Privacy Policy

RightPlano (“RightPlano”, “we”, “us”) is a financial planning application available at www.rightplano.com and app.rightplano.com. It is currently operated by its founder as an individual while a legal entity is being formed in [the United Arab Emirates; update entity name, legal form, and license number upon incorporation].

For anything in this policy, contact privacy@rightplano.com. A postal address will be added here once the entity is registered: [registered business address].

• We never ask for bank logins and never sell or share your personal data for advertising.
• Anything left in your browser by our retired browser-only mode stays on your device unless you create an account, which brings it across.
• With an account, we store what you enter so we can sync it across your devices. Only you can access it.
• Essential cookies only, and no advertising trackers at all. Product analytics exist but stay off unless you turn them on, and you can change that at any time.

Account data. Your email address and a password (stored as a hash by our authentication provider, Supabase). If you sign in with Google, we receive your email and basic profile from Google.

Financial planning data you enter. Holdings, balances, budgets, debts, incomes, expenses, goals, and scenario assumptions. We store this only to provide the service (saving and syncing your plan). It is locked to your account: our systems enforce that only you can read it.

Data left in your browser. RightPlano used to be usable without an account. Anything you entered that way is still in your browser’s storage on your device, and is never transmitted to us unless you create an account and we bring it across for you.

Technical data. Session cookies to keep you signed in, security signals processed by Cloudflare Turnstile to block bots, and standard server logs (IP address, user agent, timestamps) kept briefly for security and abuse prevention.

Product analytics, only if you allow them. If you opt in, Vercel Web Analytics and Speed Insights record which pages are visited, how quickly they load, and broad device, browser and country information. They set no cookies, they never receive your financial planning data, and they do not run at all until you say yes. You can withdraw that permission whenever you like on the Cookie Policy page.

Correspondence. Emails you send us, including support requests.

What we do not collect: bank or brokerage credentials, government identifiers, advertising identifiers, or cross-site tracking data.

• To provide the service you asked for (account, sync, subscriptions): performance of a contract (GDPR Art. 6(1)(b)).
• To secure the service (fraud and abuse prevention, logs, Turnstile): our legitimate interests (Art. 6(1)(f)).
• To meet legal obligations (tax and accounting records for paid plans): legal obligation (Art. 6(1)(c)).
• Product analytics, and anything else optional we may add later such as a newsletter: your consent (Art. 6(1)(a)), which you can withdraw at any time.

We do not use your data for automated decision-making with legal effect, and we do not use your financial data for advertising, profiling, or training third-party models.

We use a small set of infrastructure providers, each acting under contract as a processor:

• Supabase: database and authentication (stores account and planning data).
• Vercel: application hosting, content delivery, and (only with your consent) product analytics.
• Resend: transactional email (sign-in and account emails from mail.rightplano.com).
• Cloudflare: Turnstile bot protection on auth forms.

Some providers process data outside your country, including in the United States and the European Union. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK Addendum. [Confirm final hosting regions and transfer mechanism at launch; current production database region: AWS ap-northeast-2 (Seoul), Vercel functions region pinned nearby.]

• Account and planning data: for as long as your account exists. Deleting your account deletes this data from production systems, with encrypted backups expiring on a rolling schedule within 30 days.
• Server and security logs: up to 30 days unless needed for an active investigation.
• Billing records (once paid plans launch): as long as tax law requires, typically 5 to 7 years.
• Support emails: up to 24 months after the thread closes.

Depending on where you live, you have rights over your personal data. We honour the strongest applicable set for everyone where practical:

• Access, correction, deletion, and portability of your data (GDPR, UK GDPR, CCPA/CPRA, UAE PDPL).
• Restriction of, or objection to, certain processing (GDPR and UK GDPR).
• Withdrawal of consent at any time for anything based on consent.
• No sale, no sharing: we do not sell personal data or share it for cross-context behavioural advertising, so there is nothing to opt out of under the CCPA/CPRA. We do not discriminate against you for exercising rights.
• Complaints: you may lodge a complaint with your EU supervisory authority, the UK ICO, the California Attorney General, or the UAE Data Office, as applicable.

To exercise any right, email privacy@rightplano.com from the address on your account. We respond within 30 days (45 for complex CCPA requests). Most of it you can do yourself: your data is visible in the app, exportable (Pro), and your account can be deleted from settings.

Essential cookies only: session cookies that keep you signed in, and Cloudflare Turnstile security. Our product analytics set no cookies at all, and they stay off unless you allow them. There are no advertising cookies. Details in the Cookie Policy.

In transit. Traffic between your browser and our servers is encrypted with TLS 1.2 or higher.

At rest. Data stored on our servers, including database volumes and backups, is encrypted at rest with AES-256 by our infrastructure providers.

Isolation. Every table holding your data enforces row-level security in the database itself, not only in application code. Each row is bound to the account that owns it, so a request authenticated as anyone else cannot read it. New tables receive this protection automatically rather than by manual step.

Passwords. Stored only as salted hashes by our authentication provider. We never see or store your plaintext password.

Data left in your browser. Figures entered under our retired browser-only mode stay in your browser’s local storage on your own device until you create an account, which brings them across. Until then we neither receive nor encrypt that data. Your own device and browser protect it, and clearing browser storage erases it permanently.

No system is perfectly secure and we do not claim otherwise. If a breach affects you, we will notify you and the relevant authorities as the law requires.

RightPlano is not directed at children and may not be used by anyone under 18. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

We will post any changes here and update the date at the top. For material changes that affect account holders, we will email you before they take effect.