sign-in codes, important changes to the Service or these terms | Contract and legitimate interests |
| Send news and offers | Consent only — we don't do this today, and if we start, you can unsubscribe at any time |
| Take payments and keep billing and tax records | Contract, and legal obligation (tax law) |
| Understand how the Service is used, from anonymous statistics, to improve it | Legitimate interests |
3. Cookies and storage in your browser
We only use what's strictly necessary for the Service to work:
- Sign-in cookies set by Clerk, which keep you signed in securely.
- Browser storage (localStorage and IndexedDB) that keeps your work, settings and preferences on your device.
We don't use advertising or tracking cookies, and our analytics don't use cookies at all — so there's no cookie banner. If that ever changes, we'll ask for your consent first.
4. Who we share it with
We don't sell your personal information. We share it only with:
- Service providers who process it for us, under contract and only on our instructions:
- Clerk (Clerk, Inc., USA) — sign-in and accounts;
- Vercel (Vercel Inc., USA) — hosting of the website and app, and web analytics;
- Cloudflare (Cloudflare, Inc., USA, with servers worldwide) — storage of your content and files, domain names and security;
- Google (Google Workspace) — our business email, when you email us;
- Stripe (Stripe Payments Europe / Stripe, Inc.) — payments, once paid plans start.
- People you choose. Members of your organisation see your organisation's libraries, and people you share a project with can see that project.
- Authorities, if the law requires it, or to protect our rights or someone's safety.
- A buyer of our business, if Islarium Ltd or Plan-Zero is ever sold — they would have to look after your information in line with this policy.
5. International transfers
Some of our providers are based in, or store data in, the United States and other countries outside the UK. Where they do, your information is protected by the UK Extension to the EU–US Data Privacy Framework (Clerk, Vercel and Cloudflare are certified), or by the UK's approved contract clauses (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).
6. How long we keep it
| Information | How long |
|---|---|
| Your account and content | While your account is open. When you delete it, or ask us to, we delete it within 30 days. |
| Beta waitlist sign-ups | Until we invite you, or 12 months if we don't. |
| Library requests | Until reviewed and for up to 12 months after. If a product is approved, it stays in the library for as long as the library exists. |
| Billing and invoice records | 6 years after the end of the tax year they relate to, as tax law requires. |
| Server and security records | Usually a few days to a few weeks, as kept by our hosting providers. |
| Support emails | Up to 2 years after the conversation ends. |
7. Keeping it safe
Everything is sent over encrypted connections. Your content is kept in private storage that can only be reached through your signed-in account or short-lived secure links, and private product libraries are only ever sent to the organisations allowed to use them. Access to our systems is limited and protected with strong sign-in.
8. Your rights
You have the right to:
- get a copy of the personal information we hold about you;
- have it corrected if it's wrong;
- have it deleted;
- restrict, or object to, how we use it — including any direct marketing;
- receive the information you gave us in a portable format;
- withdraw consent at any time, where we rely on it.
To use any of these rights, email privacy@plan-zero.com. We'll reply within one month, and it's free. We may need to check it's really you first.
9. Children
Plan-Zero is a tool for businesses and isn't meant for children. We don't knowingly collect information from anyone under 16.
10. Complaints
If you're unhappy with how we've handled your information, please tell us first at privacy@plan-zero.com. We'll acknowledge your complaint within 30 days, keep you updated and tell you the outcome. If you're still not satisfied, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
11. Changes to this policy
We'll update this policy when the Service or the law changes. The date at the top shows when it last changed, and we'll tell you about any important changes by email or in the app.