Privacy in the app.
What data the Plonda app processes, and why.
Last updated: 25 September 2026
Controller
Plonda, represented by Lukas Kromminga
Silcherstraße 1
80807 Munich
Germany
Email: privacy@plonda.com
This policy applies to the Plonda application and the services behind it, including the apps for iOS and Android. The website privacy policy applies to plonda.com. This policy follows the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
Who is responsible for what
Plonda is a tool for companies. In most cases your employer or client sets up the use, decides which projects are recorded and who can see the recordings. That company is the controller for this project data, and we process it as a processor on its instructions and under a data processing agreement.
For the data we need to run the app itself, such as accounts, logs and support requests, we are the controller. If you would like to know who is responsible in your case, write to us; we will forward your request or answer it ourselves.
What data the app processes
Account data. Name, business email address, role in the project and a password hash. Accounts are created through your company.
Recordings. Photos, videos, 360° walkthroughs, depth and LiDAR data, and the models, areas and quantities calculated from them. On a construction site, people may appear in a recording.
Voice notes and text. Spoken or written notes about a room or a defect, which are turned into structured entries.
Recording metadata. Time of the recording, device type, sensor data used to determine position, and the assignment to project, building and room.
Location data. Only if you grant the location permission, and only to assign a recording to the right site. The app still works without this permission; the assignment is then made manually.
Device and log data. Device model, operating system version, app version, language setting, IP address, and error and crash reports. This serves operation, troubleshooting and security.
Support communication. Your messages to us and our replies.
The app does not process special categories of personal data, and we do not use your data for advertising. We do not sell data.
Permissions on your device
Camera for photos, videos and 360° recordings. Microphone for spoken notes. Photo library when you select existing recordings or save results. Location to assign a recording to a site. Notifications to tell you when an analysis has finished. Local storage so that recordings can be held on the device without a network connection and uploaded later.
Each permission is requested only when the matching feature is used, and can be withdrawn at any time in your system settings. Without the camera or microphone permission the corresponding recordings cannot be created.
Purposes and legal bases
We process the data to provide the app, analyse recordings, calculate areas and quantities, document results, keep the service secure and provide support.
We rely on the performance of a contract with your company (Art. 6(1)(b) GDPR), on our legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR), on your consent where we ask for it, for example for location and notifications (Art. 6(1)(a) GDPR), and on legal obligations (Art. 6(1)(c) GDPR).
People in recordings
On a construction site, workers and third parties may appear in a recording. The company making the recording decides whether such recordings are permitted and informs the people concerned. If you appear in a recording and have questions about it, contact the company operating the site, or us at privacy@plonda.com; we will put you in touch.
Storage and retention
Recordings are held on your device until they have been transferred, and are then stored on our servers. Project data remains available for as long as the company it belongs to uses the service. After use ends it is deleted, or handed over on request.
Records we are required to keep under commercial and tax law, such as invoices and accounting documents, are retained for the statutory retention periods, generally six to ten years (§ 257 HGB, § 147 AO), and during that time are used only for that purpose.
How to request deletion of your account and your data is described under Account and data deletion.
Service providers and storage locations
Hosting, storage, analysis, crash reporting and sending notifications run on Google Cloud Platform and Firebase, operated by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. The provider processes data only on our behalf and under a data processing agreement.
Recordings and project data are stored in Frankfurt am Main. The application logic runs in Belgium. The compute-intensive analysis of recordings is distributed across available capacity and may additionally run in the Netherlands and in the United Kingdom.
The apps are obtained through Apple and Google, who collect their own data in the process; their privacy policies apply to that.
Transfers to third countries
The locations named in Belgium, Germany and the Netherlands are within the EU. An adequacy decision of the European Commission is in place for the United Kingdom.
Where our provider's US parent company can obtain access, we base the transfer on the standard contractual clauses and on the EU-U.S. Data Privacy Framework.
Security
All transfers are encrypted. Access to project data is limited to the people the respective company gives access to. Plonda staff only access data as far as this is necessary for operation and support.
Children
Plonda is a tool for professional use. The app is not directed at children, and we do not knowingly collect data from children.
Your rights
You have the right to access your data, to have it corrected, deleted or its processing restricted, to receive or transfer your data, to object to processing based on legitimate interests and to withdraw a consent you have given with effect for the future. We answer within one month. Please write to privacy@plonda.com.
You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
Changes
We update this policy when the app or the legal requirements change. The version published on this page applies.