This Privacy Policy ("Policy") explains how PlanVantage LLC ("PlanVantage," "we," "us," or "our") collects, uses, discloses, and safeguards information in connection with the website and web application located at planvantage.ai and related services (collectively, the "Services"). By using the Services, you agree to the practices described in this Policy.
We act as a controller with respect to personal information we collect about you, and as a processor when we process personal information on behalf of a business customer ("Customer"). This Policy is intended to address requirements under applicable laws, including the California Consumer Privacy Act ("CCPA"/"CPRA") and, where applicable, the EU/UK General Data Protection Regulation ("GDPR"). If GDPR applies, a Data Processing Addendum ("DPA") governs our processing on behalf of a Customer and takes precedence in case of conflict.
We may collect the following categories of information:
• Identifiers and contact information (name, email, phone, mailing address, employer, job title)
• Account and commercial information (account credentials, subscription details, billing information, organization membership)
• Usage and device information (IP address, browser type, pages viewed, referring URLs, timestamps)
• Application telemetry and event logs (for example, actions performed, feature usage, performance diagnostics)
• Identity provider information (when Single Sign-On is configured by your organization, we receive your name, email address, and organizational identifiers from your identity provider)
• Customer Data submitted to the Services by or on behalf of a Customer
• Communications and support information (messages, tickets, feedback)
• Cookie and similar technologies data (see Section 10)
We collect information directly from you (e.g., account registration, support requests), automatically through your use of the Services, from third parties (e.g., payment processors, analytics providers, Customer administrators), and from identity providers configured by your organization (e.g., when you authenticate via Single Sign-On).
We use individual user-level analytics and event logs only for security, troubleshooting, incident response, and customer support. We do not use such data to build behavioral profiles for marketing or advertising, and we do not engage in cross-context behavioral advertising.
• Provide, operate, maintain, and improve the Services
• Authenticate users and secure accounts; prevent fraud and misuse
• Process transactions and provide customer support
• Communicate with you about the Services, including notices and updates
• Analyze usage and performance (including log-based analytics and telemetry) to develop new features and improve reliability
• Produce aggregate and de-identified usage reporting (for example, feature adoption and activity levels) that does not identify individuals
• Comply with legal obligations and enforce agreements
• With your consent or as otherwise disclosed at collection
Where GDPR applies, our legal bases include: (1) performance of a contract (providing the Services); (2) legitimate interests (e.g., securing and improving the Services, customer support); (3) consent (e.g., certain cookies/marketing); and (4) compliance with legal obligations.
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We may share information with: (1) service providers and processors that perform services for us (e.g., hosting, analytics, payment processing) under contracts requiring confidentiality and use limitations; (2) Customer administrators regarding their Authorized Users; (3) identity providers configured by your organization, limited to authentication data exchanged during the Single Sign-On process; (4) affiliates for business operations consistent with this Policy; (5) authorities or third parties as required by law or to protect rights, safety, or the integrity of the Services; and (6) as part of a corporate transaction, subject to appropriate safeguards.
We are based in the United States and may transfer, store, and process information in the U.S. and other countries where we or our service providers maintain facilities. When transferring personal data from the EEA/UK/Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs). If we process personal data on behalf of a Customer, our DPA will apply to such processing.
We retain personal information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. We use criteria such as the nature of the data, the purpose of processing, and legal requirements to determine retention periods.
At this time, we do not use cookies or similar tracking technologies on the Site other than strictly necessary technical mechanisms required to operate the Services (for example, security and session management). We do perform log-based analytics without cookies using server logs and application telemetry to monitor performance, reliability, security, and aggregate feature usage. We do not use advertising cookies, and we do not engage in cross-context behavioral advertising. If we introduce analytics or preference cookies in the future, we will update this Policy and provide appropriate controls (such as a cookie banner or settings) consistent with applicable law. Our Site respects Global Privacy Control (GPC) signals. Disabling certain strictly necessary mechanisms may impact core functionality.
Depending on your location, you may have the following rights regarding your personal information:
To exercise rights, contact us at contact@planvantage.ai. If you are an Authorized User of a Customer, we may direct your request to the Customer where appropriate. We will verify your request consistent with applicable law. You may use an authorized agent as permitted by law. We will respond to verifiable requests within the timeframes required by applicable law, generally within 45 days of receipt, with the possibility of a one-time 45-day extension where reasonably necessary and permitted by law.
• Access: request confirmation and access to personal information we hold about you
• Correction: request that we correct inaccurate or incomplete information
• Deletion: request deletion, subject to certain exceptions
• Portability: request a copy of your information in a portable format
• Restriction/Objection: object to or request restriction of certain processing
• Opt-out of sale/sharing (CCPA): we do not sell or share personal information as defined by CCPA. If that changes, we will provide a "Do Not Sell or Share My Personal Information" mechanism and honor GPC signals.
• Withdraw consent: where processing is based on consent
• Complete the transaction for which the information was collected, fulfill a contract, or provide requested services
• Detect security incidents; protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible
• Debug to identify and repair errors that impair intended functionality
• Exercise free speech or ensure the right of another to exercise free speech or other rights
• Comply with legal obligations, including record-keeping and reporting
• Engage in public or peer-reviewed research where deletion would likely render impossible or seriously impair the research, and provided appropriate safeguards are in place
• Enable solely internal uses that are reasonably aligned with user expectations based on your relationship with us
• Otherwise use your information internally in a lawful manner compatible with the context in which you provided it
The Services are intended for use by individuals aged 18 and over and by organizations for their adult personnel. We do not knowingly collect personal information from individuals under 18. If you believe an individual under 18 has provided personal information to us directly, please contact us, and we will take steps to delete such information.
The Services may, however, process information about individuals under 18 when such information is submitted by a Customer as part of Customer Data (for example, claimants or dependents). In those cases, PlanVantage acts as a processor and processes that information solely on the Customer's instructions and pursuant to our DPA. The Customer is responsible for ensuring a lawful basis for processing and, where required, obtaining appropriate parental or guardian consent.
PlanVantage is not a "covered entity" or "business associate" as defined under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and we do not intend for the Services to be used to collect, store, or process Protected Health Information (PHI). If PHI must be processed, this may only occur where PlanVantage and a Customer have executed a valid Business Associate Agreement (BAA). Without such an agreement in place, Customers must not submit PHI through the Services.
We implement commercially reasonable technical and organizational measures designed to protect personal information, such as encryption in transit (TLS/SSL), access controls, and monitoring. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
The Services may integrate with or link to third-party services. Your use of those services is governed by their privacy policies, not this Policy. Where third parties process personal information for us, we require them by contract to use appropriate safeguards and process information only on our instructions.
We may update this Policy from time to time. If we make material changes, we will provide prominent notice (for example, by email to the address associated with your account, in-app notice, or a notice on our Site) prior to the effective date as required by law. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.
PlanVantage LLC 3500 Lenox Rd NE, STE 1500-2490 Atlanta, Georgia 30326 Email: contact@planvantage.ai Telephone: (404) 490-0539