Privacy Policy
This Privacy Policy explains what personal data Plan10 collects, why we use it, who we share it with, how long we keep it, and the rights you have under the Saudi Personal Data Protection Law (PDPL). It applies to the Plan10 website at plan-10.com and to the Plan10 app.
The short version
- We collect what you give us so Plan10 can plan your studies, plus limited technical data needed to run and protect the service.
- We do not sell your personal data and we do not use it for advertising.
- AI features and optional emails are used only with your permission, and you can change your mind at any time.
- Your data is stored with cloud service providers, some of them outside Saudi Arabia.
- You can see, download and correct your data in Plan10, and you can ask us to delete your account.
1. Who we are
Plan10 is a study planning and productivity platform for students, operated from the Kingdom of Saudi Arabia. Plan10 is the controller of the personal data described in this policy, which means we decide why and how it is processed.
For any question about this policy or your personal data, contact us at support@plan-10.com.
2. The personal data we collect
| Category | What it includes | Required? |
|---|---|---|
| Account data | Your name, email address and password. Your password is stored only in hashed form by our authentication provider; we never see it. Also your account creation date, role and account status. | Required to create an account. |
| Study content | The courses, subjects, lectures, notes, revisions, study rounds, planner lists, tasks, calendar events, countdowns, timetables, reminders and settings you create or import. | You decide what to enter. Plan10 cannot plan without it. |
| Public Library | Content you choose to publish, your display name shown with it, and the imports, ratings and reviews you make. | Optional. |
| AI features | Files you upload for an AI feature (for example a course schedule as a PDF or image), the text and instructions you enter, the results produced, and usage records (time, feature, size and processing cost). | Optional. Only if you use AI features. |
| Email communications | Your email address, records of the emails we send you and whether they were delivered, bounced or marked as spam, your email choices and the history of those choices. | Service emails are required. Other emails are optional. |
| Notifications | If you turn on reminder notifications in the app: a device push token, the device platform and app version, and whether this device has notification permission and has scheduled your upcoming reminders itself (so we do not also send them as push). Also your in-app notifications and whether you have read them. | Optional. |
| Support | Reports and messages you send us from inside Plan10 or by email, our replies, and the status of your request. A report also carries a little technical context added automatically: the platform (web, iPhone or Android), the app version and the screen you were on — never what was on it. Our support staff may add internal notes to handle your request. | Optional. |
| Usage data | Records of actions in Plan10 (for example creating a course or completing a revision), with the time, and when you were last active. | Collected automatically when you use Plan10. |
| Legal and privacy records | Which versions of our Terms of Service and Privacy Policy you accepted and when, your AI permission choices, and the privacy requests you make. | Required to keep a record of your agreement and your choices. |
| Technical data | Your IP address, browser or device type and similar request information, processed by our hosting, security and infrastructure providers, including security logs of sign-in activity. In the app, each device also sends sync records: a random identifier the app creates for that device (not a hardware or advertising identifier), the platform and app version, the device's time zone, and counts and times that show whether it is up to date (for example how many changes are waiting to be sent). These never contain your study content. | Collected automatically. |
We do not collect payment information (Plan10 is currently free), your location, your contacts, or access to your camera or microphone, and we do not use advertising identifiers.
Plan10 is not designed to hold health information or other sensitive personal data. Please do not enter information about your own or anyone else's health, or information that identifies other people, anywhere in Plan10 — including in support messages.
Plan10 does not ask for your age, date of birth or any identity document.
If you do not provide the data marked as required, we cannot create or operate your account. Choosing not to use an optional feature does not affect the rest of Plan10.
3. How we collect it
- Directly from you, through the forms, editors and file uploads in Plan10, and when you contact us.
- Automatically, as you use Plan10 (usage data, notifications state, technical data).
- From our email provider, which tells us whether an email we sent was delivered, bounced or marked as spam.
4. Why we use it, and our legal basis
Under the PDPL we may process personal data only for a stated purpose and on a legal basis. We rely on the following:
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating your account, signing you in and keeping it secure (including sign-up and password-reset codes) | Account data, technical data | Performing our agreement with you (the Terms of Service) |
| Providing Plan10: storing your study content and keeping it in sync on your devices | Study content, account data | Performing our agreement with you |
| The Public Library: showing what you publish to other users and letting you import and rate content | Public Library data, display name | Performing our agreement with you, when you choose to publish |
| AI features: sending your files and text to our AI provider to produce the result you asked for | AI feature data | Performing our agreement with you, when you ask for an AI feature. Because this content leaves Plan10, we also ask for your explicit permission before the first time, and you can withdraw it at any time |
| Reminders and push notifications | Notification data, study content | Your consent, given when you turn them on |
| Service emails that you need to use your account | Email address | Performing our agreement with you |
| Optional emails about new features, tips or offers | Email address | Your consent. These are off unless you turn them on |
| Answering your reports and requests, letting our support team know a new message has arrived, and telling you when we reply | Support data | Performing our agreement with you |
| Improving Plan10 from what users report | Support data | Our legitimate interest in improving Plan10 |
| Protecting Plan10 and its users: preventing abuse, enforcing usage limits, investigating misuse and suspending accounts that break the Terms | Account, usage and technical data | Our legitimate interest in keeping the service secure |
| Understanding how features are used so we can fix and improve them | Usage data, website analytics | Our legitimate interest in improving the service |
| Keeping records of your acceptances, choices and privacy requests, and meeting our legal obligations | Legal and privacy records | Legal obligations under the PDPL, and our legitimate interest in being able to show what you agreed to |
We rely on legitimate interest only where the processing is expected, limited and does not override your rights, and never for sensitive data. We do not use your personal data for purposes that are unrelated to the ones above without telling you first and, where required, asking for your consent.
5. AI features
Some Plan10 features use artificial intelligence to turn a course schedule into a study plan or to draft a study round. When you use one:
- The files, text and instructions you provide, and the relevant parts of your course or round, are sent to Google through the Gemini API to produce the result.
- We ask for your permission before the first time your content is sent. You can withdraw it at any time in Settings → Privacy & data; AI features then stop until you allow them again.
- The result is a draft for you to review. Nothing is saved to your plan until you choose to save it, and Plan10 does not make decisions about you based solely on automated processing.
- Plan10 deletes its copy of the files you uploaded, the text you submitted and the raw AI output about one day after the job. A record of the job (feature, time, status, size, processing cost and any instructions you typed) is kept with your account for usage limits, troubleshooting and cost tracking. What you save becomes part of your study content.
- Google processes this content under the Gemini API terms that apply to Plan10. Those terms allow Google to store it for a limited time, for example to detect abuse, and depending on the service level they may allow Google to use it to improve its services.
Please do not upload files that contain other people's personal data or any health information.
7. Data processed outside Saudi Arabia
As the table above shows, several of our providers process data outside the Kingdom, mainly in the European Union, and in some cases in the United States or on global networks. We transfer data only as needed to provide Plan10 to you, limit what is transferred to what each provider needs, use encrypted connections, and rely on the providers' contractual commitments to protect it. We will update this section if the Saudi rules on transfers or our providers change.
8. How long we keep it
| Data | How long |
|---|---|
| Account data and study content | While your account exists. When you delete an item in Plan10 it disappears from your account straight away; some items are kept in a deleted state in our database until your account is deleted, so that related data stays consistent. |
| AI uploads, submitted text and raw AI output | About one day after the job. The job record is kept while your account exists. |
| Usage data | While your account exists. |
| Support conversations, including internal notes about them | While your account exists. |
| Email records and email choices | While your account exists. |
| Addresses that bounced or marked our email as spam | Kept on a do-not-send list even after account deletion, so that we never email that address again by mistake. |
| Push device tokens | Until you sign out on that device, turn notifications off, or the token stops working. |
| Device sync records | While the device keeps connecting, and for up to one year after it last connected. Records of which changes the server has already applied are kept for 400 days, so that a change sent twice is never applied twice. |
| Legal acceptances and privacy choices | While your account exists. |
| Privacy requests | While your account exists. After an account is deleted we keep only a minimal record that the request was received and completed, without content from your account. |
| Technical logs | For short periods set by our hosting, security and infrastructure providers. |
Our database provider keeps backups for disaster recovery; deleted data leaves those backups when they expire on their normal schedule.
9. How we protect it
We use encrypted connections, access controls in our database that separate each user's data, hashed passwords, private storage for uploaded files, limited and logged administrator access, and monitoring of the services that handle your data. No system is perfectly secure. If a breach affects your personal data in a way that could harm you, we will notify the Saudi Data & AI Authority and you, as the PDPL requires.
10. Your rights
Under the PDPL you have the right to:
- Be informed about how and why your data is processed. This policy is our main way of doing that.
- Access your personal data. Most of it is visible in Plan10 itself.
- Obtain a copy of your personal data in a readable format. Use "Download my data" in Settings → Privacy & data; it includes your support conversations. Internal notes our staff wrote about a request are available by asking us.
- Correct, complete or update your data. You can edit your study content and display name directly; for anything else, send us a correction request.
- Ask us to destroy your personal data when it is no longer needed, including by deleting your account.
- Withdraw your consent at any time, for AI features, optional emails and push notifications, without affecting processing that happened before.
- Complain to the Saudi Data & AI Authority (see section 16).
You can make a request in Settings → Privacy & data, or by emailing support@plan-10.com from the address on your account. We may need to confirm it is really you. We respond within 30 days; if a request needs more time we will tell you why and extend by no more than 30 more days. Making a request is free. We may decline a request that is repetitive, clearly unfounded or would require disproportionate effort, or where the law requires us to keep the data, and we will tell you why.
11. Deleting your account
You can ask us to delete your account at any time in Settings → Privacy & data. We complete deletion within 30 days, and you can follow the request's status there and in the Support Center until it is done. Deletion removes your account, your study content, your AI jobs, your support conversations and feedback, your usage data and your email records. What you published in the Public Library is removed too, but copies that other users already imported into their own plans stay with them. We keep only what section 8 says survives deletion.
You can cancel a deletion request while it is still pending.
12. Emails and notifications
- Service emails, such as sign-up and password-reset codes, a notice that our support team has replied to you, and important messages about your account or these policies, are part of the service and are sent while you have an account.
- Optional emails, such as product news or offers, are off by default. You can turn them on or off at any time in Settings → Privacy & data, and every optional email tells you how to stop receiving it.
- Reminder notifications on your phone need both your device's permission and the reminder setting in Plan10. You can turn either off at any time. When the app is able to, it schedules your upcoming reminders on the device itself, so they arrive even without a connection; a reminder the device has scheduled is not also sent as a push notification.
13. Cookies and storage on your device
Plan10 does not set cookies. It stores a small amount of data in your browser or the app on your device: your sign-in session, a copy of your study data so the app loads quickly, and display preferences such as which panels are collapsed. Our website analytics, provided by Cloudflare, does not use cookies.
The Plan10 app can also work without a connection. For that it keeps on your device: a copy of your study data, changes you made that are waiting to be sent, support messages waiting to be sent and a copy of the support conversations you last opened, and the reminders it has scheduled. On iPhone your sign-in session is kept in the device's secure storage (the Keychain). If another device changed the same text before yours arrived, the app keeps your version on the device until you use it or dismiss it.
Signing out removes your session and your private study data from that device — including anything still waiting to be sent, after asking you first — and cancels the reminders scheduled on it.
14. Younger students
Plan10 is for students of any age. Under Saudi law, full legal capacity begins at 18. If you are under 18, you may use Plan10 only with the permission of your parent or legal guardian, and they can exercise your privacy rights for you, including asking us for a copy of your data or to delete it. A child under 7 may use Plan10 only through an account a parent or guardian manages.
Plan10 does not ask for your age or date of birth. If you are a parent or guardian with a question about your child's data, contact us at support@plan-10.com.
15. Changes to this policy
Each version of this policy has a version number and date. If we make a material change, for example to what we collect or who we share it with, we will tell you in Plan10 and ask you to review and accept the new version before you continue. Smaller changes, such as clarifications, are published with a new version number and date. You can ask us for any previous version.
16. Contact and complaints
Contact us at support@plan-10.com with any question, request or complaint about your personal data.
If you are not satisfied with our response, or we do not respond in time, you can complain to the Saudi Data & AI Authority (SDAIA), which enforces the PDPL: https://sdaia.gov.sa, or its National Data Governance Platform at https://dgp.sdaia.gov.sa. Complaints to SDAIA are generally expected within 90 days of the issue or of when you became aware of it.