Platform Privacy Policy

1 About This Policy

This Privacy Policy explains how personal data is collected, stored and used within the Always On platform (alwayson.plangrowdo.com). It is intended for:

• Sales representatives and managers who use Always On on behalf of their employer
• Contacts and prospects whose data is entered into the platform

Always On is operated by Plan Grow Do, a trading name of Plan Grow Do Ltd ('PGD', 'we', 'us'). The platform is provided to business clients ('tenants') as a B2B sales management tool.

2 Data Controllers and Processors

3 Data the Platform Holds

3.1 User Account Data (Reps and Managers)

When you are invited to Always On as a team member, the following data is held:

• Name, email address, job title
• Profile picture (if uploaded)
• LinkedIn URL, regions, specialities, sectors (if provided)
• Connected email account information (Gmail or Outlook OAuth token — encrypted at rest)
• Login timestamps and activity logs within the platform

Lawful basis: Contract performance — providing access to the platform under the tenant's subscription.

3.2 Contact and Prospect Data

The platform holds data about your company's contacts and prospects. Your employer (the tenant) is the Data Controller for this data. It includes:

• Name, email address, phone number
• Company name, job title, sector, region
• Enquiry content and communication history
• BANT qualification scores and notes
• Pipeline stage, assigned rep, meeting notes
• Resources and documents shared with the contact

3.3 Communication Data

Where email sync is enabled by a rep, the platform captures:

• Emails sent to and received from contacts whose records exist in the platform
• WhatsApp conversations handled by the Sally AI agent (where enabled by the tenant)
• Form submissions received through tenant-embedded web forms

3.4 AI-Processed Data

Always On uses AI agents (Sally, Dan, Caroline) powered by Google Gemini. When the AI processes a contact interaction:

• Contact record data and communication history are sent to the Gemini API for analysis and response generation
• The AI does not store data independently between sessions
• Google does not use API data to train its models (API usage terms)
• Data processed by the AI is subject to Google's Cloud API data handling policies

4 How We Use Platform Data

5 Where Data Is Stored

All primary data storage is within the EU. Where data is processed outside the EU (Google, Meta), appropriate safeguards are in place under Standard Contractual Clauses.

6 Data Isolation and Security

Always On is a multi-tenant platform. Your employer's data is strictly isolated from all other tenants:

• Every record is tagged with a tenant_id at the database level
• Row Level Security (RLS) enforces that queries can only return data belonging to the authenticated user's tenant
• No cross-tenant data access is possible at any level
• All data is encrypted in transit (TLS/HTTPS) and at rest
• OAuth tokens for email sync are encrypted separately with a dedicated encryption key
• Platform access is invite-only — no self-registration

7 Email Sync & Gmail Integration

Always On allows you to connect your email account to sync communications with your contact records. The following applies to all email connections:

• You explicitly authorise access via OAuth — you can disconnect at any time from your profile settings
• Only emails matching existing contact records in the platform are synced
• OAuth tokens are encrypted at rest and are never visible to other users or PGD staff
• Disconnecting your account immediately stops further sync

7.1 Google Gmail Integration

When you choose to connect your Gmail account to Always On, we request access to the following Google account data:

• Read your emails (gmail.readonly) — We access your Gmail messages solely to match incoming and outgoing emails against contact records in your sales pipeline. Email content is stored securely and linked to the relevant contact profile within your organisation's workspace.
• Send emails on your behalf (gmail.send) — We send emails through your Gmail account when you compose and send messages from within the platform. These sent emails are also recorded against the relevant contact record.

7.2 What We Do Not Do

We do not:

• Share your Gmail data with third parties
• Use your email content to train AI models
• Access emails unrelated to your sales activity
• Store email content beyond what is required to display it in the platform

7.3 Disconnecting Your Gmail Account

Your Gmail connection can be disconnected at any time from your account settings. Disconnecting immediately revokes our access and stops any further email syncing.

You can also revoke access directly via your Google Account permissions page.

7.4 Microsoft Outlook Integration

When you choose to connect your Microsoft (Outlook / Microsoft 365) account to Always On, we request access to the following Microsoft account data via the Microsoft Graph API:

• Read your emails (Mail.Read) — We access your Outlook messages solely to match incoming and outgoing emails against contact records in your sales pipeline. Email content is stored securely and linked to the relevant contact profile within your organisation's workspace.
• Send emails on your behalf (Mail.Send) — We send emails through your Outlook account when you compose and send messages from within the platform. These sent emails are also recorded against the relevant contact record.
• Maintain access (offline_access) — We request a refresh token so your connection remains active without requiring you to re-authenticate each session. This token is encrypted at rest and never visible to other users or PGD staff.

7.5 What We Do Not Do (Microsoft)

We do not:

• Share your Outlook or Microsoft account data with third parties
• Use your email content to train AI models
• Access emails unrelated to your sales activity
• Access your calendar, contacts, files, or any Microsoft data beyond email
• Store email content beyond what is required to display it in the platform

7.6 Disconnecting Your Microsoft Account

Your Microsoft connection can be disconnected at any time from your account settings. Disconnecting immediately revokes our access and stops any further email syncing.

You can also revoke access directly via your Microsoft My Apps portal or through your Microsoft Account permissions page at account.microsoft.com.

8 Data Retention

9 Your Rights

As a platform user (rep or manager)

• Access, correct or request deletion of your account data — contact your manager or info@plangrowdo.com
• Disconnect your email account at any time from your profile settings
• Request deletion of your Always On account — contact your manager

As a contact whose data is in the platform

• Your rights should be exercised with the business (tenant) that entered your data — they are the Data Controller
• If you cannot reach them, contact rob@plangrowdo.com and we will direct your request appropriately

10 Complaints

If you have a concern about how data is handled within Always On, contact info@plangrowdo.com in the first instance.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

11 Changes to This Policy

We may update this policy as the platform evolves. The version date at the top indicates when it was last revised. Significant changes will be notified to tenant administrators.