Privacy

DesignPlan is run by Amirhossein Shamlou, Zelda-Kaplan-Weg, 1100 Wien, Austria. We are responsible for your data (the controller). Questions or requests: hi@shamlou.me.

• Your account: email address, name if you give one, and your password, which is stored only as a secure hash. If you sign in with Google, we keep your Google account's id, email and name instead of a password.
• Your profile photo, if you add one: a small copy kept with your account.
• What you save in the tools: assessments and snapshots, growth plans, interviews, stories, case studies, things you keep as something you're working on, 1:1 agendas (with how often you meet, your manager's first name if you add it, and the actions you agree) and UX plans, and your chats with Ghely (kept so you can open them again; delete them anytime).
• Your beta acknowledgement: the version of the notice you accepted and when.
• Wishes and feedback you send: the title and message, the screenshots you choose to attach (up to three), your optional answer about how much it matters, the page you came from, your account, the time, and the status and private notes the administrator uses to follow up. Nothing is attached unless you add it. They are deleted with your account.
• If you joined with a beta code (no longer needed): when you redeemed it. The record keeps a code hash and its last four characters, never the full code. Deleting your account removes its link to that record.
• Your email choices: whether you get important updates, and whether and when you said yes to the newsletter and marketing emails.
• Your AI choice: whether AI assistance is on, when you chose, and which version of the explanation you saw. Each change is also kept in a history with the choice, the time and where you made it (first-use window or Settings).
• How many AI requests you made each day and how many tokens the AI service counted for them, including image inputs. These are totals only. We do not keep what you sent or what came back, and the history of your AI choice holds no answers or other content.
• Technical logs on our server, such as IP address and time of a request, to keep the service running and secure. When something breaks, we record the page address, the time and the error message, without what you typed, so we can fix it.
• If you allow session recording: how you use the app (clicks, scrolling, mouse movement, pages visited, screen size, browser and device type, and an approximate location from your IP address). All text on screen and everything you type is hidden before it leaves your browser. Your choice and each change to it are kept in the same history as your other choices.

We don't sell your personal data or use advertising tools.

• To give you your account and keep what you save: to provide the service you signed up for (contract).
• To send the newsletter and marketing emails: only if you said yes (consent). You can withdraw it in Settings at any time.
• To send important updates about DesignPlan, once it sends email: to run the service you signed up for. You can turn them off in Settings.
• To use the AI actions, such as reviewing an interview answer: only when you have turned on AI assistance (the first-use window or Settings) and click an AI action (consent). You can turn it off in Settings at any time. Without it, nothing is sent.
• To record sessions and see where the app is confusing: only if you allowed session recording (consent). You can turn it off in Settings at any time.
• To read feedback and improve DesignPlan: our legitimate interest in improving the beta. Do not include confidential employer or client information.
• To keep the service secure and fix problems: our legitimate interest in running a safe service.

• Hetzner Online GmbH hosts the app and its database on a server in Germany. Account details and saved tool data are hosted in the EU. Optional AI requests may be processed outside the EU, as described below. Hetzner processes data only on our instructions, under a data processing agreement.
• Microsoft Corporation provides Clarity, the session recording tool, only for people who allowed it. It receives the usage data listed above, with all text hidden, and may process it outside the EU, including in the United States. Microsoft processes it under its own Clarity terms and privacy statement. Clarity keeps recordings for about 30 days.
• DeepSeek, an outside AI provider, receives what you send when AI assistance is on and you click an AI action: the text you wrote or pasted for that action (for example an interview answer, a case study story, evidence notes, a job description, a problem description or the lines of a 1:1 agenda), any optional context you added, and the question or competency wording the action needs. Case-study review can also send the prepared screenshot or PDF-page images you select. Original PDFs are prepared in your browser and are not uploaded. For 1:1 help we send only the lines you wrote on that screen or in that agenda, never your manager's name, the date or anything else you saved. For Ghely chat, 1:1 help, mock interview help and growth plans, when “Let Ghely use my record” is on (it is on by default once you allow AI assistance, and you can turn it off in Settings), we also send a short summary of what you wrote in DesignPlan: your notes on skills in your latest self-assessment, things you kept as something you're working on, open growth actions, upcoming interviews, the questions you saved a story for, and your own 1:1 topics. It never includes your manager's name, the text of your stories or evidence, or your notes. Settings shows exactly what that summary holds. We never send audio or automatically add your account name or email. Your selected material may contain identifying information, so check it before sending. DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) processes it as a separate provider, under its own Terms of Service and Privacy Policy, on servers in China. DesignPlan has no data processing agreement with DeepSeek and doesn't control how DeepSeek stores or uses what you send. By turning AI assistance on, you agree to this and to DeepSeek's terms. If you don't want that, keep AI assistance off; every tool works without it.
• Google, only if you choose "Continue with Google": Google confirms who you are and tells us your Google account's id, email and name. Google learns that you signed in to DesignPlan, under its own privacy policy.
• Brevo (Sendinblue SAS, France) sends a password link when you ask for one. It receives your email address and that email, and nothing else.
• Hugging Face hosts the high-quality reading voice. The first time you use it, your browser downloads the voice from Hugging Face, which sees your IP address like any website. The voice then runs on your device: no text you have read aloud is sent anywhere.

Until you delete your account. Deleting it removes your saved work, including finalized snapshots. A used beta invitation stays used, with its link to your account removed. Server logs and backups are kept for a limited time and then deleted.

You can do most of this yourself in Settings:

• See and download your data: Settings, Download your data.
• Correct it: edit your name and email in Settings, and your work in the tools.
• Delete it: Settings, Delete account.
• Withdraw consent to emails: Settings, Emails from DesignPlan.
• Turn session recording off: Settings, Session recording.

You can also ask us to restrict or stop processing, or object to it, by writing to hi@shamlou.me. If you think we handle your data wrongly, you can complain to the Austrian Data Protection Authority (Datenschutzbehörde) or the authority where you live.

We set one cookie ourselves: the sign-in cookie that keeps you logged in. If you sign in with Google, a second cookie lasts up to ten minutes to finish that sign-in safely, then goes. It's needed for the app to work, so we don't ask for consent. If you allow session recording, Microsoft Clarity also sets its own cookies (such as _clck and _clsk) to connect the pages of one visit; turning recording off clears them. Your theme choice is stored in your own browser and never sent to us. The Designers Mixtape page loads YouTube's player only after you press "Load the playlist". From then on YouTube serves it under its own terms and privacy policy, through YouTube's privacy-enhanced address (youtube-nocookie.com).

When this page changes, the date at the top changes with it.