Privacy policy
Beta version — last updated: 16 August 2026.
Who we are
TadaPlan is published by iClics SRL, chemin du Beau Vallon 42, 5100 Wépion (Belgium), VAT BE 0548.813.132, acting as data controller. Contact: info@tadaplan.eu.
What data we process
- Account: e-mail address, display name, password (hashed, never readable).
- Content: your events, tasks, budgets, comments and settings.
- Attendees: if you publish a registration page, the name and e-mail of people who register, plus their selected options. You are responsible for informing your attendees; we process this data on your behalf.
- Subscription: the plan taken out, the date, the amount and the transaction reference. We never see your card number: it is entered with Stripe, Apple or Google, never with us.
- Source: the campaign parameters carried by the link you arrived through and the referring website, kept alongside your account.
- Technical: server logs (security and diagnostics), no advertising profiling.
Why, on what legal basis, and for how long?
European law requires every processing operation to rest on a legal basis and to come with a stated retention period. Here they are, one by one.
| What we process | Legal basis | How long |
|---|---|---|
| Your account and your plans: events, tasks, budgets, seating charts | Performance of the contract (art. 6(1)(b)) | As long as the account exists. Once deleted: erased from active systems within 30 days, and from encrypted backups within 90 days at the latest. |
| The people who register for your events | Performance of the contract, on your behalf (art. 6(1)(b)) | Deleted with the event, or with your account. |
| The no-signup trial (a plan generated before creating an account) | Legitimate interest: letting you judge the product before committing (art. 6(1)(f)) | Automatically erased after 7 days if you have not attached it to an account. It is a daily scheduled job, not a promise. |
| Plan generation by artificial intelligence | Performance of the contract (art. 6(1)(b)) | See “Artificial intelligence” below. |
| Service e-mails: registration confirmations, plan alerts, digests | Performance of the contract (art. 6(1)(b)). No marketing without your consent. | For the life of the account. |
| Your subscription and your invoices | Performance of the contract (art. 6(1)(b)) for the subscription; legal obligation (art. 6(1)(c)) for the invoice | Accounting records are kept for the Belgian statutory period, at least seven years after the end of the financial year. That duty binds us: it outlives the deletion of your account. |
| Security, abuse prevention, technical logs | Legitimate interest (art. 6(1)(f)) | Application error logs are purged at 30 days by a daily job. Infrastructure logs are kept by our host for less than a month. |
| Usage measurement on the website and web app (Umami) | Legitimate interest (art. 6(1)(f)) | Aggregated statistics, with no cookie and no lasting identifier: nothing in them can single you out, and they are kept without a time limit. |
| Usage measurement in the mobile apps (Firebase Analytics) | Legitimate interest (art. 6(1)(f)), with objection two taps away inside the app | 2 months for detailed events, 14 months for data tied to a device. These are the settings actually in force on our Google Analytics property, not intended values. |
| Advertising attribution (Meta App Events) | Your consent (art. 6(1)(a)) — off by default, withdrawable at any time | Until you withdraw your consent. The periods applied by Meta are governed by its own policy. |
| Where your sign-up came from (campaign parameters, referring site) | Legitimate interest (art. 6(1)(f)) | For the life of the account. |
What is that “legitimate interest”? Knowing what serves a purpose in the product and what does not, keeping it running, and preventing abuse. We have balanced that interest against your privacy: measurement is never used to profile or target you, no advertising identifier is collected, and you can object in two taps without losing the use of the product. If that balance does not suit you,your right to object needs no justification.
Artificial intelligence
Plan generation sends your event description (type, date, venue, free text) to a language model through OpenRouter. The market study in the finance module also queries Perplexity. We do not use this content to train models; it does however pass through third-party providers whose own retention policies apply. Do not include sensitive data in your descriptions — generation has no need for any.
Audience measurement
We measure how the product is used, to know what serves a purpose and what does not. The method differs between the web and mobile.
- Website and web application: Umami, on our own instance at analytics.wepion.be — the software is ours and the measurements are shared with no one. It sets no cookie and records no personal identifier: your IP address is used to determine the country, then turned into a non-reversible fingerprint that changes every day. That is precisely why you are never shown a consent banner. The instance is hosted with Vercel, which carries out part of the processing in the United States.
- Mobile apps — usage measurement: Firebase Analytics (Google) records the actions that make up the product: a plan generated, a task ticked off, a subscription taken out. It is enabled by default and you can turn it off at any time inside the app, under the “My account” menu.
- Mobile apps — advertising attribution: Meta App Events serves only to tell us which advertisement introduced you to the app. Because it sends data to a third party for advertising purposes, it is disabled by default: it is switched on only if you explicitly accept, from the same menu.
In every case, no advertising identifier is collected: collection of the IDFA on iOS and of the Android advertising ID is switched off, and the corresponding advertising permissions are removed from the Android app.
The source of your visit — the campaign parameters in the link and the referring website — is kept alongside your account. It tells us where sign-ups come from, and nothing else.
Who processes data for us?
Each of these providers is bound by a data processing agreement and acts only on our instructions, except for the app marketplaces, which handle the purchase on their own account.
| Provider | What it does for us | Where processing happens |
|---|---|---|
| Supabase | Database, accounts, server functions | European Union — Frankfurt |
| A-Cube | Peppol electronic invoicing | European Union — Italy |
| Stripe | Payment on the web | Ireland, and the United States |
| Netlify | Hosting of the website and web application | United States |
| Vercel | Hosts our Umami measurement instance | United States |
| Resend | Delivery of service e-mails | United States |
| OpenRouter | AI plan generation | United States |
| Perplexity | Market study in the finance module | United States |
| Cloudflare | Bot protection on the no-signup trial | United States |
| RevenueCat | Subscriptions taken out inside the mobile apps | United States |
| Usage measurement in the mobile apps (Firebase, Analytics) | United States | |
| Meta | Advertising attribution — only if you accept | United States |
| Apple, Google | App distribution and in-app purchases | United States |
Transfers outside the European Union
Your account and content data are stored in the European Union, in Frankfurt. Several of our providers are however established in the United States, or carry out part of their processing there — the table above says which. Those transfers are governed by the European Commission's standard contractual clauses (implementing decision 2021/914), included in the data processing agreement signed with each of them; several of those providers are additionally certified under the EU–US Data Privacy Framework, which the Commission found adequate on 10 July 2023. You can obtain a copy of these safeguards by writing toinfo@tadaplan.eu.
Two consequences are concrete, and they are in your hands: leaving advertising attribution off — its default state — removes every transfer to Meta; objecting to usage measurement inside the app removes every transfer to Google for measurement purposes.
Your rights
Under the GDPR you have the rights of access, rectification, erasure, portability, restriction and objection: write toinfo@tadaplan.eu. We reply within 30 days. You may also lodge a complaint with the Belgian Data Protection Authority (autoriteprotectiondonnees.be).
Four of those rights require no message to us: inside the app, under the “My account” menu, you can object to usage measurement, grant or withdraw your consent to advertising attribution, export your data as JSON and delete your account. Withdrawing consent does not affect what was processed beforehand.
Cookies
The website and the web application only use the local storage required for your login session: no advertising cookies, no third-party trackers. For the mobile apps, see “Audience measurement” above.
Changes
This policy may change as the product does. The date at the top of the page states the last update; any change that would broaden the use of your data will be announced inside the app before it takes effect.
Legal notice
Publisher: iClics SRL — chemin du Beau Vallon 42, 5100 Wépion, Belgium — VAT BE 0548.813.132 — info@tadaplan.eu.