How your data is handled

25 October 2026 · a plain description of how the service works today. The Terms of Use (clause 4) are the binding text.

Your data is yours

What you put into Planum — programmes, drawings, registers, letters, photographs — remains yours. It is held only to run Planum for you and for the people you share a project with. You can take it out at any time while your account is active: every register exports as CSV and Excel, programmes as P6 XER and MS Project XML, reports as Word and PowerPoint, cost plans as RICS Data Standard files, and the logic as GraphML.

Where it is kept, and who can open it

• Each project's records and files are kept in the service's database and private file store, behind sign-in. An account must be approved before it can open anything.
• A project is open only to its owner and the people they invite. Each person's role decides what they may do: a viewer or a client reads and exports, and the database itself refuses their changes.
• A module can be closed to one side of the contract — a contractor need never see the client's business case, and internal occurrence reports stay closed to the other party by default. A closed module is not readable at all, not merely read-only.
• A project can be marked private, so that membership of the organisation alone opens nothing in it.

What is recorded about use

• When a module is opened, who opened it and when is recorded for the project's team (it is how a module shows it has been used on the project).
• Every change to a programme in the Reschedule sandbox, every decision on a proposal and every link record keeps who made it and when — that history is part of the record, not a log kept about you.
• The built-in reference tables are marked per account when they load, and each load is recorded.
• To learn which parts of the service are used, each page you open while signed in is counted with how long it was on screen. Nothing a module holds is read for it, nothing is stored in your browser for it, and a browser that sends Global Privacy Control is not counted. Your organisation's administrators see these counts for its projects; you see your own.

AI features

• An AI feature runs only when you press it — drafting from a prompt, reading a document into a register, suggesting a rule, a link type or a report narrative, reading a photograph. Nothing is sent to a model in the background.
• Only what that one feature needs is sent — the sentence, the document excerpt, the activity names, the photograph — to the model provider configured for the service, which processes it under its own terms.
• Planum trains no model on what you put into it.
• What a model returns is shown to you to accept, correct or discard, and findings that must quote a document are dropped when the quotation is not in the document.
• Most features that use a model also work without one, by rules, and say which they used. Dates, floats and critical paths are always computed by the scheduling engine, never by a model.
• Voice dictation uses your browser's own speech recognition, under your browser's terms.

Features that read across projects

Pipeline, Tender's price history, rates from actuals and the portfolio reports read every project you can already open — and nothing else. One organisation's projects are never shown to another, and Planum produces no benchmark or report drawn from customers' projects for anyone else.

Links that work without an account

A QR code you print, or a bidder's tender link, shows the content you chose to anyone who has it, and each scan of a QR code is counted for you. Withdrawing the code or closing the tender ends it.

Without signing in

Opened without an account, a module keeps your work in this browser only and says so on screen; nothing is sent to the service.

When an account ends

You can export your data while your account is active. After the account ends the data may be deleted after 30 days, as clause 4 of the Terms sets out.

Back to sign in · Terms of Use · Credits and third-party notices