Privacy Policy

This Privacy Policy describes how Devsoft Solutions ("we," "us," or "our"), the company behind Onplana, collects, uses, discloses, and protects your personal information when you use the Onplana platform, website (onplana.com), and related services (collectively, the "Service").

1. Information We Collect

1.1 Information You Provide

• Account information: Name, email address, and password when you create an account.
• Organization data: Organization name, team members, and billing information.
• Project data: Projects, tasks, comments, documents, and other content you create within the Service.
• Payment information: Credit card and billing details processed securely by our payment processor (Stripe). We do not store full card numbers on our servers.
• Communications: Information you provide when contacting support, submitting feedback, or responding to surveys.

1.2 Information Collected Automatically

• Usage data: Pages visited, features used, and actions taken within the Service.
• Device information: Browser type, operating system, device type, and screen resolution.
• Log data: IP address, access times, referring URLs, and error logs.
• Cookies and similar technologies: See our Cookie Policy for details.
• Session analytics (free plan, opt-in): Inside the application, on the free plan only and only if you opt in, we use Microsoft Clarity for de-identified, fully-masked session analytics (heatmaps and session replay) to understand where the product is confusing and improve it. Clarity masks all text, form input, names, and file contents, so page content and personal data are not captured, and we never send Clarity a personal identifier. Paid plans are excluded. We also honor Global Privacy Control and Do Not Track as an automatic decline, and you can opt out any time under Settings › Privacy & Data. See our Cookie Policy and Subprocessors page.

1.3 Information from Third Parties

• SSO providers: If you sign in via SAML or OIDC (e.g., Azure AD, Okta), we receive your name, email, and identity provider metadata.
• Imported data: When you upload native .mpp files or import Microsoft Project XML exports (MSPDI), we process the project data you choose to import.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and send billing-related communications
• Send product updates, security alerts, and support messages
• Respond to your requests and provide customer support
• Analyze usage patterns to improve features and user experience
• Detect, prevent, and address security incidents and fraud
• Comply with legal obligations

3. AI Data Processing

Onplana's AI features are powered by Anthropic's Claude and/or Azure OpenAI. Onplana operates both providers and selects the active one at the platform level (for example, to fail over during a provider outage). The active provider processes your project data to generate risk detection, plan generation, and other AI-powered recommendations. Important details:

• Your data is not used to train AI models. Project data sent to AI providers is used solely to generate responses for your specific request.
• AI processing occurs in real-time and data is not retained by AI providers beyond the duration of the request.
• Onplana-managed providers: Onplana operates both AI providers itself and decides which serves requests, with the other on standby. Provider credentials are held by Onplana; there is no customer-supplied AI provider.
• You can disable AI features at any time without affecting core platform functionality.
• Quality review on Free plans. Conversations with the in-app AI assistant in Free-plan workspaces may be reviewed to find and fix cases where the assistant answered badly, and to detect abuse. This review is automated; where a problem is found, the relevant excerpt may be seen by a member of the Onplana team so it can be corrected. Access is limited to staff with platform-administrator rights and every read is recorded in an internal audit log. This does not apply to paid plans, and no conversation content is used to train AI models.

4. Third-Party Integrations

When you connect a third-party service (Google, Microsoft, and other providers listed on our Integrations page) to your Onplana workspace, Onplana receives access tokens that allow us to access specific data from that service on your behalf. We request the narrowest scope necessary for each feature and store all tokens encrypted at rest using AES-256-GCM.

4.1 Google User Data

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we access:

• Google Calendar (calendar.events): to display your events alongside Onplana tasks and to create/update calendar events when you sync Onplana tasks to your calendar.
• Google Drive (drive.file): to attach files you explicitly select through the Drive file picker to Onplana tasks and projects. We do not scan, list, or access any file you have not explicitly chosen.
• Gmail (gmail.metadata): to read message metadata (subject, sender, date, labels) so you can turn emails into Onplana tasks. We do not access email bodies or attachments.
• Google Workspace Directory (admin.directory.user.readonly): to import your organization's users when an admin sets up team provisioning. Read-only.
• Google profile (openid, profile, email): to identify you when you sign in with Google.

How we use this data:

• Calendar events, Drive file metadata, email metadata used to create tasks, and imported directory users are visible only to members of the specific Onplana organization you authorized the connection for.
• We do not sell, rent, or share Google user data with third parties for advertising.
• We do not use Google user data to train artificial intelligence or machine-learning models.
• We do not transfer Google user data except to comply with applicable law or as part of a merger, acquisition, or sale of assets, with user notice.

Where we store it:

• Access tokens and refresh tokens: encrypted with AES-256-GCM and stored in our managed PostgreSQL database hosted on Microsoft Azure (West US region).
• Cached calendar and file metadata: stored within your organization's tenant database and not shared across Onplana organizations.
• Email-derived tasks and imported directory users: stored as standard Onplana organization data within your tenant database. Gmail message metadata is read on demand and is not cached; only the task you create from an email is retained.
• All data in transit uses TLS 1.2 or higher.

How to disconnect and delete:

• Click "Disconnect" on any integration from your Onplana Integrations page. Access tokens are revoked at Google within seconds; cached data is deleted within 24 hours.
• You can also revoke Onplana's access directly at myaccount.google.com/permissions.
• For complete account deletion, including all associated Google-derived data, contact privacy@onplana.com, or follow the steps on the delete your account page.

4.2 Microsoft User Data (via Microsoft Graph)

We access the following scopes when you connect a Microsoft account:

• Outlook Calendar (Calendars.Read): to display meetings in your Onplana dashboard.
• OneDrive (Files.ReadWrite.All or narrower, depending on feature): to attach files you select to Onplana tasks.
• Microsoft profile (User.Read): to identify you when signing in with Microsoft.

Use, storage, and deletion practices for Microsoft data are identical to those described for Google user data above.

You can revoke Onplana's access to your Microsoft account at myaccount.microsoft.com or via your organization's Microsoft 365 admin center.

4.3 Data Retention Summary

5. How We Share Your Information

We do not sell your personal information. We share information only in these circumstances:

• Service providers: We use third-party services for payment processing (Stripe), email delivery (Azure Communication Services), hosting (Microsoft Azure, West US), and analytics. For the full list with purposes, regions, and DPA references, see our Subprocessors page. These providers are contractually bound to protect your data.
• Within your organization: Other members of your Onplana organization can see project data, team information, and activity within the organization scope.
• Legal requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction.
• With your consent: We may share information with third parties when you explicitly authorize it (e.g., enabling integrations).

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. When you delete your account or organization:

• Project data is moved to soft-delete (Recycle Bin) for 30 days, then permanently deleted.
• Account information is deleted within 90 days of account closure.
• Backup copies are purged within 180 days.
• Anonymized, aggregated usage statistics may be retained indefinitely.
• Answers to the optional "where did you hear about Onplana?" and "why are you leaving?" questions: the option you chose is kept as an anonymous statistic, and any words you typed are deleted after 12 months, or when your account is erased if that comes first. Your answers are included in Export My Data.
• FREE-tier inactivity deletion: per our Terms of Service section 7.3, FREE-tier organizations that remain inactive for 90 days are automatically deleted. Self-service data export is available at any time at Settings, Privacy, Export My Data.
• Free tools (no account required): when you upload a schedule to a free tool such as the Schedule Health Check, the original file you uploaded is deleted within 24 hours. The parsed schedule we analyse is kept for 30 days, after which it is deleted and only the analysis results remain, so your report stays readable. Generated report downloads (PDF, Excel, CSV) are kept for 90 days. The analysis record itself is deleted after 12 months.
• Published schedule statistics: we may publish anonymized, aggregate statistics about schedules uploaded to our free tools or opened in the Onplana Schedule desktop app with usage data turned on. These are counts and rates only, such as how many schedules fail a quality check. They never include file contents, file names, project or task names, or anything that identifies a person or company. We do not publish a figure drawn from fewer than 20 schedules, and schedules from paying customers' organizations are not included.

7. Email Communications

Onplana sends the following categories of email:

Transactional emails (always sent, regardless of preferences):

• Account confirmation, password reset, 2FA codes
• Project notifications you've subscribed to in-app
• Service-critical alerts (suspension, billing failures, security events)

FREE-tier onboarding emails (sent to new FREE-tier users in their first 30 days):

• A welcome email on Day 1 of your account
• A nudge on Day 2 if you signed up by connecting an AI assistant and have not used it yet, sent instead of the Day 1 welcome
• A check-in email on Day 25

FREE-tier inactivity emails (sent to inactive FREE-tier organizations, see our Terms of Service section 7.3 and the Free-tier policy):

• A warning email after 45 days of inactivity
• A suspension notice after 60 days
• A deletion confirmation after 90 days

FREE-tier emails about paid plans (sent to FREE-tier workspaces, see the Free-tier policy for who receives each and how often): some emails show what the paid plans add and invite an upgrade.

• The Day 1 welcome to workspace owners and the Day 25 check-in, which each include a section on the paid plans
• An email sent once when a workspace reaches a limit of the Free plan
• A one-time email about the paid plans to owners of established, active workspaces
• A one-time offer of the Enterprise trial
• A one-time email about buying through Microsoft Marketplace
• An upgrade offer we send to selected workspaces

Legal basis for all of these: legitimate interest (GDPR Article 6(1)(f)). The onboarding and inactivity emails are an inherent part of providing the FREE tier service. The emails about paid plans go to people already using Onplana and are about the service they use, so they are not gated on marketing consent, and each carries a one-click unsubscribe.

You can unsubscribe from all of these at any time via the link in each email footer, or in Settings, Notifications, Lifecycle emails. Unsubscribing stops the onboarding, inactivity and paid-plan emails together; transactional emails (password reset, 2FA, project notifications you subscribed to) continue regardless.

Open and click measurement: lifecycle and free-tool follow-up emails include a standard tracking pixel and use redirect links so we can measure opens and clicks in aggregate (which emails are useful, which to cut). Transactional emails are never measured: they contain no tracking pixel and no rewritten links, and measurement is technically disabled on the transactional sender domain. Unsubscribing from the lifecycle channel stops this measurement entirely. Open data is approximate (some mail clients pre-fetch images for every message). See the Free-tier policy section 8 for details.

Marketing communications (only sent with explicit opt-in):

• Product newsletters, webinar invitations, customer-success stories
• Requires opt-in at signup or in Settings; can be revoked at any time.

We honor unsubscribe requests within 10 business days (CAN-SPAM Act compliance). California, Virginia, Colorado, Connecticut, and Utah residents: see our Do Not Sell or Share My Personal Information notice below.

8. Data Security

We implement industry-standard security measures including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Access controls with role-based permissions and audit logging
• Infrastructure hosted on SOC 2 compliant cloud providers
• Two-factor authentication (TOTP) available for all accounts
• IP allowlisting and session management for Enterprise plans

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete information
• Delete your personal data (right to erasure)
• Export your data in a portable format
• Object to or restrict certain processing activities
• Withdraw consent where processing is based on consent

To exercise these rights, email privacy@onplana.com. We will respond within 30 days.

9.1 Do Not Sell or Share My Personal Information (CCPA / VCDPA / CPA / CTDPA / UCPA)

California, Virginia, Colorado, Connecticut, and Utah residents have the right to opt out of the sale or sharing of their personal information. Onplana does not sell personal information.

We do engage in one form of sharing that may qualify as "cross-context behavioral advertising" under CCPA: as described in section 9.2 below, when you have explicitly opted into marketing communications, we may share a one-way hashed form of your email address with LinkedIn and Google Ads so those platforms can show you Onplana ads and identify users with similar profiles. This activity is limited to users who have given marketing consent and uses irreversible SHA-256 hashing, not plaintext addresses.

To exercise the right to opt out of any sale or sharing, including the ad-platform export described in section 9.2, email privacy@onplana.com with the subject line "Do Not Sell or Share". You may also use the unsubscribe link in any marketing email; revoking marketing consent automatically removes you from future ad-platform exports as well.

9.2 Retargeting & Lookalike Audiences (LinkedIn, Google Ads)

If you have given explicit marketing consent (typically via the marketing-email opt-in during signup or the Day 10 in-app prompt), Onplana may include your email address in audience lists shared with our paid advertising platforms, currently LinkedIn Matched Audiences and Google Ads Customer Match. Two important properties:

• We share a SHA-256 hash, not your plaintext address. Each platform receives a 64-char hexadecimal hash of your normalized email. The hash is one-way: the platform cannot derive your plaintext address from it. If your address matches a hash they already have on file, you become eligible to be shown Onplana ads; otherwise the hash is discarded by the platform after the retention window.
• The lookalike step happens platform-side. Once the platform has matched your hash, it may use its own internal signals to find users with similar profiles and serve them Onplana ads. Onplana never sees the lookalike audience members or their personal data.

Opting out: revoke marketing consent (unsubscribe from any marketing email, or emailprivacy@onplana.com) and you will be excluded from all future audience exports. We cannot retroactively remove your hash from a list a platform already received, but the platforms' own retention windows (typically 540 days for LinkedIn, periodic refresh for Google) mean the hash drops out of active matching automatically once we stop including you in subsequent exports.

Users who have NOT given marketing consent are never included in these exports. Freebie tool users who only submitted an email to unlock a report, without converting to a signed-up account that opted into marketing, are never exported. Signed-up users who unsubscribed from marketing are never exported.

9.3 Follow-up emails after using a free tool

When you submit your email to unlock a report from any of Onplana's free tools (Schedule Health Check, Migration Preview, PMO Maturity Assessment, Resource Heatmap, Resource Leveler, Migration Cost Calculator, Status Report Writer, AI Gantt), you'll receive:

• One email with your report, sent immediately after you complete the unlock form. This is the report you asked for; it's the whole point of submitting your address.
• A short follow-up series, typically 3 to 5 emails over the following 2 to 4 weeks, containing tips and patterns related to the same topic (resource overallocation, MS Project migration, schedule health, etc.). The exact number depends on which tool you used: 3 emails for AI Gantt / Resource Leveler / Resource Heatmap / Migration Cost Calculator / Status Report Writer, 4 emails for PMO Maturity Assessment, 5 emails for Schedule Health Check and Migration Preview.

Why we send them: the follow-up series is the most efficient way for us to share related tactics, gotchas, and edge cases that didn't fit in the report itself. Under EU GDPR Article 6(1)(f) we rely on legitimate interest as the lawful basis, you explicitly requested the report and reasonably expect related follow-up communications about the same subject for a short window. Under US CAN-SPAM the series complies via per-email unsubscribe headers and the unsubscribe link in every footer.

How to stop them: click "Unsubscribe" in the footer of any follow-up email, or click the one-click unsubscribe affordance your mail client surfaces (Gmail and Apple Mail render this natively because we ship RFC 8058 List-Unsubscribe headers). Either way, you'll be removed from the series immediately. Unsubscribing from a follow-up series is independent of any account-level marketing consent you may set separately if you later sign up for an Onplana account.

What we do NOT do with these submissions:

• We do not share your address with third parties (see section 9.2, only signed-up users with explicit marketing consent are eligible for hashed-email export to ad platforms).
• We do not retain your uploaded files past the documented retention window (see the free-tool retention entry in section 6).
• We do not enroll you in unrelated marketing campaigns (newsletters, webinars, surveys) without separate consent. The follow-up series is scoped to the topic of the tool you used.

9.4 Opening a demo workspace

When you open a demo workspace from onplana.com/demo-workspace or onplana.com/services, you do not create an Onplana account. This is what we collect and what we do with it.

The demo lasts 24 hours. Then it closes and is deleted.

How long we keep it

• The demo closes after 24 hours and is deleted within the following day, with everything in it and the record of your demo session, including your IP address. One thing is kept: the list of pages you opened and features you used, described below.
• We keep your email address, company, role, where you came from, and that list until you ask us to delete them. Email privacy@onplana.com and we will delete them within 30 days.

What we collect

• Your email address, and your company and role if you enter them.
• Where you first came from: the campaign tags on the link you followed, the website that sent you (its name only, not the page), and the first page you visited on onplana.com.
• In the demo, which pages you opened and which features you used, with the time of each. We record the page address and the name of the action, not what you typed or created.
• For the demo session, your IP address and browser type.
• The captcha is run by hCaptcha, which sees your IP address while it checks.

Why

• To open the demo for you, and to limit how many demos one network can open. For that limit we keep a one-way hash of your IP address for one hour.
• So we know who asked for a demo and which parts of Onplana interested you. People at Onplana may see your address, where you came from and what you used in the demo in our admin tools.
• To email you a link back to your demo, and to send it again if you enter the same address while the demo is open. The link stops working when the demo is deleted.

What we do not do

• We do not send you marketing email because you opened a demo, and we do not add you to a mailing list.
• We do not share your address with advertising platforms.
• Nothing you do in the demo is linked to an Onplana account, and nothing moves to one.

10. International Data Transfers & Subprocessors

Your data may be processed in countries outside your country of residence. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) for transfers outside the European Economic Area. For the full list of subprocessors Onplana engages, their purpose, data category, and region, see our Subprocessors page, updated whenever the list materially changes, per GDPR Art. 28(2).

11. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us at privacy@onplana.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, for significant changes, by sending an email to the address associated with your account.

13. Browser Extension and Companion Apps

Onplana Tasks is available as a browser extension (Chrome, Edge, Firefox and Safari), a Windows desktop app, and an iPhone app. They are clients for the same workspace data described above rather than a separate service, so the rest of this policy applies to what they send us. This section covers what they do on your device, because that is the part the rest of the policy cannot describe.

The extension does not read the pages you visit. It requests access to exactly three addresses: our API, our sign-in service, and a single page on app.onplana.com used to complete sign-in. It runs one script on that sign-in page and on no other page anywhere. It does not request access to all websites, and it has no ability to watch your browsing.

Page details are captured only when you ask for them. When you choose "Add to Onplana" or "Log an issue about this page", the page address, its title and any text you had selected are sent to your workspace to create that item. Attaching a screenshot captures the visible tab at the moment you click. Nothing is captured in the background, and nothing is captured from a page you have not acted on.

Without an account, nothing leaves your device. The extension can be used in a local mode where tasks are stored in the browser only. In that mode it makes no network requests to us at all, which is enforced by an automated test rather than only by intent. Uninstalling removes that local data.

When you do sign in, an access token is stored on your device so the app can reach your workspace, along with a cached copy of your recent tasks so the app still works offline. Signing out removes them.

Usage and error data are sent only while you are signed in. Once you sign in, the Onplana Tasks desktop app and browser extension send two kinds of data, and nothing before: counts of how features are used, for example how often capture is used, and reports of errors the app runs into, so we can fix them. Both are identified by a random value the app makes on first run, which is not derived from you or your account. They carry no sign-in token, so we cannot link them to you, your workspace or your colleagues. Error reports carry the app's version, your platform, and the error's message and technical details, with file names, folder paths and email addresses removed on your device and again on our servers. Neither carries page addresses or task content. You can turn both off in the app's settings, under "Share usage and error data". We keep error reports for 90 days and usage counts for 13 months. The phone app sends neither.

Apple, Google, Microsoft and Mozilla distribute these apps and may collect their own data about installs and crashes under their own privacy policies. That is between you and them; it is not data we receive.

14. Apps Built on Onplana

Customers can build and publish their own applications on Onplana, served at addresses such as example.onplana.app or a domain of their own. If you used one of those apps, this section applies to you, and the rest of this policy mostly does not.

The app's owner decides what that app collects, and is the data controller for it. Onplana hosts the app and stores what it collects on the owner's behalf, which makes us a processor acting on their instructions. We do not use that data for our own purposes, and we do not sell it.

What we hold about a visitor depends on what the owner switched on. An app can be open to anyone, protected by a shared passcode, or ask visitors to confirm an email address before entering. Where an email is used to sign in, the platform stores only a one-way cryptographic hash of it, so the address itself is not kept in our database; anything else the app asks you for is held in the owner's workspace, under their control.

To see, correct, or delete what an app holds about you, contact the owner of that app, since they decide what happens to it. If you cannot reach them, write to privacy@onplana.com and we will help you identify the right contact and pass the request on. We will act on a controller's erasure instruction, but we will not delete a customer's data on a third party's request without it.

Customers processing visitor data this way are covered by our Data Processing Agreement, which sets out our obligations as processor.

15. Microsoft 365 apps: Teams, Copilot and SharePoint

Onplana offers three apps for Microsoft 365: Onplana for Microsoft Teams, the Onplana agent in Microsoft 365 Copilot, and Onplana Projects for SharePoint. The Teams app and the Copilot agent are installed together as the app named "Onplana". All three work with the same workspace data described above, so the rest of this policy applies to them. This section covers what each one handles.

Signing in with Microsoft. These apps sign you in with your Microsoft 365 account. Microsoft gives us your Microsoft account's object ID, your organization's tenant ID, your email address and your display name. We use them to find your Onplana account, and we store the object ID and email address with it so the apps can recognize you next time. We never receive your Microsoft password.

15.1 Onplana for Microsoft Teams

• Tabs. The Teams tabs show Onplana's web app inside Teams and handle data the same way. The first time you sign in from a tab, an Onplana account may be created for you if you do not have one.
• Create a task from a message. When you choose "Create an Onplana task" on a message, the form is filled in from that message: its first line as the title, and its text plus a link back to the message as the description. You can edit both. When you save, they are stored as an ordinary task in the project you pick, assigned to you. We do not add the message author's name or email address. Nothing is stored if you close the form without saving.
• Link previews. When you paste a link to an Onplana project or task into a chat, a preview card appears that everyone in the chat can see. It shows the item's title, type and status, and only when you can open that item in Onplana. Otherwise it says only that it is an Onplana link. We never fetch the page a pasted link points to.
• The notification bot. The bot does not chat. It welcomes you, helps you link your account, confirms tasks you create from a message, and, if your workspace turns them on, sends you timesheet and workflow approval cards. It sends only into your one-to-one chat with it. To do that we store a reference to that chat: the conversation ID, your Microsoft object ID and Teams user ID, and your tenant ID. We do not store message text. The bot recognizes you by your Microsoft object ID and never acts with a Microsoft token on your behalf. A decision you make on an approval card is recorded in Onplana the same way as one made on the web.

15.2 The Onplana agent in Microsoft 365 Copilot

• The agent connects to Onplana through a sign-in you approve. Microsoft 365 Copilot holds the access token; we store only a one-way hash of it. You can disconnect it in Onplana at any time, and "Logout All Devices" disconnects it too.
• Onplana receives only the calls the agent makes to Onplana's tools, such as a search term or the details of a task to create. It does not receive the rest of your Copilot conversation. What Onplana returns is shown to you in Copilot, and Microsoft processes it under its own terms.
• When the agent first connects, we add a member named "Microsoft 365 Copilot" to your workspace. Changes the agent makes are recorded under that member, together with the inputs it sent. Its role in the workspace is never higher than yours.

15.3 Onplana Projects for SharePoint

• Onplana Projects adds Onplana web parts and file commands to SharePoint Online. Your organization's SharePoint administrator installs it and approves its access to Onplana.
• Sign-in. SharePoint gives the web part a Microsoft token for Onplana, which we exchange for an Onplana session that lasts one hour. The session is kept in the page's memory only, never in browser storage, and ends when you leave the page. The browser remembers only preferences, such as which workspace you picked.
• It never creates an account. If you have no Onplana account, it sends you to Onplana to decide. A guest on a SharePoint site is signed in only when Microsoft has verified their email address.
• Files stay in SharePoint. Listing and uploading files happen through SharePoint, as you, under SharePoint's permissions, and the files do not pass through Onplana's servers. When you link a file to a task, Onplana stores the file's name and address, not its contents, and makes no Microsoft Graph call. Removing the link leaves the file untouched. When a site owner connects a site to a project, Onplana stores the site's address and its document library's address.
• Usage counts. The web parts send counts of how they are used, for example that a part loaded or a sign-in failed. They never include an email address, a site address, a file name or the page you are on. While you are signed in, they are linked to your account like other usage events in Onplana.
• One permission. The package asks Microsoft for one permission, access to Onplana's service as you. It has no permission to read your mail, your OneDrive or your SharePoint content through Microsoft Graph. A SharePoint page is created only when someone chooses to set up the Onplana page on a site, with their own SharePoint rights.
• Read-only links. A web part can show a plan through an Onplana read-only link, for people without an Onplana account. Viewing it needs no sign-in, and we receive only what any visit to a web page sends, such as your IP address.
• Removing it. Your organization's administrators can remove the package from the SharePoint app catalog and withdraw its API approval and sign-in consent. Removing it deletes nothing in your Onplana workspace; to delete that data, see section 9.

16. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

• Email: privacy@onplana.com
• Company: Devsoft Solutions
• Postal address: 141 Traction St, Unit 2011, Greenville, SC 29611, USA
• EU representative (GDPR Art. 27): TBD
• Website: devsoft.com