Privacy Policy
How PlanningPoker collects, uses and protects personal data, and the rights you have over it under Moldova's Law No. 195/2024, the GDPR and UK GDPR, the California Consumer Privacy Act as amended by the CPRA, and Canada's PIPEDA and Quebec Law 25.
PlanningPoker (the “Service”) is operated by S.R.L. MARGOVIMER, MD-3100, str. 31 August, 59, ap. 68, mun. Bălți, Republica Moldova. We are established in the Republic of Moldova and are primarily subject to Law No. 195/2024 on the protection of personal data (in force from 23 August 2026; the outgoing Law No. 133/2011 applies until then), overseen by the National Centre for Personal Data Protection (Centrul Național pentru Protecția Datelor cu Caracter Personal, CNPDCP). Because we also offer the Service to people in the EU and UK, the GDPR and UK GDPR apply to those users under their extraterritorial scope, and for the purposes of those frameworks we are the controller of account and guest data described below. Where you use the Service as an organisation, we act as a processor for the story text and estimates you bring into a room, and your organisation is the controller. Data protection contact: privacy@planningpoker.cloud. For UK users our UK GDPR Article 27 representative is [name, address].
If you join as a guest: the display name you type, a randomly generated identifier, the room you joined, the role you took, and the cards you played. No email address is required or requested.
If you create an account: the above, plus your email address and name, and a securely hashed password. We never store your password in a readable form.
Session content: room names, story titles and descriptions you enter, votes, revealed estimates and confidence answers. Story titles often describe your work — treat them as you would any other note you put into a shared tool.
Support data: messages and files you send through the contact form.
Technical data: standard server logs including IP address and browser type, kept by our hosting and database providers for security and abuse prevention.
We do not collect special-category data and we do not buy personal data from third parties.
To run rooms and sessions in real time; to keep your history where your plan includes it; to answer support requests; to keep the Service secure and prevent abuse; and to meet legal obligations. We do not use your session content to train machine-learning models, and we do not sell personal data or share it for cross-context behavioural advertising.
Contract (Art. 6(1)(b)) for operating the Service. Legitimate interests (Art. 6(1)(f)) for security, abuse prevention and product improvement, balanced against your rights. Consent (Art. 6(1)(a)) for optional product emails and non-essential cookies — see Cookies settings, withdrawable at any time. Legal obligation (Art. 6(1)(c)) for tax and accounting records where paid plans apply. These bases apply equally under Law No. 195/2024 on the protection of personal data, which mirrors the GDPR’s Article 6 framework.
Where a processor is outside the EEA or UK, transfers rely on the European Commission’s Standard Contractual Clauses with the UK International Data Transfer Addendum, supported by a transfer impact assessment where relevant. The same safeguards cover transfers between us, in Moldova, and our EEA/UK-based processors, since Law No. 195/2024 on the protection of personal data requires equivalent protection for data leaving Moldova. Copies of the safeguards are available on request at privacy@planningpoker.cloud.
Rooms created without an account are deleted 7 days after they were last used, along with their stories and votes. On the free plan, your most recent 5 sessions are kept; older ones are removed. If you delete your account, your profile and the rooms you created are deleted (with a short window to restore a mistaken deletion, per the confirmation email you receive). Votes you cast in rooms belonging to other people are anonymised rather than removed, because deleting them would silently change estimates that team still relies on. Support messages and attachments are kept for 12 months after the issue is closed.
You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests, and you may withdraw consent at any time. Most rights are self-service: export from Settings, delete your account from Settings. We answer written requests within one month, extendable by two months for complex requests, and we do not charge a fee unless a request is manifestly excessive. There is no automated decision-making with legal effect. You may complain to your supervisory authority.
Under Law No. 195/2024 on the protection of personal data (in force from 23 August 2026; the outgoing Law No. 133/2011 applies until then) you may request access, rectification, erasure, restriction of processing, and portability, and you may object to processing — including an unconditional right to object to direct marketing — and withdraw consent at any time. We answer requests within one month. You may complain to the National Centre for Personal Data Protection (Centrul Național pentru Protecția Datelor cu Caracter Personal, CNPDCP).
California residents have the right to know, delete, correct, and to obtain a portable copy of personal information, and the right not to be discriminated against for exercising them. We do not sell personal information and we do not share it for cross-context behavioural advertising, so no “Do Not Sell or Share My Personal Information” link is required. Requests: privacy@planningpoker.cloud or the contact form; we verify identity through the email on the account, honour authorised agents with written permission, and respond within 45 days (extendable once by 45 days). Comparable rights are honoured for residents of other US states with equivalent laws, including the right to appeal a refused request.
Under PIPEDA you may access your personal information, ask for corrections, and withdraw consent subject to legal and contractual limits, and you may complain to the Office of the Privacy Commissioner of Canada. Quebec residents additionally have, under Law 25, the right to data portability and the right to be informed of automated decisions. Our Privacy Officer is Andrei Barbier, reachable at privacy@planningpoker.cloud. We report privacy breaches presenting a real risk of significant harm to the OPC, to the Commission d’accès à l’information where Quebec residents are affected, and to affected individuals.
Data is encrypted in transit and at rest by our infrastructure providers. Passwords are hashed, never stored in a readable form. Access to production data follows least privilege. We will notify a supervisory authority within 72 hours of becoming aware of a reportable breach, and affected users without undue delay.
The Service is intended for workplace use and is not directed at children under 16. We do not knowingly collect their data. If you believe a child has provided data, write to privacy@planningpoker.cloud and we will delete it.
We will post material changes here and email account holders at least 14 days before they take effect. Questions, requests and complaints: privacy@planningpoker.cloud, or S.R.L. MARGOVIMER, MD-3100, str. 31 August, 59, ap. 68, mun. Bălți, Republica Moldova. For data your employer brought into a room, contact them first — we will help them respond.