Privacy Policy

1. Information We Collect

• Account information — your name, email address, phone number, company, and role.
• Project content — documents, drawings, permit submissions, bid packages, and other files you upload or route to the Service.
• Communications — the emails, text messages, WhatsApp messages, and phone calls the Service coordinates on your projects, including call audio and transcripts.
• Contact information about third parties — when you use the Service to coordinate a project, we process contact details for subcontractors, suppliers, consultants, and other people you communicate with. You are responsible for having the right to provide that information.
• Usage and diagnostic data — how you interact with the Service, and technical error and performance information used to keep it reliable and secure.

2. How We Use Your Information

We use your information solely to operate, secure, and improve the Service, including to:

• Provide project coordination, document search, plan review, and the other features you request.
• Communicate with people on your projects on your behalf, as you direct and configure.
• Secure the Service, prevent abuse, and meet our legal obligations.
• Compute your usage and billing from your own project record.
• We do not sell your personal information, and we do not use it for advertising.

3. AI Processing and Model Training

The Service uses artificial intelligence to read documents, draft communications, and produce plan-review findings.

PlanMinds runs its own custom models on Google’s AI infrastructure. Your project content and communications are transmitted to Google in order to be processed.

We do not use your project content, communications, or documents to train our models. Our custom models are tuned on our own non-customer material, never on your data. Our agreements with AI providers prohibit them from using your content to train their models, and we use paid commercial API tiers specifically because they carry those terms.

IIVY grounds its answers and actions in your project’s own record, and every action it takes is recorded in that record and attributable to the person or rule that authorized it.

4. Sub-processors

We use the following third parties to provide the Service. Each processes data on our behalf under contractual confidentiality and security obligations. This list is current as of the date above; we will update it when it changes.

5. Data Isolation and Access

Project data is siloed per project and private per principal. Each person sees only what they have been granted, enforced by fail-closed access controls in our database — access is denied by default and permitted only by explicit grant.

IIVY is always disclosed as an AI teammate on any communication and never impersonates a person.

6. How We Share Information

We do not sell your information. We share it only:

• With the sub-processors listed in Section 4, to operate the Service.
• To comply with applicable law, legal process, or enforceable governmental requests.
• To protect the rights, safety, and security of PlanMinds, our users, and the public.
• In connection with a merger, acquisition, or sale of assets, in which case we will notify you before your information becomes subject to a different privacy policy.

7. Data Security

We protect your data in transit using TLS on every connection, and at rest using the encryption provided by our infrastructure providers. Files are never publicly accessible; every file read and upload passes through a short-lived, expiring signed link.

Access to production systems requires multi-factor authentication. We maintain administrative, technical, and physical safeguards designed to protect your information.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Data Location

PlanMinds is a Canadian company. Our application infrastructure and primary data storage are hosted in Canada — application compute and caching in Microsoft Azure’s Canada Central region, and our primary database and file storage in Supabase’s Canada Central region.

Some sub-processors listed in Section 4, including AI, communications, and payment providers, process data in the United States and other jurisdictions. By using the Service, you understand that your information may be processed outside Canada, where it may be subject to the laws of those jurisdictions.

9. Data Retention

We retain your information for as long as your account is active and for as long as needed to provide the Service, resolve disputes, and meet our legal, tax, and audit obligations.

You may delete project content at any time through the Service. Deleting a project removes its stored files from our systems.

Backups are retained on a rolling basis for disaster recovery and are overwritten in the ordinary course. Content deleted from the live Service may persist in backups until those backups age out.

10. Your Rights

Subject to applicable law, you may:

• Access the personal information we hold about you.
• Correct or update that information.
• Request deletion of your personal information.
• Request a copy of your project data, including within 30 days of account termination.
• Withdraw consent for optional processing, where applicable.
• To exercise any of these rights, contact support@planminds.ai. We will respond within 30 days. We may need to verify your identity before acting on a request, and some information may be retained where we have a legal obligation or an overriding legitimate interest in keeping it.
• If you are located in Canada and are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

11. Breach Notification

If we become aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, as required by PIPEDA, and will tell you what happened, what information was involved, and what we are doing about it.

12. Cookies

The Service uses essential cookies necessary for authentication and session management. We do not use cookies for advertising and we do not sell information collected through them.

13. Children’s Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on the Service and update the Last updated date above. For material changes we will provide additional notice. Your continued use of the Service after any change constitutes acceptance of the updated policy.