Privacy Policy

1. Who we are

PlanTheMagic is a digital trip-planning service available at planthemagic.net and related web pages, dashboards, billing areas, progressive web app features, and support features.

PlanTheMagic is operated by Island Ascent Limited, trading as PlanTheMagic.

For data protection purposes, the controller is:

Island Ascent Limited trading as PlanTheMagic

Company number: 17186774

Registered office and geographical address: Island Ascent Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

ICO registration number: [Pending with ICO - please contact us]

Email: privacy@planthemagic.net

This Privacy Policy explains how we collect, use, store, and share personal data when you use PlanTheMagic.

2. Scope of this policy

This policy applies to personal data we collect when you:

visit our website;
create or use a PlanTheMagic account;
start a trial or subscribe;
use trip planning, dining, AI, billing, feedback, and support features;
contact us; or
receive emails from us.

Our service is designed for consumers aged 18 or over. It is not intended for children.

3. The personal data we collect

3.1 Data you provide directly

We may collect:

your name;
your email address;
your password in hashed form;
your email verification status;
your profile details;
saved Disney membership flags;
trip details and trip settings;
planner items, meal plans, notes, confirmation numbers, links, and other content you choose to store in the Service;
feedback submissions, bug reports, feature requests, and support messages;
your marketing preferences; and
account deletion requests or other privacy requests.

3.2 Billing and subscription data

When you start a trial or subscribe, we and our payment provider may process billing-related data, including:

Stripe customer ID;
Stripe default payment method ID;
card brand;
last four digits of your card;
expiry month and year;
Stripe subscription ID;
Stripe price ID;
subscription and trial status;
renewal, trial, and billing-period dates;
cancellation status and end dates;
invoice history; and
related metadata.

We do not store your full payment card number or card security code.

3.3 Technical and usage data

When you use the Service, we may automatically collect:

IP address;
browser, device, and operating system information;
approximate location derived from IP address;
timestamps;
log data;
authentication events;
cookie and similar technology identifiers;
service usage data, such as pages viewed and features used;
error, diagnostic, and performance data; and
local device storage data, such as local storage, IndexedDB, service worker cache, and similar technologies used for app functionality.

3.4 Data from third parties

We may receive personal data from third parties, including:

Stripe, for payment, subscription, invoice, and billing-status information;
Amazon SES and Amazon WorkMail, in connection with email delivery and communications;
Google Analytics, for website and service usage statistics;
OpenAI, when you use certain AI-powered features; and
GitHub, where feedback workflows or issue-sync functions are used.

4. How we use your personal data

We use personal data to:

create and manage your account;
verify your email address and authenticate your access;
provide the planner, dining, export/import, dashboard, billing, and profile features;
process trials, subscriptions, renewals, invoices, and cancellations;
send essential service emails, such as verification emails, password resets, billing notices, account alerts, planning reminders, and service updates;
provide optional marketing emails where you have opted in;
operate and improve AI-powered features such as “Must Eats”;
provide customer support and investigate issues;
monitor, secure, maintain, and improve the Service;
detect, prevent, and investigate fraud, misuse, scraping, account sharing, excessive use, and other breaches of our Terms;
maintain audit logs and internal records;
handle feedback and sync certain feedback items into GitHub workflows;
comply with legal and regulatory obligations; and
establish, exercise, or defend legal claims.

5. Our lawful bases

Depending on the context, we rely on one or more of the following lawful bases under UK data protection law:

5.1 Contract

We process personal data where necessary to provide the Service you requested, including:

account creation and login;
trip planning and planner storage;
billing and subscription administration;
password resets and account communications;
CSV import/export and related features; and
optional features you choose to use, including AI recommendations.

5.2 Legitimate interests

We process personal data where necessary for our legitimate interests, provided those interests are not overridden by your rights. These interests include:

keeping the Service secure;
preventing misuse, fraud, scraping, and abusive behaviour;
troubleshooting and support;
improving the performance, design, and reliability of the Service;
understanding how the Service is used at an aggregate level;
handling feedback and product development;
maintaining audit records;
enforcing our Terms; and
protecting our legal position.

5.3 Legal obligation

We process personal data where necessary to comply with legal obligations, including tax, accounting, fraud-prevention, law-enforcement, and regulatory requirements.

5.4 Consent

We rely on consent where appropriate, including for:

marketing emails and similar promotional communications; and
any processing where the law specifically requires consent.

Where we rely on consent, you can withdraw it at any time. Withdrawal will not affect processing already carried out before you withdrew consent.

6. AI features

PlanTheMagic may offer AI-powered features, including “Must Eats”.

For this feature, we send restaurant-focused data only, such as:

restaurant name;
meal service;
area and area type;
cuisines;
service flags;
an official menu URL where available; and
technical request settings.

We do not send your account information, trip name, or free-form trip notes in that request.

We use AI outputs to provide recommendations inside the Service. AI outputs may be inaccurate, incomplete, or out of date and should be treated as informational only.

OpenAI is not permitted by us to use this data to train its models for this feature.

7. Cookies, local storage, analytics, and similar technologies

We use cookies and similar technologies, including local storage, IndexedDB, and service worker cache, for the following purposes:

7.1 Essential technologies

Some technologies are necessary for core functionality, such as:

keeping you signed in;
maintaining session security;
remembering basic app state;
supporting the progressive web app;
storing offline assets or fallback content; and
protecting the Service from abuse.

7.2 Analytics technologies

We use Google Analytics to understand how visitors and users interact with the website and Service, and to improve performance, layout, navigation, and product decisions.

This may involve the collection of information such as:

number of users and sessions;
approximate geolocation;
browser and device information;
page usage and navigation patterns; and
similar aggregate or statistical usage information.

7.3 Your choices

You can control some storage and access technologies through your browser or device settings.

You can also object to our use of Google Analytics for service-improvement statistics by using: [insert your on-site analytics opt-out control, privacy settings route, or equivalent mechanism].

If we use any non-essential storage or access technologies for purposes beyond the scope described above, we will update this policy and, where required, provide an appropriate consent or choice mechanism.

8. Account access, support access, and audit logging

We restrict internal access to personal data to those who need it for legitimate business purposes.

PlanTheMagic staff may access or impersonate a user account only where reasonably necessary to:

provide support;
investigate suspected breaches of the Terms of Service;
maintain security;
prevent fraud or misuse; or
respond to a lawful request from an appropriate authority.

Such actions are logged. Audit logs may record the support agent involved, the action taken, and the date and time.

9. Feedback and GitHub issue sync

If you submit feedback through the Service, we may review, categorise, and use it to improve PlanTheMagic.

Where our workflow includes GitHub issue syncing:

we do not intentionally send your personal data to GitHub unless you include it yourself in the free-text field; and
otherwise, the sync may include a user ID and internal metadata that can only be correlated with your identity by PlanTheMagic staff.

Please do not include sensitive or unnecessary personal data in feedback submissions.

10. Who we share personal data with

We may share personal data with:

Stripe, for payment processing, billing, and invoicing;
Amazon Web Services (AWS), for hosting and infrastructure;
Amazon SES and Amazon WorkMail, for sending and managing communications;
OpenAI, for limited AI feature processing;
Google Analytics, for usage analytics;
GitHub, for issue-management workflows connected to feedback;
professional advisers, such as lawyers, accountants, insurers, or auditors;
regulators, courts, law-enforcement bodies, or other authorities where required or appropriate; and
a purchaser, successor, or reorganisation party if we sell, transfer, or restructure all or part of the business.

We require service providers to handle personal data only as needed for the relevant service, subject to appropriate contractual and security measures.

11. International transfers

We primarily operate our infrastructure from the United Kingdom and Ireland.

Our AWS environment is in London, United Kingdom.

Our database is in Dublin, Ireland.

Certain personal data connected with AI features may be processed in the United States by OpenAI.

Certain payment-related data may be stored or processed by Stripe in the United States and other countries where Stripe or its service providers operate.

Analytics and other support providers may also process data outside the UK from time to time.

Where we transfer personal data outside the UK, we take steps intended to ensure it remains appropriately protected. Depending on the circumstances, this may include relying on adequacy regulations, contractual safeguards, transfer addenda, or other lawful transfer mechanisms.

You can contact us if you would like more information about the safeguards we rely on for relevant transfers.

12. Data retention

We keep personal data only for as long as reasonably necessary for the purposes described in this policy.

In general:

we keep account, profile, and trip data while your account remains active;
if you sign up but do not convert to a paid service and the account remains dormant, we may delete it after 6 months;
if you delete your account, we will remove your active account and trip data from our live systems promptly, subject to limited retention described below;
billing, payment, invoice, compliance, fraud-prevention, tax, accounting, audit, and similar records may be kept for 5 years or more after the end of the business relationship or the date of the last transaction, and longer where reasonably necessary or legally required;
support records, feedback records, and audit logs may be kept for as long as reasonably necessary to deal with support, security, misuse, compliance, disputes, and product history; and
backup copies may remain for a limited rolling period until they are overwritten in the ordinary course.

If we do not apply a fixed retention period, we decide how long to keep the data based on the nature of the data, the purpose for which it was collected, the sensitivity of the data, legal requirements, operational need, and the risk of harm from unauthorised use or disclosure.

13. Sensitive data

PlanTheMagic is not designed for storing special category personal data or other highly sensitive information.

Please do not submit sensitive personal data through planner notes, feedback forms, or other free-text fields unless it is strictly necessary. This includes information about:

health or medical conditions;
allergies;
accessibility needs;
religion or beliefs; or
other similarly sensitive matters.

If you submit sensitive data anyway, we may delete it, redact it, or handle it only as needed to operate the Service, respond to your request, protect legal claims, or comply with law.

14. Children

PlanTheMagic is intended only for adults aged 18 or over.

We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete it.

15. Your rights

Depending on your location and the circumstances, you may have the right to:

access the personal data we hold about you;
ask us to correct inaccurate or incomplete personal data;
ask us to delete your personal data;
ask us to restrict how we use your personal data;
object to processing based on legitimate interests;
receive a copy of certain personal data in a portable format;
withdraw consent where we rely on consent; and
complain to the Information Commissioner’s Office (ICO) or, where applicable, another supervisory authority.

To exercise your rights, contact us at contact@planthemagic.net.

We may ask for reasonable proof of identity before actioning certain requests.

16. Marketing communications

We may send you marketing emails such as newsletters, product updates, feature launches, offers, or reminders if you have opted in, or where otherwise permitted by law.

You can unsubscribe from marketing emails at any time using the unsubscribe link in the email or by contacting us.

We will still send essential service-related communications, such as billing notices, account alerts, password resets, and important updates about the Service.

17. Security

We use technical and organisational measures designed to protect personal data, including measures such as:

encryption in transit;
access controls;
least-privilege access practices;
audit logging; and
security monitoring and review.

No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security.

18. Third-party websites and services

The Service may link to third-party websites and services, including Disney websites, reservation pages, menus, maps, Stripe-hosted billing pages, and other third-party resources.

We are not responsible for the privacy practices of those third parties. Their own privacy notices and terms will apply.

19. Automated decision-making

We do not use your personal data to make solely automated decisions that produce legal effects, or similarly significant effects, about you.

20. Changes to this policy

We may update this Privacy Policy from time to time.

When we do, we will post the updated version on the website and update the effective date above. If the changes are material, we may also notify you by email or in-app notice.

21. Contact us