Privacy Policy

Customer teams: your name, work email, and role; the documents your organization uploads and the text extracted from them; the register, revisions, comments, and attachments your team creates; and an append-only audit trail of who changed what, when.

External reviewers: if a customer sends you a transmittal, we hold your name, email address, and — for each action you take on a review link — timestamp, IP address, and browser user agent. Construction disputes turn on who approved what and when; this record is the evidence, we say so openly, and it is retained with the audit trail.

Usage and billing metadata: pages processed, job costs, plan state. Card details go to Stripe directly and never touch our systems.

We use this data to run the product, bill for it, secure it, and support you. That is the list.

We do not sell data, share it for advertising, or run third-party analytics or tracking scripts — the application sets exactly two kinds of cookie, both essential: your sign-in session and which organization you have open. We do not train AI models on your content, and we restrict production AI providers to ones whose terms exclude training on it, enforced by a startup check in the processing worker rather than by policy. The security page describes this in the same words a vendor questionnaire would ask for.

While your account is active: as long as you keep it. When you delete a document, project, or organization: gone from every path immediately, hard-purged after a 14-day undo window, and out of backups within 30 days as they age out.

What survives deletion, disclosed rather than discovered: append-only audit records — including the name labels of deleted accounts, so the history of organizations you worked with stays readable — and the business records billing law requires.

A single US region, with provider-managed encryption keys. Data-region choice and customer-managed keys are enterprise work we have not built; the security page tracks both honestly.

You can read, correct, and export your data from the app — each project’s register exports to Excel — and organization owners control invitations, roles, and deletion for their workspace. For anything the app cannot yet do itself (a full account-data export, correction of audit metadata, deletion questions), contact us and we will do it manually during the retention windows above.

Where Plinta processes documents on behalf of a customer organization, that organization controls the data and we act on its instructions — requests about a workspace’s contents go to its owner, and we route misdirected ones there.

Material changes are emailed to account owners before they take effect. The vendor table above changes only with notice: adding a processor that would see customer data is exactly the kind of change notice exists for.