Data processing agreement

You are the data controller for the personal data you put into Polylane. SMAT Solutions Pvt Ltd is the data processor, acting on your documented instructions — which, in normal use, are the actions you take in the product.

Subject matter: providing the Polylane planning service. Duration: for as long as your account is open, plus the deletion windows below.

Categories of data: account email, planner content you create (projects, channels, tasks, notes, calendar events), billing identifiers, and — only if you connect it — Google Calendar events you choose to sync.

Data subjects: you, and anyone you invite to a shared workspace.

We do not sell personal data, and we do not use your planner content to train machine-learning models.

You give general authorisation for the providers listed on our subprocessors page. We update that page before a new one begins processing customer data, and will email advance notice on request. Each subprocessor is bound to protections no weaker than these.

We apply the technical and organisational measures described on our security page, including database-enforced row-level isolation, encryption in transit and at rest, and access restricted to a fixed founder allow-list. Anyone with access is bound by confidentiality.

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and within 72 hours, with what we know, what we are doing, and what we recommend.

Export and deletion are available in-product, which covers most access and portability requests without needing us. Where you need our help to answer a data-subject request, email support@smatsols.com and we will assist at no charge.

Deleting your account removes your content from live systems immediately. Encrypted backups age out on their normal rotation, after which no copy remains. On request we confirm deletion in writing.

Our subprocessors operate globally, so data may be processed outside your country — including outside the EEA, UK, and India. Where required, transfers rely on Standard Contractual Clauses or an equivalent lawful mechanism in the subprocessor's own terms.

On reasonable written notice, and no more than once a year, we will answer a documented security questionnaire and supply the information reasonably needed to demonstrate compliance with this agreement.

This agreement supplements the terms of service. Where the two conflict on the processing of personal data, this agreement governs.