Privacy Policy

1. Who We Are

Pleanáil is a curriculum planning platform for Irish primary schools, operated by Strattonite Limited, a company registered in Ireland (CRO).

Registered address: 152 Kimmage Road Lower, Harold's Cross, Dublin 6W, D6W YA70, Ireland.

Data Protection Contact: ciaran@pleanail.ie

Under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018, Strattonite Limited is the data controller for personal data processed through pleanail.ie.

2. What Data We Collect

2.1 Account Data

• Name, email address, password (bcrypt hash only), class level, school affiliation

2.2 Planning Data

• Fortnightly plans, long-term plans, Cúntas Míosúil, school plans, curriculum settings

2.3 Payment Data

• Stripe customer reference ID and subscription ID (we never store your card number, CVV, or bank details)
• For whole-school accounts: invoice records

2.4 Contact Form Data

• Name, email, role, message content

2.5 Usage Analytics

• Umami self-hosted cookieless analytics
• Server access logs via Nginx

3. How We Use Your Data

Purpose	Legal Basis
Providing the planning platform and features	Contract performance (Art. 6(1)(b))
Account authentication and security	Contract performance (Art. 6(1)(b))
Processing subscription payments via Stripe	Contract performance (Art. 6(1)(b))
Sending welcome emails and password resets	Contract performance (Art. 6(1)(b))
Responding to support/contact enquiries	Legitimate interest (Art. 6(1)(f))
Anonymous usage analytics (Umami)	Legitimate interest (Art. 6(1)(f))
Server security logging	Legitimate interest (Art. 6(1)(f))
Retaining financial records (invoices)	Legal obligation — Irish tax law (Art. 6(1)(c))

We never use your data for advertising, profiling, automated decision-making, or any purpose unrelated to providing the Pleanáil service.

4. Cookies

Pleanáil uses one essential cookie: an httpOnly authentication token that keeps you signed in.

We do not use any tracking, advertising, third-party, or analytics cookies.

Umami is entirely cookieless.

5. Who We Share Data With

Provider	Purpose	Location
Hetzner Online GmbH	Server hosting and data storage	Germany (EU)
Stripe, Inc.	Payment processing	USA (EU–US Data Privacy Framework)
Resend, Inc.	Transactional email delivery	USA (EU–US Data Privacy Framework)

Where data is transferred to the USA, each provider participates in the EU–US Data Privacy Framework (DPF), which provides an adequate level of data protection as recognised by the European Commission.

We never sell your personal data to anyone.

6. Where Your Data Is Stored

All primary data is stored on servers operated by Hetzner Online GmbH in Nuremberg, Germany, within the European Union.

Limited data is shared with Stripe and Resend in the USA, both of which operate under the EU–US Data Privacy Framework (DPF).

7. How We Protect Your Data

• Passwords stored as bcrypt cryptographic hashes
• All connections encrypted via HTTPS/TLS
• Authentication via httpOnly, secure JWT cookies
• Server access restricted to SSH key authentication only
• Firewall rules (Hetzner Cloud firewall + fail2ban)
• Security headers (Helmet.js) — rated A by securityheaders.com
• Rate limiting on auth and contact endpoints
• Honeypot fields on public forms
• Regular server updates and security patches

8. How Long We Keep Your Data

Data Type	Retention Period
Account data and planning content	Retained while active, deleted within 30 days of deletion request
Payment records and invoices	6 years (Irish Revenue, Taxes Consolidation Act 1997)
Contact form submissions	Up to 12 months, then deleted
Server access logs	Up to 90 days, auto-rotated
Anonymous analytics (Umami)	Indefinitely (fully anonymised)

9. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — You can request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — You can ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17) — You can request that we delete your personal data.
• Right to restriction of processing (Art. 18) — You can ask us to limit how we use your data.
• Right to data portability (Art. 20) — You can request your data in a structured, machine-readable format.
• Right to object (Art. 21) — You can object to processing based on legitimate interest.

To exercise any of these rights, contact us at ciaran@pleanail.ie. We will respond within 30 days.

10. Children's Data

Pleanáil is a professional tool designed for teachers and school principals. We do not knowingly collect any personal data from children or pupils.

No pupil data is collected, stored, or processed by the platform.

If you believe a child's data has been submitted to us in error, please contact us at ciaran@pleanail.ie and we will delete it promptly.

11. School Accounts (Whole School Plans)

When a school subscribes to a whole-school plan, the principal acts as a controller within the school context and may add teachers to the account.

Teachers added to a school account retain their individual rights, including the right to request deletion of their personal data.

Planning content created under a school account may be retained as institutional records, even after an individual teacher leaves the school.

12. Changes to This Policy

We may update this privacy policy from time to time. If we make significant changes, we will notify you by email.

The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Irish Data Protection Commission:

We encourage you to contact us directly at ciaran@pleanail.ie first so we can try to resolve your concern.