Privacy Policy

Effective Date: [Insert effective date]

This Privacy Policy describes how PlanTools, LLC (“PlanTools,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with the PlanTools platform and related services (the “Services”). It is designed to work together with our Terms of Service, AI Governance Policy, and any Data Processing Addendum.

We process information for a fintech SaaS platform used by financial advisors, recordkeepers, broker-dealers, and DCIOs. We treat Customer Data (including Recordkeeper feeds and Participant data) with the highest level of care and never use it to train AI models.

1. Scope and Roles

This policy applies to information we process when you use the Services, visit our websites, or interact with us.

• Customer Data (data you or your authorized users submit, upload, or generate through the Services, including plan, Participant, and advisor materials) is processed by PlanTools as a processor (or service provider) on your behalf.
• Account, billing, and usage information about you as a customer is processed by PlanTools as a controller.

By using the Services, you agree to this Privacy Policy. If you do not agree, do not use the Services.

2. Information We Collect

We collect only what is needed to provide and secure the Services:

Account and Institutional Information

• Name, business email, phone, job title, firm name, and professional credentials (where provided)
• Login credentials, preferences, and role assignments
• Billing and payment information (processed by our payment providers)

Customer Data (as submitted by you)

• Retirement plan data, Participant-level information, investment selections, contribution and balance data
• Documents, reports, scorecards, benchmarks, IPS materials, and compliance files you upload or create
• Data received from Recordkeeper partners or other authorized sources you connect

Technical and Usage Data

• IP address, device and browser information, session logs, and clickstream data
• Audit trails, feature usage, and performance metrics
• Support tickets and communications with us

On plantools.com, we collect this technical and usage data with Google Analytics.

We do not collect Sensitive Personal Information beyond what is necessary for the Services and what you choose to submit.

3. How We Use Information

We use information to:

• Provide, operate, maintain, and secure the Services
• Generate reports, scorecards, analytics, and fiduciary tools you request
• Authenticate users, enforce access controls, and prevent fraud or abuse
• Provide customer support and communicate about the Services
• Improve platform performance, reliability, and user experience (using aggregated or de-identified data only)
• Comply with legal, regulatory, and audit obligations (including SOC 2)
• Bill for the Services and manage subscriptions

AI Use. Any AI features process data solely to deliver the requested functionality for you. We do not use Customer Data or Participant data to train, fine-tune, or improve foundation AI models. Third-party AI providers are contractually prohibited from training on your data. AI outputs are assistive and subject to our AI Governance Policy.

4. How We Share Information

We do not sell or rent personal information or Customer Data.

We share information only in these limited circumstances:

• With authorized PlanTools personnel and subprocessors under strict confidentiality and data-protection agreements, solely to provide the Services
• With Recordkeeper or data partners you authorize for the purpose of delivering the Services
• With professional advisors (legal, accounting) under confidentiality obligations
• When required by law, subpoena, or to protect rights, safety, or security
• In connection with a merger, acquisition, or sale of assets (with notice where required)

A current list of material subprocessors is available upon request or published at [subprocessors page].

5. Data Security

We maintain administrative, technical, and physical safeguards aligned with SOC 2 Type II controls, including:

• Encryption in transit (TLS) and at rest
• Role-based access controls and multi-factor authentication
• Regular vulnerability assessments, penetration testing, and monitoring
• Audit logging and incident response procedures
• Employee training and background checks for personnel with access to Customer Data

No method of transmission or storage is 100% secure. We will notify you of confirmed security incidents affecting Customer Data in accordance with applicable law and our contractual commitments.

6. Data Retention and Deletion

We retain Customer Data for the duration of your subscription and as needed to provide the Services. Upon termination or your written request, we will delete or return Customer Data within 30–60 days, subject to legal retention obligations, backup cycles, and legitimate business needs (e.g., resolving disputes).

Account and billing records are retained as required for tax, accounting, and legal purposes.

7. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, or restrict processing of personal information, or to data portability.

• For Customer Data, these requests should generally be directed to you (the controller). We will assist you in fulfilling them.
• For account information we control, contact us at privacy@plantools.com.
• You may opt out of non-essential marketing communications at any time.

We will not discriminate against you for exercising privacy rights.

8. International Transfers

We primarily process data in the United States. Where data is transferred internationally, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

9. Children’s Privacy

The Services are not directed to individuals under 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email or in-platform notice. Continued use after the effective date constitutes acceptance.

11. Contact Us

For privacy questions, requests, or concerns:

PlanTools, LLC
Attn: Privacy
privacy@plantools.com
6277-600 Carolina Commons Dr., Suite 361
Fort Mill, SC 29707