Privacy policy

Who is responsible

Plars Build Project Management Services, Dubai, United Arab Emirates. Questions: hello@plars.ae.

What we hold

• Account — name, email address, password (stored only as a hash, never readable).
• Project content — whatever you and your invitees upload and record.
• Activity — who did what and when, which is the point of the product.
• Billing — plan, amount, date and a payment reference. We never see or store card numbers.

Why

To run the service you asked for, to keep an accurate record of decisions, to take payment, and to email you when something needs your attention. We do not sell your data, we do not advertise to you, and we do not use your content to train anything.

Who can see your project

Only the people invited to it. This is enforced in the database itself, not merely by hiding buttons — someone outside a project receives no rows at all, not a hidden page.

We look inside a project only when you ask for help. That access is limited to a maximum of 72 hours, requires a written reason, and is written into your project’s own permanent history. That record is included whenever a project administrator downloads the project.

Where it is stored

On servers in Frankfurt, Germany (European Union), with our infrastructure provider. Chosen deliberately so your data sits under European data-protection standards.

Your files are copied to separate storage inside the EU every hour. The database is backed up once a day, and we keep seven days of those. We have tested restoring a file and confirmed it comes back exactly as it was.

Who else processes it

• Supabase — database, files and login (EU).
• Vercel — runs the website.
• Resend — sends our email.
• Stripe — processes card payments. Card details go to them directly and never reach us.
• Cloudflare — checks you are not a robot when you sign in, and holds our file backups (EU).
• Sentry — records technical faults so we can fix them (EU). No names, email addresses or IP addresses are sent to it.
• Vercel Analytics — counts how many people visit each page. It sets no cookies, records no IP address, and cannot identify you or follow you to another website.

Each holds data only to provide its part of the service.

How long we keep it

For as long as your account exists. You can close it yourself on your account page — you do not have to ask us. If you are the only administrator on a project, we will ask you to hand that over to another member first, so nobody is left locked out of their own project. Closing your account erases your name, email address and phone number everywhere we hold them, and you can no longer sign in.

When you remove something from a project — an invoice, a snag, a permit document, a set of photos — it stops appearing in the project, but it is kept in that project’s record and a project administrator can restore it. That is deliberate: these are shared records other parties rely on, and one person’s click should not erase another person’s certificate or evidence of a defect. Individual photos and videos are the exception and really are deleted. Everything kept this way goes when the project itself does.

How long a project is kept

A project is kept for two years after it finishes. If nobody has added anything to a project for three years we treat it as finished, so a project left alone is kept for five years in total. If you need it longer than that, tell us before the date and we will keep it — you do not have to explain why.

Nobody loses a project by surprise.Every member is emailed 60 days before the date, again at 30 days and again at 7, with a one-click download of the whole project. Those emails are sent even if you have turned other notifications off, because they are not notifications — they are notice. Any administrator can keep a project that is still in use with one click, at no cost.

We do this rather than holding everything forever because keeping people’s personal information longer than it is useful is not something we should do by default. Your own copy, downloaded before the date, is yours to keep for as long as you need it — and it keeps working whether or not you still use Plars.

Smaller things go sooner: an invitation 90 days after it is accepted, withdrawn or expires; a supplier’s access to a share box 90 days after it closes, along with the email address it was sent to; and notifications after twelve months.

The activity record

Every project keeps a record of who did what and when. We hold that so the parties can establish what happened if there is ever a dispute or a claim, and because a record of decisions that can be quietly altered is worth nothing to anybody.

After two yearswe strip the names and email addresses out of it and keep only the events themselves — what changed, when, and in what order. So the history survives as history and stops being information about a person. This is the same approach we take when you close your account.

What stays is the work itself. A project has several members, and the documents, approvals and comments you added are the record the whole project relies on — so those remain, shown as “Deleted user”, with nothing on them pointing to you. Every project you were on records that you closed your account, so the other members are not left guessing. We also keep the payment records we are required to keep for tax and accounting.

Your rights

Ask us what we hold, correct it, delete it, or get a copy. Any project admin can already download an entire project as a single file at any time, without asking us. Email hello@plars.ae and we will reply within 30 days.

Cookies

We set only what is needed to keep you signed in. No advertising cookies, and no third-party tracking.

Changes

If we change this materially, we will tell account holders by email before it takes effect.