Privacy Statement

Who we are

replanif is a product of Beamline AI (Pty) Ltd, a private company registered in South Africa (registration number 2026/766108/07), 5 Pinotage Close, Nooitgedacht Village, Stellenbosch, Western Cape, South Africa.

For the website and for our own customer relationship, we are the responsible party. For the project information your organisation puts into the application, your organisation is the responsible party and we process that information on its behalf, as its operator, under our Terms of Service.

Our Information Officer can be reached at privacy@replanif.com.

What we collect in the application

Account information: the name and work email address of each person your organisation invites, and their role.

Project information: whatever your organisation records in its workspace, such as work items, plans, risks, actions, leave, reports and the names of the people and external stakeholders they are assigned to.

Security and usage records: sign-in attempts (kept for 24 hours, with the IP address stored only as a salted hash), which of a person's devices are signed in and when each was last used, a record of important actions taken in the workspace, and the date, time and IP address at which each person accepted our Terms of Service.

Your name and work email are needed to use the service or get a reply; other demo-form fields are optional. Records of important actions and of terms acceptance are kept for the life of the workspace.

What we collect on the website

If you ask for a demo, we receive your name, work email, company, team size and your message. It is sent to us by email and is not stored in any database. We use it only to reply to you.

The website sets no cookies and uses no analytics or advertising trackers. Our hosting provider keeps short-lived request logs, including IP addresses, for security.

Why we use it

To provide the service your organisation has subscribed to: signing people in, showing each person their organisation's projects, sending the reminders and notices the application sends, and keeping the service secure.

To answer enquiries and manage our customer relationship.

We do not sell personal information, we do not use it for advertising, and we do not send marketing email unless you have asked for it.

AI features

replanif AI powers features such as risk analysis and forecasting. It runs on large language models from third-party AI providers, and those features send project information to the provider to generate a suggestion. They run only when someone in your organisation asks, and nothing is saved to your workspace without a person deciding to keep it.

Before anything is sent, the names of people known to the workspace are replaced with placeholders, and email addresses, phone numbers (international formats with a country code, plus South African and US formats) and ID numbers (South African ID and US Social Security numbers) are removed. If a known name would still be sent, the request is stopped. A name typed in passing that the workspace does not know may not be recognised and removed, so please avoid writing unnecessary personal details into free-text fields.

The prompts sent to the AI are not stored. Risk-analysis suggestions are kept in your workspace until someone accepts, watches or dismisses them; any still untriaged are deleted 90 days after the analysis ran, or sooner if the project is deleted; other AI replies are shown to you and not stored unless you save them. We use only AI providers whose commercial terms do not allow the information we send to be used to train their models.

Who processes it for us

The application's database and sign-in service (Supabase) and its hosting (Vercel) run in London, in the United Kingdom. The replanif.com website, including the demo-request form, is hosted by Vercel in the United States.

Nightly backups are encrypted before they leave our systems and are stored with Cloudflare in the European Union.

Email, such as invitations, reminders and demo requests, is sent through Resend, which may process it outside South Africa, including in the United States. replanif AI uses third-party AI providers, which may process information outside South Africa, including in the United States. We may use more than one provider, for example as a fallback.

A current list of the sub-processors we use, including our AI providers, is available on request from privacy@replanif.com.

Where personal information leaves South Africa, we send it only to providers bound by written agreements giving it protection substantially similar to POPIA's (section 72(1)(a)), on the authority your organisation gives us in our Terms of Service.

How long we keep it

Workspace information is kept for as long as your organisation's subscription lasts. When a subscription ends, we delete the workspace as described in our Terms of Service.

Sign-in attempt records are deleted after 24 hours. Untriaged risk-analysis suggestions are deleted after 90 days. Backups are kept for 30 days and then deleted, so deleted information can remain in a backup for up to 30 days.

Demo requests are kept in our mailbox only as long as we need them to deal with your enquiry.

How we protect it

Each organisation's information is kept separate, and access is checked on every request. Connections are encrypted, backups are encrypted, and inactive sessions are signed out automatically after a period your organisation's administrator sets.

If a security incident affects workspace information, we tell your organisation immediately so it can meet its own duties. For information we hold as responsible party, we notify the Information Regulator and the people affected as POPIA section 22 requires.

Your rights

You may ask to see the personal information held about you, to have it corrected, or to have it deleted, and you may object to its processing. If you use replanif through your organisation, it is usually quickest to ask your organisation's administrator, who can correct or remove a person's details. You can also write to privacy@replanif.com, and we will respond within 30 days.

You have the right to complain to the Information Regulator of South Africa (inforegulator.org.za).

Changes to this statement

If we change how we handle personal information, we will update this statement and its date. Significant changes will be communicated to account administrators.