Privacy and Personal Data Protection Policy — AI4PLAN

AI4PLAN SAS SIRET: 847 604 873 00020 – Intra-Community VAT: FR80 847 604 873 Registered office: ESC 7 BOITE 16, 8B rue Michelet, 92150 Suresnes, France

In force from 27 August 2026

Translation provided for information only. This Policy is drafted in French. Only the French version is legally binding (T&Cs, art. 1).

1. Purpose of the Policy

This Privacy and Personal Data Protection Policy (hereinafter the “Policy”) describes the conditions under which AI4PLAN collects, processes, retains, secures and uses the personal data of its Customers and their Users in connection with the use of the AI4PLAN SaaS service.

It applies to all processing carried out by AI4PLAN in the course of:

• subscription to the Services,
• use of the Software and associated features,
• assistance, maintenance and support,
• commercial and contractual management.

This Policy supplements the applicable Terms and Conditions of Sale (T&Cs), Terms of Use (ToU) and Data Processing Agreement (DPA).

2. Controller

AI4PLAN SAS acts as Controller for the personal data it collects directly from Customers and Users (commercial management, support, accounts).

AI4PLAN acts as Processor for data processed on behalf of the Customer in connection with the operation of the Service (imported documents, operational data).

Such processing is framed by the DPA, in accordance with article 28 of the GDPR.

3. Data collected

Minimisation principles

AI4PLAN applies the principles of minimisation, necessity and proportionality. Only the data strictly necessary to the supply, securing and improvement of the Service is collected.

3.1 Data supplied by the Customer

The personal data processed may include:

• surname, first name, business email address,
• position, organisation, business contact details,
• login credentials,
• information necessary for invoicing and contracting,
• data exchanged with support.

3.2 Data generated during use of the Service

In connection with the operation of the Service, AI4PLAN also collects:

• Technical data: access logs, event logs, metadata, usage traces,
• Application navigation data: user actions, parameters used, performance,
• Derived data: metadata linked to imported files, technical information necessary for processing.

3.3 Data uploaded by the Customer

The Customer remains solely responsible for the files, documents and data it imports into the software (including PDF, DXF or other content).

Such data may contain personal, technical or contractual information whose management is a matter for the Customer.

AI4PLAN never uses that data for prospecting or canvassing purposes, and discloses it to no third party.

It processes that data on behalf of the Customer in order to operate and secure the Service, and may exploit it to improve the Software and its algorithms, exclusively in aggregated or anonymised form, on the terms of article 10.5 of the T&Cs.

4. Purposes of the processing

Personal data is processed for the following purposes:

4.1 Supply and management of the Service

• management of User accounts,
• authentication and access control,
• performance of the technical operations necessary to the running of the Software,
• management of support, maintenance and incidents.

4.2 Improvement of the Service and security

• continuous improvement of algorithms and features,
• technical monitoring and anomaly detection,
• protection against fraudulent access,
• optimisation of the performance and reliability of the Service.

4.3 Commercial and contractual management

• invoicing, management of Subscriptions,
• contractual communications,
• customer support.

4.4 Legal obligations

• compliance with accounting, tax and legal obligations,
• response to legitimate administrative or judicial requests.

5. Legal basis for the processing

Each processing operation rests on the legal basis indicated below:

Where processing exceptionally rests on consent, that consent may be withdrawn at any time, without such withdrawal affecting the lawfulness of processing already carried out.

6. Sharing and recipients of data

Categories of processors

AI4PLAN calls only on processors offering sufficient guarantees as regards security and GDPR compliance. The categories of processors include in particular:

• cloud hosting providers;
• monitoring and observability providers;
• storage and backup providers;
• support and ticketing services;
• transactional email sending tools;
• fraud and incident detection systems;
• management of the institutional website and appointment booking;
• conversational agent;
• customer relationship management and payment service providers.

The list of names of the processors in force is communicated to the Customer on request. AI4PLAN informs the Customer of any addition or replacement at least thirty (30) days before it is implemented, on the terms of article 7 of the DPA.

AI4PLAN may share certain data with:

• its authorised personnel, bound by an obligation of confidentiality;
• its technical processors falling within the categories above;
• administrative or judicial authorities where the law so requires.

All processors are subject to strict confidentiality and security obligations.

No personal data is sold, rented or transferred to third parties for commercial purposes.

7. Retention period

Data is retained for the period necessary for the purposes pursued, according to the following periods:

At the end of these periods, the data is deleted, subject to retention required by a legal obligation or necessary for the establishment, exercise or defence of legal claims.

8. Security and integrity of data

AI4PLAN implements a high level of technical and organisational measures:

• encryption of communications,
• segregation of environments,
• reinforced access control,
• continuous monitoring,
• regular backups,
• protection against intrusion and abnormal behaviour.

The Customer remains responsible for the security of its own environment: workstations, access rights, internal networks, passwords, account management.

9. Rights of data subjects

In accordance with the GDPR and the French Data Protection Act, each data subject has the following rights:

• right of access to their data;
• right to rectification;
• right to erasure;
• right to object;
• right to restriction of processing;
• right to portability;
• right to withdraw consent at any time, where the processing rests on it;
• right to give directions as to the fate of their data after their death;
• right to lodge a complaint with the CNIL.

Absence of automated decision-making

The Outputs produced by the Software are intended to be verified by a qualified human operator and do not constitute automated decisions producing legal effects or significantly affecting a person within the meaning of article 22 of the GDPR.

Exercise of rights where AI4PLAN acts as processor

For data contained in the files imported by the Customer, AI4PLAN acts as processor. In that context, any request to exercise rights must be addressed to the Customer, as controller. AI4PLAN provides the Customer with the assistance necessary to respond to it, in accordance with the DPA.

Exercise of rights with AI4PLAN

For data collected directly by AI4PLAN (accounts, logs, support), rights are exercised at rgpd@ai4plan.com or by post to the registered office.

AI4PLAN may request proof of identity before taking any action, and responds within one month, extendable by two months in the case of a complex request.

10. Technical data and algorithms

Controller / Processor distinction

Where the data processed comes from the files imported by the Customer (drawings, PDF, DXF or other content), AI4PLAN acts exclusively as processor. Any request to exercise rights concerning that data is redirected to the Customer, as controller.

AI4PLAN may exploit technical data (logs, metadata, usage statistics) in order to:

• improve the performance of the Software,
• improve and refine its processing algorithms,
• detect abnormal behaviour,
• strengthen security.

The files imported by the Customer may be analysed in order to produce Outputs (quantity take-offs, interpretations, annotations). Those outputs must be verified by a qualified human operator.

Quantity take-off processing implements no machine-learning model, and Customer data is not used to train any. The conversational agent relies on a service supplied by a third party, on the terms of article 11.

The technical data exploited to improve the Service is aggregated or anonymised, so as to prevent any re-identification.

11. Transfer outside the EU

Customer data — imported files, Outputs, accounts and application logs — is hosted in a European Union region.

Certain technical resources necessary to the delivery of the Service, in particular those attached to the content delivery network, are administered from a region located in the United States, and that network serves content from points of presence distributed worldwide. The resulting access logs may contain technical data such as IP addresses.

Such processing and transfers are framed by the data processing agreement entered into by AI4PLAN with its infrastructure provider, which incorporates the standard contractual clauses approved by the European Commission, supplemented by appropriate additional technical measures.

AI4PLAN further makes available a conversational agent supplied by a provider established in Canada. Exchanges with that agent are processed by that provider, under a data processing agreement incorporating the standard contractual clauses approved by the European Commission.

12. Cookies and similar technologies

AI4PLAN uses only cookies and local storage mechanisms strictly necessary to the operation of the Service:

• session maintenance and User authentication;
• securing of access;
• storage of interface preferences;
• operation of the conversational agent.

As these mechanisms are strictly necessary to the supply of a service expressly requested by the User, they are exempt from the requirement to obtain consent.

AI4PLAN uses no audience measurement, advertising or behavioural tracking cookie, and carries out no targeted advertising.

13. Termination and deletion of data

At the end of the contract:

• the User Accounts cease to be associated with the Customer Account and lose access to the Service; the User Account, being personal, subsists;
• the Customer Data and the Outputs are, at the Customer’s choice, returned or deleted, on the terms of article 6.4 of the T&Cs and article 13 of the DPA;
• certain technical data may be retained for legal or security reasons, according to the periods in article 7.

14. Amendments to the Policy

AI4PLAN may amend this Policy at any time for legal, technical or organisational reasons.

The Customer will be informed in the event of a substantial change.

Use of the Service after an update amounts to acceptance of the revised Policy.

15. Contact

For any question relating to the protection of personal data, you may contact:

AI4PLAN — Data Protection Email: rgpd@ai4plan.com Address: ESC 7 BOITE 16, 8B rue Michelet, 92150 Suresnes, France

AI4PLAN undertakes to protect the confidentiality, integrity and security of the data of its Customers and Users.