Privacy Policy

1. Data we collect

• Account data: name, email address, optional phone number, password hash, sign-up date, plan and role.
• Content data: prompts, conversations, uploaded files, generated images and video, agent runs, memories and workspace items.
• Usage data: feature usage, credit consumption, request counts, device and browser type, approximate location derived from IP, timestamps and error logs.
• Billing data: plan, invoices, payment status and contract records. Full card numbers are handled by our payment processor and never stored by us.
• Support data: messages you send us and their attachments.

2. Why we use it

• To provide and personalise the Services, including assistant memory and recommendations.
• To bill accurately and enforce plan limits and quotas.
• To secure the platform: abuse detection, fraud prevention, rate-limiting and audit logging.
• To debug, monitor reliability and improve product quality.
• To communicate service notices, security alerts and, with consent where required, product updates.
• To comply with legal obligations and enforce our Terms.

3. Legal bases (EEA/UK)

We rely on contract performance (delivering the Services), legitimate interests (security, abuse prevention, product improvement), consent (optional cookies and marketing), and legal obligation (tax, accounting, lawful requests).

4. Model training

We do not sell your data. We do not use your private conversations, uploads or generated content to train foundation models for third parties. Aggregated, de-identified statistics may be used to improve routing, safety and product quality. Where a feature requires sharing a prompt with an inference provider to produce your answer, that transfer is limited to what is needed to serve the request.

5. Sharing and processors

We share data with vetted processors that host our infrastructure, deliver email, process payments, run inference, and provide error monitoring, each under contractual confidentiality and security obligations. See the Subprocessors page for the current list.

We may disclose data when legally required, to protect rights and safety, or as part of a merger or acquisition (with notice).

6. International transfers

Data may be processed in countries other than yours. Where required we use appropriate safeguards such as Standard Contractual Clauses and additional technical measures including encryption in transit and at rest.

7. Retention

• Account and billing records: for the life of the account and up to 7 years afterwards where tax or accounting law requires.
• Conversations, files and generated media: until you delete them, or up to 30 days after account deletion in backups.
• Security and audit logs: typically 12 months.
• Temporary (incognito) sessions: not persisted to your history.

8. Your rights

Depending on where you live, you may request access, correction, deletion, portability, restriction, or objection, and you may withdraw consent at any time. Most actions are self-service in Settings; otherwise write to privacy@plexaai.app and we will respond within 30 days. You may also lodge a complaint with your local supervisory authority.

California residents: we do not sell or share personal information as defined by the CCPA/CPRA, and we will not discriminate against you for exercising your rights.

9. Children

The Services are not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact privacy@plexaai.app and we will delete it.

10. Security

We use encryption in transit and at rest, row-level access controls, least-privilege service roles, audit logging and regular dependency scanning. No system is perfectly secure; report vulnerabilities to security@plexaai.app.

11. Changes and contact

We will post updates here and, for material changes, notify you in-product or by email. Contact: privacy@plexaai.app.