Privacy notice
Draft for review — not approved for publication
priv-01-2026-10-04.2
How AI Advisor processes information
Who is responsible?
PlanGRC is operated by Star Worldwide Trading Limited, company number 13530775. Our registered office is 268 Lees Road, Oldham, United Kingdom, OL4 1PA. We control information used for our website, enquiries and service administration. Customers normally control the personal information they put in their workspaces; we process that content under their instructions and applicable agreements.
Information and purposes
We process contact and organisation details submitted with enquiries, account and access information, customer workspace content, support correspondence, security records and privacy choices. We use these to respond to enquiries, provide and protect the service, manage customer relationships and meet applicable obligations. Please avoid submitting unnecessary sensitive information in public forms.
Legal grounds and optional choices
The appropriate ground depends on the purpose and applicable law: steps requested before a contract, contractual performance, legal obligations, or justified interests where permitted. Optional marketing and tracking require separate permission under our global design. A demo request is not marketing consent. Reading this notice or accepting service terms is not consent to optional processing.
Recipients and international processing
Hosting and security providers, communications providers and authorised support personnel may process information to deliver the service. Customers control their own authorised workspace users. The provider register, actual processing countries and required transfer safeguards must be verified before this draft is published; this draft makes no promise of exclusive UK or Saudi data residency.
Cookies and language
Authentication and requested interface features may use necessary cookies or browser storage. Cookie settings explains the configuration and optional choices. A country signal may suggest an initial language; your explicit supported-language choice takes priority. Optional services remain off without a valid choice. A language change does not grant consent.
Evidence and retention
Privacy decisions are recorded separately from service terms and policy acknowledgements. Evidence includes the purpose, decision, server time, receipt reference, language and exact notice version. We minimise identifiers and do not require a recording of your browsing session. Consent evidence is needed while relying on consent; any additional period must be justified. Detailed retention periods, backup handling and disposal arrangements remain subject to approval before publication.
Your choices and rights
You can reject optional services or withdraw permission through Privacy & cookies without losing essential access. Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing. For customer-controlled content, we assist the relevant customer. We verify requests proportionately and explain applicable exceptions. You may complain to the competent authority, including the UK ICO, the relevant EU authority or Saudi SDAIA where applicable.
Contact and updates
For privacy enquiries, contact [email protected] or write to our registered office above. We retain notice versions with effective dates and explain material changes; updates do not retrospectively expand permission. This draft requires factual and legal approval before publication.
Service, billing, refunds and payment privacy / شروط الفوترة والاسترداد وخصوصية الدفع
AI Advisor: information and processing
When authorised users request AI assistance, PlanGRC can send saved project context, selected framework requirements, interview answers, selected evidence excerpts and reviewed findings to the configured generation service. These may contain personal information included by the customer. The current hosted integration uses Token Harbor (tokenharbor.ai) to access the configured AI model. This identifies the gateway; the complete onward processing chain, locations, contractual coverage, provider retention and training practices remain unverified in this draft. Do not assume that data stays in one country or that the provider retains nothing.
AI Advisor: your control and review
Use only information you are authorised to share and remove unnecessary personal or sensitive information. Access and AI availability depend on the tenant and user permissions. Saved inputs, generated drafts, reviews and deliverables can form part of the customer workspace history. AI output can be incomplete or wrong and needs human review; it does not certify compliance or replace a professional decision. Browser privacy choices control optional browser services, not the customer’s separate instructions to use AI Advisor. An approved retention schedule and supplier/transfer disclosures are still required before this draft is published.
Star Worldwide Trading Limited
268 Lees Road, Oldham, United Kingdom, OL4 1PA+44 7883 27 1160
[email protected]
Privacy enquiries: [email protected]. You can also write to our registered office.