1. Scope and operator
This notice covers the PlancKey website, free external scans, demo requests and partner applications. PlancKey is currently a pre-registration project. This notice does not identify a registered legal entity or establish compliance with every privacy law. Full operator details must be published before commercial launch.
2. Information you provide
For scans, we collect your domain, work email, company size and confirmation that you are authorized to request the scan or are requesting it for supplier due diligence. For supplier scans, the vendor name and criticality tier you enter stay in your browser and are not sent to or stored by us. Demo requests include your name, work email, company, role, company size and reason for contacting us. Partner applications include your name, company, work email, client-count range and optional message.
Do not provide passwords, private keys, payment details, patient information or other sensitive personal data. We do not require access to your internal systems for a free scan.
3. Public observations and providers
Your submitted domain is sent to Google Public DNS and Qualys SSL Labs to obtain publicly observable DNS, HTTPS and certificate information. Your submitted email and company details are not included in those provider requests. Assessments can be cached, incomplete or unavailable, and the providers may retain their own records under their policies.
To estimate your sector, we may read the title and description of your submitted domain's public homepage and send them, with the domain, to an AI service operated through Lovable. Your email is not included.
Each scored scan is added to the anonymous Q-Signal™ Index benchmarks. Benchmarks show only group statistics for groups of at least five domains; your domain, email and individual score are never published unless you are a subscriber who chooses to be listed.
Website hosting and Lovable Cloud process submitted requests and operational data. Loading the site's Google Fonts also sends normal connection information, such as your IP address, to Google. Hosting and observation providers may process data outside your country.
See Google's privacy policy and Qualys's privacy statement for their practices.
4. Why we use information
We use submitted details to process requests, display scan findings, respond to enquiries, evaluate partner interest, understand demand and protect the service from abuse. Where applicable, processing relies on steps you request before a contract, legitimate interests in operating and securing the service, legal obligations, or consent when required.
Submitting a scan or enquiry is not consent to unrelated advertising or a marketing mailing list. Optional promotional email, advertising pixels and nonessential tracking require an appropriate notice and, where applicable, a separate choice before activation.
5. Cookies, analytics and market research
The current website does not integrate an advertising pixel or a dedicated marketing analytics platform. Providers may process necessary technical information to deliver and protect the website. We may review submitted company-size ranges and enquiry topics to understand market demand.
Broader market research tools are planned, not represented as already active. Before adding optional tracking or changing the purposes of processing, we will update this notice and implement the choices required by applicable law. We do not offer your submitted contact details for sale.
6. Storage and retention
Scan-session access expires approximately 30 minutes after creation. Expiry limits access to results; it does not automatically delete a scan request or stored findings. Contact submissions and scan records are currently stored without an automated deletion schedule.
A defined retention schedule and deletion process must be adopted before commercial launch. Do not interpret the session expiry as a promise that your personal information has been erased.
7. Sharing and protection
Submitted requests are not publicly readable through the website's data access rules. We use service providers to host the site, store requests and obtain domain observations, and may disclose information when legally required or necessary to address abuse. A downloaded report can include public domain findings; you decide who receives copies you share.
No online service can guarantee absolute security. We do not claim that a free scan protects your systems or changes your encryption.
8. Your requests and choices
Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, obtain a copy of your information, or withdraw consent. Use the contact form linked on this page, select “Other” and identify the type of request in the company field. We may ask for information necessary to verify your identity before acting. You may also contact your relevant privacy regulator.
The service is intended for business users, not children. If information about a child has been submitted, contact us to request its removal.
9. Changes
We will update the date above when this notice changes. Material new uses of personal information will be disclosed before they begin, with additional consent where required.
