G-310Legal
Planbase US State Privacy Notice
Related: Privacy Policy · Data Retention and Deletion · Subprocessors · Cookie Notice
Summary in plain language
- This notice adds to our Privacy Policy for residents of California and other US states with consumer privacy laws.
- We do not sell your personal information, and we do not share it for cross-context behavioural advertising (targeted advertising). We don’t use it for profiling that has legal or similarly significant effects.
- You can ask to know, access, correct, delete or port your personal information, and to appeal if we say no. You can use an authorised agent.
- Email privacy@planbaseestimating.com. We won’t treat you differently for asking.
1. Who this applies to
1.1 This notice applies to residents of California and of every other US state whose comprehensive consumer privacy law gives them the rights below (for example Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia), to the extent that law applies to Planbase.
1.2 We honour the rights in this notice for every US resident, whether or not a state’s law applies to Planbase.
1.3 Missouri, where Planbase is based, has no comprehensive consumer privacy law as of the date above.
2. Definitions
- “Personal information” has the meaning given by the applicable state law, and includes “personal data”.
- “Sell” means disclosing personal information to a third party for money or other valuable consideration, as the applicable law defines it.
- “Share” (California) means disclosing personal information to a third party for cross-context behavioural advertising.
- “Targeted advertising” means showing ads based on personal information obtained from a person’s activity across unrelated sites or apps.
- “Service provider”, “contractor” and “processor” mean companies that process personal information for us under a contract that limits their use of it. Ours are listed in subprocessors.md.
- Other terms have the meanings in the Privacy Policy §2.
3. Personal information we collect
In the last 12 months we have collected the categories below (the categories are those in Cal. Civ. Code § 1798.140). We collect them from you, automatically from your browser and DimSum, and from Clerk, Google (if you use Google sign-in), Paddle and Keygen, and, for prospective customers we email about DimSum, from people we know and from contact details businesses publish, as set out in the Privacy Policy §4 and §4.3A. Retention for each is in data-retention-and-deletion.md.
| Category | Examples from our Services | Business purposes | Disclosed for a business purpose to |
|---|---|---|---|
| A. Identifiers | Name, email address, account and Workspace IDs, Clerk user ID, Paddle customer ID, IP address (held in server logs and by Clerk, not in our database), computer name, machine fingerprint (a hash) | Accounts, licensing, updates, emails, support, security | Cloudflare, Clerk, Keygen, Resend, Google (support mailbox) |
| B. Customer records (Cal. Civ. Code § 1798.80(e)) | Name, email; billing address and payment details (collected and held by Paddle, not us) | Accounts, billing | Paddle collects these directly as merchant of record |
| C. Protected characteristics | None collected | ||
| D. Commercial information | Plan, seats, trial and subscription status, payment status, period dates | Licensing, billing, support | Cloudflare, Keygen |
| E. Biometric information | None | ||
| F. Internet or other electronic network activity | Sign-in sessions and devices (Clerk), server and request logs, license check-ins and update checks, the audit log, email delivery records, cookieless website visit counts | Security, licensing, fixing problems, understanding which pages help | Cloudflare, Clerk, Resend, Sentry (server errors only, no customer input) |
| G. Geolocation data | Country only (from the IP address on forms); Clerk’s approximate sign-in location. No precise geolocation | Spam prevention, security | Cloudflare, Clerk |
| H. Audio, electronic, visual or similar | None today. When the Remote Workstation opens, the picture of DimSum’s window travels end-to-end encrypted between your devices and isn’t stored or readable by us | Providing the Remote Workstation (coming) | Cloudflare relays encrypted traffic only |
| I. Professional or employment information | Company, role, business type, number of estimators, trades (beta form); Workspace role (admin or member) | Accounts, beta programme | Cloudflare |
| J. Education information | None | ||
| K. Inferences | None | ||
| L. Sensitive personal information | Account log-in: your email with a password, held by Clerk to sign you in | Signing you in and keeping your Account secure only | Clerk |
| Content you provide | Support messages; diagnostic bundles you choose to send (and a job file only if you tick it); DimSum Cloud content (coming) | Support, Cloud | Cloudflare, Google (support mailbox) |
3.1 Sensitive personal information. We use account log-in data only to sign you in and keep your account secure, which the CCPA permits without offering a “limit” right (Cal. Code Regs. tit. 11, § 7027(m)). We don’t use sensitive personal information to infer characteristics about you.
3.2 Business purposes in detail are in the Privacy Policy §5: providing the Services; licensing; billing; support; security and fraud prevention; debugging; communications; legal compliance.
4. Sale, sharing and targeted advertising
4.1 We do not sell personal information and have not sold it in the last 12 months.
4.2 We do not share personal information for cross-context behavioural advertising, and do not use it for targeted advertising. We have no advertising cookies or pixels.
4.3 We have no actual knowledge of selling or sharing the personal information of anyone under 16.
4.4 We don’t profile people in furtherance of decisions that produce legal or similarly significant effects.
4.5 Global Privacy Control. We treat a GPC signal from your browser as a valid request to opt out of sale and sharing for that browser. Because we do neither, it changes nothing about how we handle your data.
4.6 Paddle and Google receive personal information directly as independent businesses when you pay or choose Google sign-in; that’s at your direction and isn’t a sale by us.
5. Your rights
Depending on your state, you have the right to:
| Right | What it means |
|---|---|
| Know / access | Learn the categories and specific pieces of personal information we hold about you, its sources, our purposes, and who we disclosed it to |
| Correct | Have inaccurate personal information corrected. You can change your name and email in the portal |
| Delete | Have personal information we collected deleted, with the exceptions the law allows (for example, records we must keep for tax, or to complete a transaction, detect security incidents, or comply with law) |
| Portability | Get your personal information in a portable, machine-readable form |
| Opt out | Of sale, sharing, targeted advertising and significant profiling. We do none of these, so there is nothing to switch off |
| Limit (California) | Limit the use of sensitive personal information. Not offered, because we use it only for permitted purposes (§3.1) |
| Non-discrimination | Not be treated differently (price, service quality) for using these rights |
| Appeal | Appeal our decision on your request (§9) |
| List of third parties (Oregon, Minnesota) | Ask for the specific third parties we disclosed your personal data to. See subprocessors.md, or ask us |
6. How to make a request
6.1 Email privacy@planbaseestimating.com with “Privacy request” in the subject, from the email address on your Account if you have one. Say which right you’re using.
6.2 Post: Planbase Estimating LLC, 3418 East 104th Street, Kansas City, MO 64137, USA.
6.3 Requests are free. We may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive, or more than two access requests in 12 months (California), and will explain why.
7. How we verify you
7.1 We match your request to the information we already hold. Usually that means replying to, or getting a code sent to, the email address on your Account.
7.2 For requests for specific pieces of personal information, or to delete sensitive data, we need a higher degree of certainty and may ask for one more detail we already hold (such as the name of an activated computer or your Workspace name).
7.3 If you don’t have an Account (for example, a beta sign-up), we verify using the email address you gave us.
7.4 We use the information you give for verification only for that purpose, and delete it afterwards. If we can’t verify you, we’ll say so and explain why.
8. Authorised agents
8.1 You can have an authorised agent make a request for you. The agent must give us:
- signed written permission from you, or a valid power of attorney under California Probate Code §§ 4000–4465 (or your state’s equivalent); and
- its own name and contact details, and, if it’s a business, proof it’s registered in your state.
8.2 Unless the agent holds a power of attorney, we may also ask you to verify your identity directly with us and to confirm you gave the agent permission.
8.3 We may refuse an agent’s request if it doesn’t provide this proof.
8.4 Opt-out requests (including GPC) may be sent by an agent without this proof, where the law allows.
9. Appeals
9.1 If we decline all or part of your request, we’ll explain why. You can appeal by emailing privacy@planbaseestimating.com with “Privacy appeal” in the subject within 60 days of our answer.
9.2 Someone who didn’t make the first decision will review it, and we’ll answer within 45 days (Colorado, Connecticut, Virginia and most others) or 60 days where the law allows, explaining what we decided and why.
9.3 If you’re not satisfied, you can contact your state Attorney General (for example, through the Colorado, Connecticut or Virginia Attorney General’s website) or, in California, the California Privacy Protection Agency.
10. Response times
We’ll confirm receipt within 10 business days and answer within 45 days of receipt. If we need more time, we’ll tell you within those 45 days and may take up to 45 more days where the law allows.
11. Other state notices
11.1 Nevada. We don’t sell covered information as Nevada law (NRS 603A) defines it. Nevada residents can still email privacy@planbaseestimating.com to make an opt-out request.
11.2 California “Shine the Light” (Cal. Civ. Code § 1798.83). We don’t disclose personal information to third parties for their own direct marketing.
11.3 California minors. The Services aren’t directed at people under 16 (or under 18 for the purposes of Cal. Bus. & Prof. Code § 22580–22582). We don’t knowingly collect their data.
12. Changes and contact
12.1 We review this notice at least once every 12 months and update its “Last updated” date.
12.2 privacy@planbaseestimating.com · Planbase Estimating LLC, 3418 East 104th Street, Kansas City, MO 64137, USA
Change log
| Date | Version | Change |
|---|---|---|
| 2026-10-07 | 1.0 | Published. Same day, added after attorney review (show at the next review): section 3 names the sources of prospect records (outreach). |
Planbase Estimating LLC, 3418 East 104th Street, Kansas City, MO 64137, USA. Questions: legal@planbaseestimating.com.All legal documents.