Effective date: 1 June 2026 · Last updated: 1 June 2026
We built VanillaPM to manage projects, not data. We collect only what we need to run the service, we don't sell your data, and we don't use your project content to train models or for advertising.
This Privacy Policy explains how VanillaPM ("we", "us", or "our") collects, uses, stores, and shares personal information when you use the VanillaPM platform ("Service"). It applies to all users of the Service, including visitors to our website, registered account holders, and organisation members.
VanillaPM is the data controller for personal information processed under this Policy. Our contact details are set out in Section 13.
This Policy should be read alongside our Terms of Service. By using the Service, you agree to the collection and use of information in accordance with this Policy.
| Data | When collected | Purpose |
|---|---|---|
| Full name | Account registration | Identify you within the platform and to other project members |
| Email address | Account registration | Account authentication, email verification, notifications, and support communications |
| Password | Account registration | Account authentication — stored as a salted hash; we never store or transmit plaintext passwords |
| Project content | During Service use | Tasks, WBS nodes, risks, budget entries, stakeholders, and other data you create — stored to provide the Service |
| Contact form messages | When you contact us | Responding to your enquiry |
| Payment information | Paid plan subscription | Processed by our payment provider — we do not store card numbers |
| Data | Purpose |
|---|---|
| IP address | Security, fraud prevention, and approximate geolocation for legal compliance |
| Browser and device type | Diagnosing technical issues and optimising the interface |
| Pages visited and feature usage | Understanding how the Service is used to guide product improvements |
| Session tokens | Maintaining your authenticated session — stored as secure, HTTP-only cookies |
| Error logs | Identifying and fixing bugs and service issues |
We use the information we collect to:
We do not use your personal information for advertising, and we do not sell, rent, or trade your personal information to third parties for their marketing purposes.
Where applicable privacy law requires a legal basis for processing personal information, we rely on the following:
Your name and email address are visible to other members of organisations and projects you belong to. Project content (tasks, risks, etc.) is visible to other members of the same project, subject to their assigned role and access level.
We share data with trusted third-party service providers who help us operate the Service. These providers are bound by data processing agreements and may only use your data as instructed by us:
We may disclose personal information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
If VanillaPM is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you by email and/or a prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.
We do not sell, rent, trade, or otherwise share your personal information with any third party for their own commercial purposes.
Your data is stored on servers located in [data centre region]. We implement industry-standard technical and organisational security measures, including:
No method of transmission or storage is 100% secure. While we work hard to protect your information, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at [email protected].
We retain your personal information for as long as your account is active or as needed to provide you with the Service. Specific retention periods:
After the applicable retention period, data is securely deleted or anonymised. Database backups are overwritten on a rolling 30-day cycle.
VanillaPM uses a minimal set of cookies strictly necessary to operate the Service:
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
sessionid | Strictly necessary | Maintains your authenticated session | Session / configurable |
csrftoken | Strictly necessary | Protects against cross-site request forgery | 1 year |
We do not use advertising cookies, tracking pixels, third-party analytics cookies, or any cookies that track you across other websites. We do not use Google Analytics, Facebook Pixel, or similar third-party tracking tools.
You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging in and using the Service.
Depending on your location, you may have the following rights regarding your personal information:
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may ask you to verify your identity before fulfilling your request.
If you are in the EU or UK and believe we have not handled your personal information in accordance with applicable law, you have the right to lodge a complaint with your local data protection supervisory authority.
The Service is not directed at children under 16 years of age (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with their information, please contact us at [email protected] and we will delete it promptly.
VanillaPM operates globally. Your personal information may be transferred to and processed in countries other than the one in which you reside. When we transfer personal information internationally, we take steps to ensure that appropriate safeguards are in place to protect your information and comply with applicable data protection law, including using standard contractual clauses where required.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email to your registered address and/or by a prominent notice within the Service at least 14 days before the changes take effect.
Your continued use of the Service after the effective date of the updated Policy constitutes your acceptance of the changes.
VanillaPM is the data controller for personal information collected through the Service. If you have questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us:
