Privacy Policy

How PlaneMate collects, uses, shares and protects personal information.

Welcome to PlaneMate, a digital service for independent travelers, available through our website, mobile application, and related services. We respect the privacy of our Users and attach great importance to the protection of personal information. This Privacy Policy explains what personal information we collect, how we use it, with whom we may share it, where it is stored or processed, how long we retain it, and what rights Users have in relation to it.

This Policy applies to use of the website, application, social features, trip-planning tools, paid features, notification systems, affiliate links, and any other related PlaneMate service. The Service is intended solely for adults aged 18 and over.

By using the Service, you confirm that you have read this Privacy Policy. Where applicable law requires separate consent, a specific confirmation, or authorization for a particular processing activity, we will request it separately, and use of the service or parts thereof may be conditional upon providing such consent or authorization.

1. Who We Are

1.1 The controller of the personal information processed in connection with the Service is Nakama Software House, operating under the name PlaneMate, whose registered address is 81 HaMeyasdim Street, Peki'in HaHadasha.

1.2 You may contact us with any question, request, or inquiry concerning privacy at: support@nakama-software.com.

1.3 To the extent that PlaneMate is required by law to appoint a privacy protection officer or Data Protection Officer, it will appoint one in accordance with applicable legal requirements and make available to Users an appropriate method for contacting such person regarding the protection of personal information and the exercise of their rights. The relevant contact details will be published in this Policy, on the website, in the application, or through another appropriate channel.

2. What Information We Collect

2.1 Account and Profile Information. When registering for the Service, we may collect an email address, an encrypted and/or hashed password, full name, date of birth, gender, biography, profile picture, additional pictures, Instagram username, country, city, region, languages spoken, travel interests, preferred currency, and preferred language. Some information may be required to open an Account or use particular features, while other information is voluntary, at the User's discretion.

2.2 We do not collect phone numbers and do not send SMS messages as part of the Service in its current format. However, if this functionality is added in the future, the relevant processing will be carried out in accordance with an updated policy, applicable law, and, where necessary, on the basis of appropriate consent or authorization.

2.3 If the User chooses to sign in through external providers, Google or Apple, we may receive from those providers a user identifier, name, and email address, and in the case of Apple, a private relay email address if that is the information provided to us. The scope of information we receive depends on permissions, Account settings with the external provider, and the information the provider chooses to share in accordance with its policy.

Identity Verification

2.4 PlaneMate may offer a User, or in certain cases require, an identity-verification process intended to reduce impersonation, prevent fraud, and improve the safety and reliability of the Service. In certain circumstances, such as a genuine concern of impersonation or unauthorized use of an Account, Account recovery or security, use of a feature requiring a verified User, or where required by law, completion of the verification may be a condition for carrying out a particular action or using the relevant feature. Before the verification begins, the User will be informed whether the verification is voluntary or required in the relevant circumstances and of the consequences of choosing not to complete it.

2.5 As part of the verification process, we may collect and process a facial images, facial data, matching data, and additional technical information required for identity verification, liveness detection, prevention of impersonation, fraud, and misuse of the Service. The manner in which verification is performed and the technological means used in the process may change from time to time depending on the technology, feature, device, and circumstances of the verification. Additional information about the verification process and the related processing may be presented to the User before the verification begins.

2.6 Upon completion of the verification, we may retain the verification result, matching data, reason for approval or rejection, audit logs, and technical information relating to the verification, as well as information required to maintain verification status, prevent impersonation, secure the platform, and enforce the Service rules.

Location

2.7 When the User enables location-based features and grants the required permissions, we may collect and process precise or approximate location data and information derived from it, in accordance with device permissions, User settings, the feature being used, and the operation of the relevant operating system and services. We may use such information to display Users, places, routes, distances, and relevant content; personalize the Service; operate location-based features; ensure safety; prevent fraud; maintain security; and for operational purposes relating to the Service. In features in which the User chooses to publish or share their location, in whole or in part, other Users may see the User's location, area, distance, or another indication of their location, depending on the nature of the feature and the relevant settings. Location data will be retained for the period reasonably necessary for the purposes for which it was collected, depending to the type of data, the feature, safety and security needs, and legal requirements.

Private Communications and Content

2.8 We collect the content of chat messages, the sender's identity, timestamps, photos or files shared, trip references, and content uploaded to the Service, such as photos, biographies, trip descriptions, reviews, ratings, and comments. Please note that any any information published or shared with other Users may be accessed, copied, retained, photographed, reported, or transferred by anyone who has access to it, and we cannot guarantee full control over such uses after the information is shared.

Trip Planning and Financial Tools

2.9 We may collect itineraries, daily activities, lists, saved places, travel documents, flight and hotel searches, and shared-expense data, such as amounts, currencies, categories, who paid, who owes whom, and settlement status. The Service does not process payments, hold funds for Users, or act as a payment service provider, clearing provider, escrow provider, credit provider, or financial adviser; it only records such information for management, coordination, and display among Users.

Usage, Device, and Analytics

2.10 We may collect push tokens, platform type, device identifier, application version, IP address, language, time zone, usage events, screens viewed, profiles viewed, swipe actions, a preference profile learned from such actions, flight and hotel searches, clicks on affiliate links, saved places, reviews, and ratings. This information may be linked to the Account, Account identifier, device, session, technical identifiers, or derived identifiers, and processed for purposes of analysis, security, operation, optimization, measurement, and prevention of misuse.

2.11 For analytics and operational purposes, we use limited product measurements that may be linked to the User's Account. We may collect usage events, crash data, logs, metadata, and limited technical snapshots necessary for error monitoring, security, Service improvement, and incident documentation.

Safety

2.12 We may collect blocks, reports, reasons for reports, administrative actions, Account status, trust signals, trust scores, and information required to investigate incidents of harassment, impersonation, fraud, breach of terms, or safety risk. We may generate, infer, or update internal indicators, scores, classifications, and decisions for purposes of safety, trust, fraud prevention, and enforcement.

Subscriptions and Purchases

2.13 If the User purchases a subscription or paid feature, we may receive subscription-status data, purchase identifiers, receipts, entitlement status, and purchase attempts. Credit-card details, bank-account details, or other payment methods are generally handled directly by the Apple App Store, Google Play, or another relevant payment provider, and are not received by us in full, except as required for transaction verification, support, accounting, fraud prevention, or legal compliance.

Optional Integrations

2.14 If the User chooses to connect external services, such as Google Calendar for one-way export of trip events, we may retain an encrypted refresh token, the email address of the connected Account, and additional technical data required to operate, secure, monitor, and manage permissions for the integration. If the User requests an AI-based travel itinerary, we may transfer the destination, dates, preferences, and other relevant instructions provided by the User to the relevant model provider for purposes of generating the output, improving it, monitoring proper operation, enforcing policies, preventing prohibited use, and complying with law, in accordance with the policies and terms of that provider and subject to its settings and processes.

PlaneMate's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Access to the User's Google Calendar is requested only when the User chooses to connect it, and is used only to add the User's trip events to that calendar. We do not transfer Google user data to third parties, except to the infrastructure providers strictly necessary to operate the Service; we do not use it for advertising; and we do not allow humans to read it unless the User gives explicit consent, or where it is necessary for security, legal compliance, or troubleshooting that cannot be carried out using aggregated or anonymized information. Access tokens are stored encrypted, and the User may disconnect Google Calendar at any time from the application settings, after which our copy of the tokens is deleted.

Insights and Derived Information

2.15 We may generate, infer, combine, and update information based on information the User has provided to us and on the User's activity and use of the Service, including preferences, interests, usage and behavioral patterns, characteristics, relationships between data, ratings, classifications, trust and safety signals, recommendations, matches, and other derived information.

2.16 Such information may be used to operate and personalize the Service, generate recommendations and matches, develop and improve the Service and new features, conduct analysis and measurement, maintain safety and security, prevent fraud and misuse, enforce the Terms of Service, and protect Users and PlaneMate.

3. How We Collect Information

3.1 Directly from the User, when the User registers, completes a profile, performs identity verification, creates trips, sends messages, reports other Users, contacts support, connects integrations, subscribes to optional mailings, or makes a purchase.

3.2 Automatically, through operating systems, SDKs, log files, analytics components, push mechanisms, security tools, system records, local storage, technical identifiers, error monitoring, and based on use of the Service and its various features.

3.3 From third parties, when the User chooses to use them or where necessary to operate the Service, such as Apple Sign-In, Google Sign-In, app stores, payment providers, calendar providers, map providers, AI-based content providers, infrastructure providers, security providers, notification networks, and affiliate providers to which Users are redirected through links in the Service.

4. Purposes for Using Information

4.1 Provision of the Service and performance of the contract. We use information to open and manage Accounts, verify identity, display profiles, match travelers, enable chats, operate trip-planning tools, manage shared expenses, enable secure sign-in, provide paid features, operate integrations, enable messages and notifications, and provide support, maintenance, and customer service.

4.2 Legitimate interests. We use information to protect the safety of Users and the public; prevent impersonation, fraud, harassment, unauthorized access, spam, misuse of the Service, and breaches of terms; operate blocks and reports; calculate trust signals; improve product quality; develop, test, evaluate, and improve features, products, services, algorithms, matching, recommendation, safety, and fraud-prevention systems, including through automated tools, machine learning, and similar technologies; measure usage; conduct analytics; diagnose malfunctions; secure systems; conduct internal audits; back up and restore data; and enforce and protect our rights, property, safety, and legitimate interests, Users, and third parties.

4.3 Consent and permissions. In certain cases, we rely on the User's consent, authorization, or affirmative choice, for example, to enable precise location, send marketing communications if and to the extent implemented, connect optional integrations, enable non-essential components on the website or in the application where required by law, and use other features that the User chooses to enable voluntarily. The User may withdraw such consent or permission where appropriate, but such withdrawal may affect the availability or proper functioning of certain Services.

4.4 Legal obligation. We may use information to comply with legal requirements, court orders, requests from competent authorities, accounting requirements, reporting obligations, evidentiary preservation obligations, security and compliance requirements, and to handle disputes, claims, legal proceedings, or regulatory inquiries.

4.5 We process facial images, comparison data, and verification results for identity verification, prevention of impersonation and fraud, Account security, and maintenance of the safety and reliability of the platform. Where verification is offered voluntarily, the User may choose whether to participate in the process, and where consent is required by law for the processing of biometric information, separate and affirmative consent will be sought before processing begins. Failure to complete voluntary verification will not prevent regular use of the Service, but may prevent the User from receiving a verification badge or using features intended for verified Users. Where verification is required for a particular action or feature, for Account security, due to a genuine concern of impersonation or fraud, or by pursuant to a legal obligation, we will inform the User in advance of the requirement and of the consequences of not completing the verification, and will act in accordance with the legal requirements applicable to the processing.

4.6 We may rely on more than one legal basis to process certain information, depending on the context, the particular feature of the Service used, applicable law, the User's location, and the nature of the information processed.

5. With Whom We Share Information

5.1 With other Users. The User's profile, photos, biography, preferences, published content, trip descriptions, approximate distance, and communications the User chooses to share through social features may be accessible to other Users inaccording with theService settings, permissions, Account characteristics, and relevant feature. Please note thatonce information is disclosed to other Users, we cannot completely prevent them from copying, retaining, photographing, distributing, or otherwise using it.

5.2 With infrastructure and service providers. We may disclose or allow access to personal information to cloud, hosting, database, mailing, content-delivery, real-time messaging infrastructure, analytics, error-monitoring, subscription-management, mapping, secure-login, AI, calendar, identification and verification, security, maintenance, and operational service providers, to the extent necessary to provide, operate, secure, maintain, improve, back up, or enforce the terms of the Service. Such providers will receive access only to the information required to provide the service, and where required by law, their use of the information will be subject to appropriate contractual commitments regarding the purposes of processing, information security, retention, and deletion.

5.3 Our service providers may include, among others, providers of cloud, hosting, and database services; email and communications; notifications and alerts; analytics and error monitoring; information security and identity verification; mapping, location, and navigation; artificial intelligence services; payments and subscription management; platform services and app stores; travel and content partners; and providers of infrastructure, maintenance, support, and other technological services. The identity of the providers and services we use may change from time to time according to business, technological, operational, security, or legal needs. When we send push notifications or other alerts, information required to deliver the notification, including technical identifiers and, where appropriate, its content or preview, may be transferred through notification providers, operating systems, and relevant infrastructure providers. The scope of information displayed or processed also depends on the User's device settings, operating system, permissions, and notification configuration.

5.4 When the User clicks a link to flight, hotel, eSIM, car-rental, or similar services, we may transfer to the partner the search parameters entered, such as origin, destination, dates, and number of passengers, as well as a partner identifier, referral identifier, campaign identifiers, or other technical details required for attribution, measurement, operation of the link, or presentation of the service. In addition, when using certain features, including autocomplete and search services, queries entered by the User may be sent directly from the device to the relevant service provider while the User is typing, in order to display suggestions. After navigating to the partner's website or service, or when using its service, information processing is governed by that partner's policy, terms, and practices, and we are not responsible for such processing.

5.5 With professional advisors, insurers, financiers, investors, potential purchasers, affiliates, and law-enforcement authorities, where required or reasonable to protect our rights, manage the business, investigate disputes, prevent harm, maintain security, conduct due diligence, collect debts, comply with law, or carry out a merger, sale, investment, financing, reorganization, or structural change in the business.

5.6 We do not sell personal information and do not share personal information for cross-context behavioral advertising, as these terms are defined under applicable privacy laws. If this changes, we will notify Users in advance and act in accordance with applicable law.

6. International Transfers

6.1 Personal information may be stored, transferred, processed, or accessible in Israel and outside Israel, including in countries in which our service providers, partners, affiliates, or subcontractors operate. These countries may apply privacy and data-protection laws that differ from those applicable in the User's place of residence. Where required by law, we rely on appropriate lawful transfer mechanisms, such as contractual commitments, standard contractual clauses, adequacy decisions, intra-group agreements, statutory derogations, or another legal mechanism applicable to the relevant transfer.

6.2 Transfer of personal information outside Israel will be carried out in accordance with the legal provisions applicable to the transfer of information outside Israel. Where the law requires the provision of particular conditions or safeguards with respect to a transfer, PlaneMate will take the measures appropriate to the relevant transfer, including, as applicable, obtaining appropriate contractual commitments from the recipient of the information or relying on another mechanism permitted by law. To the extent that privacy laws of another country or region, including European Union laws, apply to particular processing, the transfer mechanisms required by those laws will also be used, to the extent applicable.

6.3 You may contact us to obtain additional information about the safeguards we apply to international transfers, subject to limitations of confidentiality, security, third-party rights, and legal and operational feasibility.

7. Information Retention and Deletion

7.1 We retain personal information only for the period reasonably necessary for the purposes specified in this Policy, compliance with legal requirements, security, backup, documentation, audit, protection of User safety, fraud prevention, dispute management, incident investigation, enforcement of our terms, and protection of our rights. Actual retention periods may also be affected by the type of information, its sensitivity, scope, the nature of its use, and applicable technological and operational requirements.

7.2 Account, profile, trip, content, and chat data are retained for as long as the Account is active, as long as required to operate the Service, or for an additional reasonable period thereafter for backup, restoration, security, documentation, enforcement, investigation of complaints, or compliance with legal requirements, unless the User deletes the information earlier or the law requires otherwise. Certain information items may also be retained after Account deletion in accordance with the periods and purposes set out in Section 7 below.

7.3 Account deletion takes place in two stages. In the first stage, upon a deletion request, we delete or anonymize most personally identifying fields in the Account, mark the Account as deleted, replace the username with an alternative identifier where required to preserve the integrity of shared records, and redact historical texts in relevant locations. In the second stage, within up to 90 days of the deletion request, we delete the remaining content and records that remain subject to deletion, including messages, verification records, and residual records, unless we are required or permitted to retain particular information for a longer period under law, for purposes of investigating fraud, harassment, a safety incident, dispute, claim, enforcement of terms, protection of rights, or a reasonable operational need such as backup, restoration, or documentation.

7.4 Upon deletion of an Account, we may copy limited identifying details of the Account holder to a separate and closed archival record, including full name, email address, date of birth, gender, country, city, region, Instagram username, and Google and Apple login identifiers, to the extent provided or received in connection with use of the Service. The record will generally be retained for up to 90 days from deletion. However, PlaneMate may retain limited information for an additional period to the extent required or permitted by law for purposes of preventing fraud, impersonation, re-opening an Account that was blocked, investigating a safety incident, enforcing the Terms of Service, protecting Users, managing a dispute, or protecting its rights. You may request Account deletion through the application and through a dedicated page without logging in at: https://planemate.app/delete-account. If the User is unable to complete the process, the User may contact us at support@nakama-software.com.

7.5 Location data will be retained for the period reasonably necessary according to the type of information, the feature used, and the purposes for which it was collected, including operation of the Service, safety, fraud prevention, security, incident investigation, and compliance with legal requirements. Information no longer needed for these purposes will be deleted or anonymized, subject to applicable law.

7.6 Information processed as part of the identity-verification process, including photographs, facial or matching data, verification results, verification statuses, audit records, and technical information relating to the process, will be retained for the period reasonably necessary according to the type of information and the purposes for which it was collected or generated, including identity verification, prevention of impersonation and fraud, security of the Account and Service, enforcement of the Terms of Service, handling reports, investigation of disputes, and compliance with legal requirements. Retention periods and the manner of handling information may vary according to the type of verification process, the technology used, and legal requirements. Information no longer needed for these purposes will be deleted or anonymized, subject to obligations or permissions applicable by law.

7.7 Logs, telemetry, security data, moderation data, and audit data are generally retained for up to 24 months, unless a longer period is required or permitted for an investigation, legal proceeding, fraud prevention, law enforcement, compliance with a legal obligation, preservation of evidence, system security, or protection of our rights.

7.8 Purchase, accounting, and tax data will be retained for the period required by applicable law and by the requirements of payment providers or app stores.

7.9 PlaneMate may retain limited documentation relating to consents, permissions, withdrawal of consents or permissions, choices made by the User, and notices or information notices displayed to the User, including the date of the action, the manner in which it was performed, and the relevant version of the notice, policy, or terms displayed. Such information may be retained after Account deletion for the period reasonably necessary to demonstrate compliance with legal requirements, handle complaints and disputes, enforce the Terms of Service, protect the rights of PlaneMate or its Users, and comply with requirements of a competent authority or legal proceeding.

8. Users' Rights

8.1 Subject to applicable law, the User may be entitled to access the personal information we hold about the User, request correction of inaccurate information, request deletion, request restriction of processing, object to certain processing, request data portability in a commonly used format, and withdraw consent wherever consent is the basis for processing. These rights are not absolute and are subject to exceptions, limitations, conditions, and provisions established by applicable law.

8.2 Where privacy laws granting additional rights apply, including rights relating to receiving information about the manner of processing, receiving a copy of information, restricting certain uses, appealing certain decisions, or significant automated decisions, we will act in accordance with applicable law and subject to the limitations and exceptions permitted thereunder.

8.3 Rights may be exercised by contacting support@nakama-software.com. Before handling a request, we may request reasonable information, documents, or additional verification measures to verify the identity and authority of the person making the request, and the scope of the request.

9. Children and Minimum Age

9.1 The Service is intended solely for persons aged 18 and over. We do not permit minors to create an Account, and we may take verification, review, restriction, suspension, or blocking measures in order to enforce this condition.

9.2 If we become aware that personal information of a person under 18 was collected in violation of these requirements, we will act to delete the information, restrict its processing, suspend or block the relevant Account, to the extent possible, reasonable, and appropriate under the circumstances.

10. Information Security

10.1 We implement reasonable and customary technical and organizational measures to protect personal information, including encryption in transit, access controls, secure retention of access tokens, segregation of sensitive information databases, activity logging, rate limitations, input validation, monitoring, backup, and other operational safeguards. However, these measures do not guarantee the absolute prevention of every security incident.

10.2 We do not store passwords in plain text. One-time access codes, authentication tokens, and information relating to identity verification processes are managed using security measures appropriate to, among other things, the type of information, its sensitivity, and the risks involved in its processing. Information relating to verification processes will be retained and deleted in accordance with Section 7 of this Policy.

10.3 Despite our security efforts, no system is entirely secure, and therefore we cannot guarantee absolute protection against intrusion, malfunction, loss, disruption, leakage, destruction, or unauthorized access, use, or disclosure.

11. Service Notices, Notifications, and Mailings

11.1 We may send operational notices, security notices, sginin- codes, service notifications, in-app messages, push notifications, and messages directly related to Account management and use of the Service. Certain notices are considered an integral part of the Service and therefore may not be capable of being disabled for as long as the Account is active or as long as they are required for security, operation, or legal compliance.

11.2 If the User enables a weekly email summary or similar optional mailing, we will use the User's email address to se nd itaccording to the settings selected. The User may unsubscribe at any time through the settings, through an unsubscribe link in the message where available, or through another method made available to the User. However, certain technical processing may continue for a reasonable period after the request.

11.3 Marketing mailings, if implemented, will be sent in accordance with applicable law and subject to consent, authorization, or an opt-out opportunity, as applicable and where required by law.

12. Cookies, SDKs, and Similar Technologies

12.1 The application itself does not use browser cookies, but it may use SDKs, device identifiers, local storage, tokens, advertising identifiers, or similar technologies for analytics, security, error monitoring, login, notifications, and Service functionality, subject to device settings, permissions, and applicable law.

12.2 The website may use cookies, local storage, pixels, or similar technologies for operation, security, measurement, customization, Service improvement, referral attribution, and integration with third-party services. Where the law requires consent for non-essential components, we will request consent accordingly.

12.3 Some permissions, consents, and tracking preferences may be managed through the device settings, browser settings, or website preference center, if available. However, blocking or disabling certain components may affect the availability, proper functioning, or performance of certain Services.

13. Partner Links and Third-Party Services

13.1 The Service may include links, referrals, or buttons that lead to third-party websites, services, and applications, including flight, hotel, car-rental, eSIM, and other travel-service partners. Their inclusion in the Service does not necessarily constitute a recommendation, endorsement, sponsorship, responsibility, or representation on our part with respect to such third parties, nor does it mean that we assume any responsibility for them.

13.2 When the User clicks such a link, certain search details entered by the User, such as origin, destination, dates, or number of passengers, as well as a partner identifier, referral identifier, campaign details, or related technical details, may be transferred to the relevant third party for the purpose of directing the User to the service, attributing the referral, measuring performance, preventing fraud, and operating the booking or service.

13.3 After navigating to a third-party service, use of that service is subject to the privacy policy, cookies, tracking technologies, security practices, and terms of use of that third party. We do not control and bear no responsibility for the policies, content, services, availability, security, or processing of information by such third parties.

13.4 We may receive a commission, payment, credit, revenue share, or other benefit in respect of particular referrals, clicks, uses, or bookings made through such links.

14. Changes to the Privacy Policy

14.1 We may update this Policy from time to time, at our discretion, to reflect changes in the product, processing practices, providers, technology, legal requirements, interpretation thereof, or our business policy.

14.2 In the event of a material change, we will publish an updated version on the website, in the application, or through any other reasonable means, and update the Effective Date at the beginning of this document. Where the law requires notice, affirmative choice, or additional consent, we will act accordingly. Continued use of the Service after the updated Policy enters into force may be deemed acceptance of the updated wording, to the extent permitted by applicable law.

15. Contact

15.1 For any question, request, exercise of a right, privacy report, or other inquiry relating to this Policy, you may contact us at: support@nakama-software.com.

15.2 If you wish to request deletion of your Account without logging in, you may also use the dedicated page at: https://planemate.app/delete-account.