Data protection
Data protection and IT security, wherever you live
Plan Our Life is used from Sweden to South Africa, so we apply one standard everywhere rather than a weaker default outside Europe. Below is what your local law gives you and what we commit to doing about it.
Last updated 7 August 2026
Your rights in your country
GDPR (Regulation (EU) 2016/679) · Detected country
Wherever you use Plan Our Life from, we apply one standard: full export and one-click deletion from Settings, per-account data isolation, no sale or sharing of personal data, and no advertising profiling. If your country has a data protection authority, you can complain to it at any time.
- Access a copy of your data
- Rectify inaccurate data
- Erasure (be forgotten)
- Data portability in a machine-readable format
- Object to, or restrict, processing
- Lodge a complaint with your supervisory authority
Data protection worldwide: your local data protection authority
One standard, applied globally
Every account — regardless of country — gets the same self-service export, the same one-click deletion, the same per-account data isolation and the same audit log. We do not sell, share or broker personal data anywhere, and we run no advertising profiling. These are commitments about how the product is built; they are not a claim of certification or of formal compliance assessment under any of the laws below.
Requests and complaints: privacy@plantourlife.com. Security reports: security@plantourlife.com.
European Union / EEA
GDPR (Regulation (EU) 2016/679)
Anyone in the EU or EEA using Plan Our Life.
Authority: National data protection authorities, coordinated by the EDPB
- Access a copy of your data
- Rectify inaccurate data
- Erasure (be forgotten)
- Data portability in a machine-readable format
- Object to, or restrict, processing
- Lodge a complaint with your supervisory authority
What we do: Every right above can be exercised from Settings — one click exports your full record as JSON, one click deletes your account and all household data. Nothing you enter is sold, brokered or used for advertising.
European Union
NIS2 (Directive (EU) 2022/2555)
Baseline cyber-risk management and incident handling practices.
Authority: National cybersecurity authorities / CSIRTs
- Risk analysis and information system security policies
- Incident handling and reporting
- Access control and authentication
- Logging and monitoring
- Supply-chain security
What we do: We follow NIS2's control areas as our internal security baseline: row-level access control on every table, an immutable audit log, automated anomaly alerts on repeated denied access, and a documented incident-response path. We are not designating ourselves an essential or important entity under NIS2.
United Kingdom
UK GDPR & Data Protection Act 2018
Users in the United Kingdom.
Authority: Information Commissioner's Office (ICO)
- Access, rectification and erasure
- Portability
- Object to processing
- Complain to the ICO
What we do: Handled identically to GDPR requests — same self-service export and deletion, same response commitment of 30 days.
Switzerland
revFADP (Federal Act on Data Protection)
Users in Switzerland.
Authority: Federal Data Protection and Information Commissioner (FDPIC)
- Access
- Correction
- Deletion
- Data portability
What we do: Same self-service tooling and response times as GDPR.
California, United States
CCPA / CPRA
California residents.
Authority: California Privacy Protection Agency (CPPA)
- Know what is collected and why
- Delete personal information
- Correct inaccurate information
- Opt out of sale or sharing
- Limit use of sensitive personal information
- Non-discrimination for exercising rights
What we do: We do not sell or share personal information, and we run no cross-context behavioural advertising — so there is nothing to opt out of. Financial ranges are treated as sensitive and used only to produce your own plan.
United States
State privacy acts (VA, CO, CT, UT, TX, OR, MT and others)
Residents of US states with comprehensive privacy laws.
Authority: State attorneys general
- Access
- Deletion
- Correction
- Portability
- Opt out of targeted advertising
What we do: One privacy standard applies globally rather than a weaker default outside the EU — the same export and delete controls are available to every account.
Canada
PIPEDA (and Quebec Law 25)
Users in Canada.
Authority: Office of the Privacy Commissioner of Canada
- Access your personal information
- Challenge accuracy
- Withdraw consent
- Portability (Quebec Law 25)
What we do: Consent is the basis for everything you enter; withdrawing it means deleting the account, which removes the underlying records rather than flagging them.
Brazil
LGPD (Lei Geral de Proteção de Dados)
Users in Brazil.
Authority: Autoridade Nacional de Proteção de Dados (ANPD)
- Confirmation and access
- Correction
- Anonymisation or deletion
- Portability
What we do: Served by the same export and deletion controls.
South Africa
POPIA (Protection of Personal Information Act)
Users in South Africa.
Authority: Information Regulator
- Access
- Correction
- Deletion
- Object to processing
What we do: Household data is isolated per account at the database level; no operator shares it onward.
Kenya
Data Protection Act, 2019
Users in Kenya.
Authority: Office of the Data Protection Commissioner
- Access
- Correction
- Deletion
- Object to processing
What we do: Same self-service access, correction and deletion tooling.
Nigeria
Nigeria Data Protection Act, 2023
Users in Nigeria.
Authority: Nigeria Data Protection Commission (NDPC)
- Access
- Rectification
- Erasure
- Restrict processing
- Portability
What we do: Same self-service access, correction and deletion tooling.
West and East Africa
Ghana Data Protection Act 2012, Uganda DPPA 2019, Tanzania PDPA 2022
Users in Ghana, Uganda and Tanzania.
Authority: National data protection commissions
- Access
- Correction
- Deletion
- Object to processing
What we do: Same self-service access, correction and deletion tooling.
Australia
Privacy Act 1988 (Australian Privacy Principles)
Users in Australia.
Authority: Office of the Australian Information Commissioner (OAIC)
- Access
- Correction
- Anonymity where practical
- Complain to the OAIC
What we do: Only an email address is required to hold an account — we ask for no identity documents and no exact address.
New Zealand
Privacy Act 2020
Users in New Zealand.
Authority: Office of the Privacy Commissioner
- Access
- Correction
- Complaint
What we do: Same self-service access and correction tooling.
Japan
APPI (Act on the Protection of Personal Information)
Users in Japan.
Authority: Personal Information Protection Commission (PPC)
- Disclosure
- Correction
- Cessation of use
- Deletion
What we do: Served by the same export and deletion controls.
South Korea
PIPA (Personal Information Protection Act)
Users in South Korea.
Authority: Personal Information Protection Commission
- Access
- Correction
- Suspension of processing
- Deletion
What we do: Served by the same export and deletion controls.
India
Digital Personal Data Protection Act, 2023
Users in India.
Authority: Data Protection Board of India
- Access a summary of processing
- Correction
- Erasure
- Grievance redressal
What we do: The activity log in Settings is the processing summary — it shows what changed, when, and from which session.
Singapore
PDPA (Personal Data Protection Act)
Users in Singapore.
Authority: Personal Data Protection Commission (PDPC)
- Access
- Correction
- Withdraw consent
What we do: Served by the same export and deletion controls.
Not listed here?
If your country has a data-protection law that is not covered above, the same rights apply in practice — write to privacy@plantourlife.com and we will handle the request under the strictest standard we operate to. See also the privacy notice and the security overview.