Privacy Policy

1. Scope and non-goals

In scope

• A complete GDPR-compliant Privacy Policy for publication at brandpilot.ai/privacy before launch
• Coverage of all 14 sections required by BRAA-111
• Sub-processor disclosure with a public list and the purpose of each processor
• All 6 GDPR data-subject rights with practical instructions for how to use them

Out of scope

• A separate Cookie Policy document. Section 13 is the operative cookie description for the service, covering strictly necessary cookies, the cookie-consent banner, and the optional analytics cookie. We do not maintain a separate Cookie Policy.
• A separate DPA (Data Processing Agreement) for Team / Agency tiers. That is an Enterprise feature and is not required for the MVP.
• Expanded children's privacy clauses beyond the minimum age statement. We do not target users under 16 and do not knowingly process children's data.
• California-specific CCPA / VCDPA clauses. These will be added when US go-to-market requires them.

2. Data inventory

2.1 Account data (identity)

Storage: PostgreSQL users table (Supabase, EU regions for EU users where available).

2.2 Brand content data

Visibility: all brand content is protected by strict per-user RLS (Row-Level Security in PostgreSQL). Other users cannot read your brand data.

2.3 Usage telemetry

What we do not store in telemetry: plaintext LLM inputs and outputs. prompt_runs.error_message may include short fragments in failure cases. Those records are anonymized on deletion.

2.4 Billing data

What we do not collect: we do not store card numbers or CVV in our own databases. New billing will be processed by Paddle as Merchant of Record; Stripe continues to process legacy subscriptions during migration. We store only the provider references and limited payment-method details the relevant provider returns to us.

2.5 Cookies and tracking

• Strictly necessary cookies: authentication session, CSRF/security, the short-lived subscription-access cache, and your saved cookie-consent choice. There is no opt-out because the product cannot function without them.
• Optional analytics — off until you opt in: with your consent, PostHog receives pseudonymous product and website events. PostHog is not initialised and no analytics event is sent before you make a choice. Withdrawing consent stops collection and clears PostHog browser storage where possible.
• Marketing cookies: not used. We do not use advertising or cross-site behavioural cookies.

See Section 13 for the full cookie description, storage duration, and how to change your choice.

2.6 Consent preferences and audit logs

• user_email_preferences stores the current on/off state and consent evidence separately for optional product-nurture emails and the editorial newsletter. Both optional purposes default to off.
• email_preference_events and consent_log record subscribe/unsubscribe or signup-consent evidence, including purpose, copy version, source, timestamp, and limited request metadata such as IP address and user agent.
• gdpr_audit_log (append-only, 7-year retention) records GDPR actions such as export requested, export delivered, deletion requested, deletion completed, and anonymization completed. It does not contain your content. It stores user ID, action type, timestamp, and actor (user / system / DPO).

3. Legal basis for processing (Art. 6 GDPR)

Each data category is processed under one of four legal bases.

Withdrawal of consent: where processing is based on consent (Art. 6(1)(a)), you may independently switch off product-nurture emails and the editorial newsletter at any time without explanation (Settings -> Email Preferences or the unsubscribe link in the relevant email). Withdrawal does not affect the lawfulness of earlier processing. Service, security, billing, and legal notices are transactional and are not controlled by either optional marketing preference.

Objection to legitimate interest: where processing is based on legitimate interest (Art. 6(1)(f)), you have the Right to object under Art. 21. See Section 5.5.

4. Sub-processors

We use the following sub-processors to provide the service. Each processor is bound by a DPA and, where applicable, Standard Contractual Clauses (SCCs) for transfers outside the EEA.

Anthropic specifically: we use the Anthropic API under their commercial terms, which state:

• prompts and completions are not used to train Anthropic models,
• prompts may be retained for abuse monitoring for a limited period only,
• access to raw prompts is restricted to authorized security personnel for incident response.

What we do not do: we do not sell your data, use it to train third-party models, or share it with advertisers or data brokers.

Sub-processor changes: if we change or add a sub-processor, we will publish a policy update and send 30 days' notice before the effective date. See Section 13.

5. Your rights under GDPR

You have the following rights. Requests can be submitted through Settings -> Privacy & Data or by emailing hello@plumie.ai with the subject GDPR Request: [right]. We respond within 30 calendar days and may extend to 90 days for complex requests where the law permits.

5.1 Right of access (Art. 15)

You may request a copy of your data and information about how we process it.

How: Settings -> Export My Data. The export covers all categories listed in Section 2.

5.2 Right to data portability (Art. 20)

You may obtain your data in a machine-readable format for transfer to another service.

Self-serve endpoint: POST /api/account/export (via Settings -> Export Data). Authenticated only. Rate limit: 1 request per hour.

Export format (ZIP with machine-readable structure):

brandpilot-export-{your-id}-{timestamp}.zip
├── account.json           - your profile (email, name, preferences)
├── billing.json           - subscription and payments (without raw provider payloads)
├── brand-{brand_id}/
│   ├── brand.json         - brand definition + voice + goals + strategy + pillars
│   ├── topics.csv         - all topics
│   ├── posts.csv          - all posts + versions
│   ├── publish-events.csv - publication history
│   ├── crm.csv            - CRM contacts
│   ├── sources.csv        - sources + search configs
│   └── uploads/           - original files (logos, brand assets, voice training)
├── voice-archive/         - past-post archive (if present)
└── README.md              - structure description + GDPR notice

Delivery: a signed download URL is sent to your email and remains valid for 7 days.

Additional safeguard: before automatic deletion of an archived account, we generate an export and send the download link even if you did not request one, unless you already used self-serve export recently.

5.3 Right to rectification (Art. 16)

You may correct inaccurate or incomplete data.

How:

• Email, name, preferences -> Settings -> Account
• Brand content (brands, posts, voice, etc.) -> editable directly in the product
• Billing data -> Settings -> Billing -> the portal for the provider that owns your subscription
• If you cannot find the right surface -> hello@plumie.ai

5.4 Right to erasure (Art. 17 - "Right to be forgotten")

You may request deletion of your account and related data.

Self-serve flow:

1. Request: Settings -> Delete Account -> confirm with your email
2. Grace period: 30 days. During that period, you can cancel deletion by logging in or contacting hello@plumie.ai.
3. Confirmation email: sent immediately after the request, with a "Cancel deletion" link and an auto-export ZIP.
4. Day +30: physical deletion begins.

What is permanently deleted (hard delete):

• All brand content: brands, posts, voice profiles, topics, sources, CRM entries, reports, uploaded files
• Storage uploads: voice archive files, logos, brand assets
• Personal identifiers: email, name, auth identifiers, Telegram chat ID
• Pending email-notification queue items for your account

What is anonymized and retained for 7 years:

• Payment and subscription records (without email or payment method, only financial fields needed for tax / audit compliance)
• Usage telemetry (cost data, action counts) without PII in payloads
• GDPR audit log entries documenting the deletion request and completion
• Billing-provider webhook events retained under operational and financial-audit requirements

Why we anonymize instead of fully deleting some records:

• Georgia tax law requires long-term retention of financial records
• Billing-provider chargeback, refund, and dispute windows require audit history
• GDPR Art. 6(1)(c) allows retention where there is a legal obligation

What is retained for 12 months after deletion for anti-abuse purposes:

• A hash of your email and phone number (if provided) in deleted_users_blocklist to prevent trial abuse
• These hashes are physically removed after 12 months

Automatic deletion for unfinished trials:

For the target usage-pricing cohort, the 7-day trial starts when you launch your first authorized AI-assisted workflow rather than when you create the account. Legacy cohorts retain the trial duration and signup-based start recorded when they joined. In every cohort, the lifecycle below is calculated from the persisted trial end date:

• At trial end: the account becomes read-only
• 30 days after trial end: the account is archived (export remains available through hello@plumie.ai)
• 113 days after trial end: we send a final notice that the deletion-grace window starts in 7 days and attach an automatic export link
• 120 days after trial end: a 7-day grace period begins. Logging in reactivates the account if allowed by the current plan state.
• 127 days after trial end: physical deletion begins under the same policy as self-serve deletion

DPO-routed erasure: if you want the request handled directly as a legal escalation, email hello@plumie.ai.

5.5 Right to restriction (Art. 18) and objection (Art. 21)

Restriction: you may request a temporary freeze on processing (for example, during a dispute) by emailing hello@plumie.ai. We will switch the account to read-only where possible.

Objection: if the legal basis is legitimate interest (see Section 3), you have the right to object. We will stop that processing unless we have compelling legitimate grounds that override your interests, rights, and freedoms. For example, we may not be able to stop logging prompt-injection attempts while an active security investigation is ongoing.

5.6 Right to lodge a complaint (Art. 77)

If you are unhappy with our response to a GDPR request, you may complain to the supervisory authority in your country (for EU residents, the national DPA such as CNIL in France or BfDI in Germany). We recommend contacting us first because most issues can be resolved faster without escalation.

6. Right to erasure - full text

Deletion of your data. You may request deletion of your account at any time through Settings -> Delete Account. After your request:

• For 30 days (the grace period), you may cancel it by logging in or emailing hello@plumie.ai.
• After the grace period, we permanently delete your content (brands, posts, voice, strategies, sources, CRM, uploaded files), personal information (email, name), and authentication identifiers.
• We anonymize, but retain for 7 years where required by tax law or audit obligations, payment records, subscription records, AI-usage records, and audit logs. These records no longer contain your name or email after anonymization.
• Billing-provider payment events may remain in raw form for 7 years to satisfy financial audit obligations.

Automatic deletion for unfinished trials: for the target usage-pricing cohort, the 7-day trial starts when you launch your first authorized AI-assisted workflow, not when you create the account. Legacy cohorts retain their recorded signup-based trial. If you do not activate a subscription, the account becomes read-only at its persisted trial end, is archived 30 days later, receives a final-deletion notice and automatic export link 113 days after trial end, enters a 7-day grace period 120 days after trial end, and is deleted under the same policy as self-serve deletion 127 days after trial end.

Right to portability (GDPR Art. 20): at any time, you can use Settings -> Export Data to download a ZIP containing your data in JSON, CSV, and original-file formats.

7. Data retention summary

After the 7-year retention window: anonymized billing records are physically deleted by a final purge job.

8. International data transfers

Because some of our sub-processors are located outside the EEA / UK (including Anthropic, Paddle and Stripe, and in some cases Supabase), we transfer data internationally.

For EU / UK residents, transfers are covered by:

• Standard Contractual Clauses (SCCs) for EU -> US transfers
• UK IDTA where applicable for UK -> US transfers
• Data Processing Agreements with each relevant sub-processor

See Section 4 for the full list of sub-processors and transfer mechanisms.

Adequacy preferences: where available, we prefer EU regions (for example, Supabase EU regions or EU-region email options). Anthropic and the billing providers may still process data in the United States or other disclosed locations.

Optional analytics: consented PostHog analytics data is processed in PostHog's EU Cloud, so it generally stays within the EEA. The PostHog corporate entity (PostHog Inc.) is US-based, so we rely on the PostHog DPA and SCCs where applicable. Because analytics is off until you opt in, no analytics data is transferred unless you consent.

Transfer Impact Assessment: we maintain a transfer-risk assessment for US transfers. Anthropic's no-training posture and provider encryption controls materially reduce risk, but they do not eliminate it.

If you are an EU resident and believe these transfers are unacceptable, contact hello@plumie.ai. In practice, opting out of these transfers may make the service unusable because core LLM functionality depends on Anthropic.

9. Security

We protect your data with the following measures:

• Row-Level Security (RLS): PostgreSQL policies prevent other users from reading your data through the API
• Encryption at rest: Supabase default encryption for PostgreSQL data and Storage buckets
• Encryption in transit: TLS for all HTTP traffic
• Authentication: OAuth (Google, GitHub) or email magic link. We do not store plaintext passwords.
• Prompt-injection protection: filtering and trust-boundary controls before LLM calls; detected attempts are logged in injection_attempts
• Access control: least-privilege internal access; production-database access is restricted and audited
• Backups: automated encrypted backups with limited retention and deletion coverage in the GDPR erasure pipeline

If a breach occurs: we will notify affected users within 72 hours of discovery where GDPR requires it. Notification may include email, in-app notices, and public disclosure for significant incidents.

10. Children's privacy

Minimum age to use BrandPilot: 16 years old.

We do not target users under 16 and do not knowingly collect children's data. Signup requires an age-related acknowledgment.

If you are a parent or guardian and discover that your child registered without appropriate consent, email hello@plumie.ai and we will remove the account promptly.

11. Changes to this policy

We may update this policy to reflect changes in:

• sub-processors,
• the data categories we collect for new features,
• legal or regulatory requirements in applicable jurisdictions.

Notification mechanism:

• Material changes such as new data categories, new sub-processors, retention changes, or new transfer mechanisms will trigger 30 days' notice by email and an in-app banner before the effective date.
• Consent-gated additions that introduce a strictly optional, off-by-default processing activity (for example, opt-in analytics that collects nothing until you agree) may take effect immediately, because the new processing cannot occur without your separate, freely given consent. We still update the version, date, and changelog, and the cookie banner asks for your choice.
• Non-material changes such as clarifications, typo fixes, or structural edits without substantive policy change may be published without advance notice, with the version and date updated in the footer.

Version history: the full history is available at /privacy/changelog.

12. Contact information

12.1 Controller

The controller of the personal data described in this policy is:

Ilia Nemchenko — Individual Entrepreneur registered in Georgia, operating the Plumie service.
Identification number: 304759189 (for a Georgian Individual Entrepreneur this also serves as the tax/registration number)
Registration date: 29 January 2025
Registering authority: LEPL National Agency of Public Registry (Georgia)
Legal address: Nino and Ilia Nakashidze Street N 1 (former Avlevi), Building No. 3, Apartment N 3, Krtsanisi district, Tbilisi, Georgia
Email: hello@plumie.ai

12.2 Data protection contact

We have not appointed a formal DPO for the MVP, but we maintain a dedicated GDPR contact point.

Email: hello@plumie.ai
Subject prefix: GDPR Request: [Access | Erasure | Portability | Rectification | Restriction | Objection]

Response SLA:

• Acknowledgement: 5 business days
• Resolution: 30 calendar days (extendable to 90 days for complex requests where legally permitted)

12.3 EU representative

[To be appointed when required for EU customer operations under Art. 27.]

13. Cookies and tracking

Strictly necessary cookies are always active because the service cannot function without them. They cover the authentication session, CSRF/security protection, the short-lived subscription-access cache, and your saved cookie-consent choice.

Optional analytics — off until you opt in. With your consent, PostHog receives pseudonymous product and website events so we can understand feature use and improve Plumie. Plumie does not initialise PostHog or send any analytics event before you make a choice. When enabled, PostHog uses browser storage named after our project token (ph_<project-token>_posthog) to keep a pseudonymous identifier and session state for up to 180 days, unless you withdraw consent or clear browser data. We do not use advertising, marketing, or cross-site behavioural cookies.

Your choices. On your first visit you can Accept all, Reject non-essential, or Manage preferences. Rejecting analytics does not affect core service access. You can revisit Cookie settings in the footer or Settings → Privacy & Data at any time. Withdrawing analytics consent stops future collection and clears Plumie's PostHog browser storage where possible.

Browser controls: you can still block cookies in your browser settings, but blocking strictly necessary cookies may log you out or break the product.

14. Dispute resolution

We prefer to resolve issues directly through hello@plumie.ai. If direct resolution is not possible:

1. GDPR-related disputes: your local data protection authority (see Section 5.6)
2. General disputes: governing law is Georgia (Georgia IE entity), and jurisdiction is the courts of Tbilisi, Georgia, except where mandatory local consumer-protection law overrides this rule

Appendix A - Glossary

• Anonymization - irreversible removal of identifying fields while preserving aggregated or financial fields where legally required
• Controller - the entity that determines the purposes and means of processing (Ilia Nemchenko, Individual Entrepreneur, operating Plumie)
• DPA - Data Processing Agreement
• DPO - Data Protection Officer
• EEA - European Economic Area
• GDPR - General Data Protection Regulation (EU 2016/679)
• PII - Personally Identifiable Information
• Processor - an entity that processes data on behalf of the controller (our sub-processors)
• RLS - Row-Level Security
• SCC - Standard Contractual Clauses
• TIA - Transfer Impact Assessment