Privacy Policy
Last updated July 12, 2026
whatplan.ai is operated by Moreno Software Solutions LLC, a Wyoming limited liability company ("we", "us", "our"), which is the data controller responsible for your personal data. We turn any topic into a structured course you can finish. This policy explains what personal data we collect when you use the service at https://whatplan.ai, why we collect it, who we share it with, and the choices you have. We are currently in open beta.
If you have questions about this policy or want to exercise any of your rights, email us at hello@trymss.com.
Information we collect
Account information. We use Clerk to handle sign-up and sign-in. When you create an account, Clerk stores your name, email address, profile image, and the authentication identifiers needed to keep you signed in. We never see or store your password.
Content you create. When you use the app we store the topics you enter, the courses and lessons generated for you, your quiz results, your bookmarks, your progress and streaks, and the questions you ask the in-app AI tutor. This is the data that makes your account useful to you.
Usage analytics. We use Vercel Analytics, which is privacy-friendly: it does not use cookies and does not track you across other websites. Beyond page views, we record product events — for example which type of page you viewed, lesson progress, quiz attempts, and details about AI generations (such as the model used, difficulty, status, and how long they took). We use this in aggregate to understand and improve the product; it is not used to build an advertising profile of you.
Technical data. Like any website, our hosting provider processes basic technical information (such as IP address and browser type) to serve requests and keep the service secure.
How we use your data
- To provide the service: authenticate you, generate your courses and lessons, power the AI tutor, and save your progress.
- To keep the service safe, secure, and reliable — including rate-limiting abuse and reviewing the topics, questions, and AI outputs involved in the AI features to detect misuse and keep the Service compliant.
- To analyze operational costs and capacity, such as the tokens and models used to generate content.
- To understand, in aggregate, how the product is used so we can improve it.
- To communicate with you about your account or important service changes.
We do not sell your personal data, and we do not use it for third-party advertising.
Lawful bases for processing (EU/UK)
If you are in the EU or UK, we rely on the following lawful bases under the GDPR:
- Performance of a contract — to create and administer your account, generate your courses and lessons, run the AI tutor, and save your progress. Providing this data is necessary to use the Service; without it we cannot provide these features.
- Legitimate interests — to keep the Service safe, secure, and reliable, prevent and investigate abuse (which may involve reviewing content submitted to the AI features), manage and analyze operational costs, and understand in aggregate how the product is used so we can improve it. You may object to processing based on legitimate interests (see "Your rights").
- Legal obligation — to keep records or make disclosures where the law requires it.
- Consent — only where a specific feature relies on it; you may withdraw consent at any time without affecting processing already carried out.
We do not carry out automated decision-making that produces legal or similarly significant effects about you. Generating course content is not a decision about you.
AI processing
Generating a course, a lesson, a quiz, or a tutor answer requires sending content to third-party AI model providers. Depending on the feature, this includes the topic and level you choose, the structure of your course (chapter and lesson titles and summaries), and — for the AI tutor — your questions along with the content of the lesson you are on and your recent conversation. We reach these providers through the Vercel AI Gateway; the underlying models are operated by OpenAI and Google. We route these requests with zero data retention enabled: the providers use your input only to generate the response, and do not retain it afterward or use it to train their models. Separately, we store the content you create — such as your courses and tutor conversations — in our own database so the app works and so we can keep it safe, as described above. Please do not enter sensitive personal information into topic or tutor fields.
Who we share data with
We share data only with the service providers ("sub-processors") that run the product on our behalf:
| Provider | Purpose | Data involved |
|---|---|---|
| Clerk | Authentication & identity | Name, email, profile image, auth identifiers |
| Neon | Database (hosting your content) | Your courses, lessons, chats, bookmarks, progress |
| Vercel | Hosting, AI Gateway & cookieless analytics | Technical data, product-usage events, AI request routing |
| OpenAI, Google | AI model providers (via the AI Gateway) | Topics, course structure, and tutor questions with lesson context |
Each provider is contractually bound to protect your data. We may also disclose data if required by law, or to protect the rights, safety, and security of our users and the service.
Cookies
We use only essential cookies:
- Authentication — the session cookies Clerk sets to keep you signed in.
- Preferences — a cookie that remembers whether you left the app's sidebar open or collapsed.
We do not use advertising or cross-site tracking cookies, and our analytics is cookie-free. Because our cookies are limited to these essential functions, we believe a cookie-consent banner is not required; if we ever add non-essential cookies, we will ask for your consent first where the law requires it.
Data retention and deletion
We keep your data for as long as your account exists. You can delete your account at any time from your account settings. When you do, we remove the data you own — your courses, lessons, tutor conversations, bookmarks, and related records — from our database. Some data may persist briefly in backups before being overwritten in the normal course of operation.
Your rights
Depending on where you live (for example under the EU/UK GDPR or similar laws), you have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to certain processing.
You can delete your account and its data yourself, at any time, from your account settings. To exercise any other right — access, correction, export, restriction, or objection — email us at hello@trymss.com and we will respond as the law requires. You also have the right to complain to your local data protection authority.
International transfers
Our providers (Clerk, Neon, Vercel, and the AI model providers) may process and store data on servers located in the United States and other countries. Where data is transferred internationally, it is done under the safeguards those providers put in place.
Children
The service is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has provided us with personal data, contact us and we will delete it.
Security
We rely on reputable providers and industry-standard measures to protect your data. No method of transmission or storage is ever completely secure, so we cannot guarantee absolute security.
Changes to this policy
We may update this policy as the product evolves. When we make material changes — especially any that expand how we use your personal data — we will update the "Last updated" date above and give you advance notice by a reasonable means (such as email or an in-app notice) before the change takes effect.
Contact
Questions or requests: hello@trymss.com. This inbox serves more than one product, so please keep the "whatplan.ai" subject prefix — the email link above adds it for you.