Privacy Policy
Last updated: July 7, 2026
Plarelo (the “Service”) is a relocation management platform. It is operated by its creators and individual operators (“we”, “us”, or “our”). Plarelo is not currently incorporated as a legal entity; references to “we”, “us”, or “our” throughout this policy refer to the individuals who create and operate the Service.
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have under the EU General Data Protection Regulation (“GDPR”) and applicable global privacy laws.
By using Plarelo you confirm you have read and understood this policy. If you do not agree, please do not use our service.
1. Who We Are (Data Controller)
The creators and operators of Plarelo act as data controllers for the personal data you provide through this service. You can contact us about privacy matters at privacy@plarelo.com.
2. Data We Collect
Account data
- Full name and email address (required to create an account)
- Role (person relocating or relocation advisor)
- Hashed password (stored by Supabase Auth — we never see it in plaintext)
Relocation project data
When you create a project or complete the onboarding questionnaire we collect information you voluntarily provide, which may include:
- Origin and destination countries/cities
- Intended move date and reason for moving
- Family composition (number and ages of adults and children)
- Employment status, housing preferences, budget range
- Whether you have pets, vehicles, or goods to ship
- Decisions, tasks, paperwork items, and notes you create inside a project
Data entered by advisors on behalf of clients
When a relocation advisor uses Plarelo to manage a project for a client, the advisor enters their client's personal data into the Service. In that context:
- The advisor is the data controller for their client's personal data.
- We act as the data processor, handling the data only as instructed by the advisor through the Service.
- Advisors are required to declare at project creation that their client has authorised them to store and manage the client's relocation information on their behalf. This declaration is recorded with a timestamp in our systems.
- If you are a client whose data has been entered by an advisor, you may contact us at privacy@plarelo.com to exercise your data rights. We will coordinate with the relevant advisor to fulfil your request.
Usage and analytics data
When you use Plarelo we automatically collect:
- IP address, browser type, device type, and operating system
- Pages visited, features used, and events triggered (via PostHog, delivered through Google Tag Manager)
- Session identifiers created by Supabase Auth
Cookie data
See Section 8 (Cookies) for details.
3. How We Use Your Data
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Providing the core project and plan features | Performance of a contract (Art. 6(1)(b)) |
| Generating an AI relocation plan using your project data | Your explicit consent (Art. 6(1)(a)) — requested before first use |
| Sending invitation and notification emails | Performance of a contract / Legitimate interests (Art. 6(1)(f)) |
| Product analytics to understand usage and improve the service | Your consent for analytics cookies (Art. 6(1)(a)) |
| Fraud prevention, security, and abuse detection | Legitimate interests (Art. 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
4. AI Plan Generation
When you choose to generate a relocation plan, your project's onboarding data (origin, destination, family details, housing preferences, etc.) is sent to Google's Gemini AI models via Google Cloud to produce a personalised checklist. This data is processed under Google's data processing terms and is not used to train Google's AI models under our enterprise agreement.
The output is a planning aid only. Nothing in your Plarelo plan constitutes legal, immigration, financial, or medical advice. Always consult qualified professionals for binding decisions.
We ask for your explicit consent before the first generation. You may withdraw consent at any time by contacting us at privacy@plarelo.com — withdrawal does not affect prior processing.
5. Third-Party Processors
We share data with the following sub-processors, each bound by a data processing agreement:
| Provider | Purpose | Location |
|---|---|---|
| Supabase (Postgres database, authentication) | Database and authentication | EU and US data centres |
| Vercel | App hosting | EU and US data centres |
| Google Cloud AI / Gemini | AI plan generation | US |
| Zoho (Zoho Flow / Zoho Mail) | Transactional email (invites, notifications) | EU and US data centres |
| PostHog (via Google Tag Manager) | Usage analytics (only with your consent) | US |
Transfers to the US are protected under the EU Standard Contractual Clauses (SCCs) or the EU–US Data Privacy Framework as applicable.
We do not sell your personal data to any third party.
6. Data Retention
We retain your account and project data for as long as your account is active. If you request deletion of your account we will permanently delete all associated personal data within 30 days, except where retention is required by law.
PostHog analytics data is retained for 1 year per our PostHog configuration.
7. Your Rights
Depending on your location you may have some or all of the following rights. EU/EEA residents have all of them under GDPR:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure (“right to be forgotten”) — ask us to delete your personal data.
- Data portability — receive your data in a structured, machine-readable format.
- Restriction — ask us to limit how we process your data in certain circumstances.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, you may withdraw it at any time.
- Lodge a complaint — you have the right to complain to your local data protection authority. In the EU this is typically your national DPA.
To exercise any of these rights, email us at privacy@plarelo.com. We will respond within 30 days (or 72 hours for urgent requests such as suspected breaches).
8. Cookies
We use cookies and similar local storage mechanisms. They fall into two categories:
Necessary
These are required for the service to function and cannot be turned off. They include Supabase Auth session cookies (to keep you logged in) and our cookie consent preference stored in your browser's local storage.
Analytics
PostHog analytics cookies help us understand how Plarelo is used so we can improve it. PostHog is delivered through Google Tag Manager and is only activated with your consent. You can change your preference at any time via the cookie banner or by contacting us.
We implement GTM Consent Mode so that analytics are only activated after you accept analytics cookies.
9. Children
Plarelo is not directed at persons under 18 years of age. We do not knowingly collect personal data from children. If we learn that we have inadvertently collected such data we will delete it promptly.
10. Changes to This Policy
We may update this policy from time to time. When we make material changes we will update the “Last updated” date at the top of this page and, where required, notify you by email or in-app notice. Continued use of Plarelo after a change constitutes acceptance of the updated policy.
11. Contact
For any privacy-related questions or to exercise your rights, contact us at privacy@plarelo.com.