This policy explains what data we process when you use PlanReaderPro, why we process it, and what rights you have.
1. Data controller
PlanReaderPro is the data controller for this service. For privacy questions or data requests, contact us at samuel.mihal@mihalsoft.com.
2. Data we process
We process data required for mobile sign-in, account security, and use of the service.
- Account data: email, email verification status, acceptance of the legal documents, AI-sharing permission and its time, account blocking status, and account deletion request status. We collect these when you register, sign in or change your settings.
- Authentication data: one-time verification code hash and its expiration time (10 minutes).
- Content data: plan photos captured in the app, highlighted areas, questions and other chat messages, AI responses and chat titles. We collect them when you start an analysis or send a message.
- Operational data: logs, diagnostics, and security records.
3. Purpose and legal basis
We process data for one-time-code sign-in, customer account management, service abuse prevention, plan analysis and chat responses, and account deletion request handling. Plan photos and chat content are kept in private storage so you can view your plans and chats again.
Accepting the Privacy Policy and Terms of Use is required before requesting a sign-in verification code. This does not grant permission for AI sharing. Before the first AI request, the app separately explains the sharing and asks for your explicit permission.
Legal bases include contract performance, legitimate interest in system security, and consent where required. Sharing plan and chat content with external AI providers requires your separate permission.
4. AI data sharing and recipients
When you permit AI sharing and request an analysis, our server sends the plan photo with the highlighted area and relevant chat content to the AI provider we have selected: OpenRouter (OpenRouter, Inc., USA) or DeepInfra (Deep Infra Inc., USA). Either one forwards these inputs to Google, which runs the Gemini model. Follow-up questions, relevant conversation history and short excerpts used to generate chat titles may also be sent. Photos and text can contain personal data that appears in the plan or your messages.
The sole purpose of this sharing is to explain the plan, answer questions and generate a short chat title. Through OpenRouter, requests are routed only to Google Vertex endpoints with zero data retention that do not collect data for model training; OpenRouter may process limited data for security, abuse prevention, billing or legal obligations. DeepInfra does not store prompt or response content: inputs and outputs are kept only in memory while a request is processed, and it may process limited metadata for billing, reliability and abuse prevention. When DeepInfra forwards a request to Google, Google may store the output under its own terms (the Google Privacy Notice). See OpenRouter's privacy policy and DeepInfra's data privacy policy.
You can withdraw AI permission in the app's Settings. This blocks new AI analyses and replies, including pending requests that have not yet reached the AI provider. Withdrawal does not remove data already sent or delete plans and chats stored in your account; request account deletion to remove those records.
5. Retention and deletion
Verification codes are valid for 10 minutes. After successful verification, code authentication data is removed.
After an account deletion request, the account is blocked immediately. After 30 days, unless support cancels the request before the deadline, the account, saved plans, photos and chat records are permanently deleted from our active service. AI providers' limited security or legal retention may follow their own policies.
6. Your rights
You have the right to access, rectify, erase, restrict processing, portability, and objection. You also have the right to lodge a complaint with the relevant supervisory authority.