Privacy Policy

Plinth is operated by Sumit Verma, an individual based in India, who is the data fiduciary (data controller) for the personal data described here. This policy explains what we collect, why, who we share it with, and the choices and rights you have. It applies to plinthpages.me and the Plinth app. It is written with India's Digital Personal Data Protection Act, 2023 in mind, and we extend equivalent rights to users elsewhere.

• Account details: your name and email address. If you sign up with email, your password is handled by our authentication provider (Supabase) and is never stored by Plinth.
• GitHub sign-in: your GitHub user ID, username, display name and avatar, and public profile information and public repositories we use to personalise your first site.
• Your site and choices: the role and look you choose, the content and code of your site, and the history of changes.
• Plinth AI activity: the messages you send and receive, the changes made, and usage figures such as the AI tokens used.
• Integration secrets: API keys you add for integrations. They are encrypted with AES-256-GCM and are only ever delivered to your own site's server-side environment.
• Billing: your plan, when it ends, and a record of each payment — its amount, its status and the payment provider's own order and payment references. Card, UPI and bank details are collected and held by the payment provider, not by us.
• Consent and requests: which version of our Terms and this policy you accepted and when, and any privacy or legal requests you send us.
• Technical data: IP addresses and request details in our service logs, used for security and troubleshooting.

Visitors to published sites: if a site uses the Visitor Counter, we keep only a running total of visits. Visitor IP addresses are used briefly in memory to avoid double counting and are never stored.

Your site's code and content live in a public GitHub repository and your published site is public. Anything you put on your site, including its change history, can be seen by anyone and may be copied, forked, indexed or archived by others. Please do not add information to your site that you want to keep private. Integration secrets are never placed there.

• to create and run your account, build, preview and publish your site, and provide Plinth AI and integrations you ask for;
• to process payments and manage your plan and usage limits;
• to send you essential account emails, such as confirming your email address;
• to keep the Service secure, prevent abuse, and debug problems;
• to understand aggregate usage and improve the Service;
• to meet legal obligations and respond to lawful requests.

We process your data on the basis of the consent you give when you accept this policy, and where the law allows, for the legitimate purposes of providing the Service you asked for and complying with the law. We do not sell your personal data, and we do not use it for targeted advertising.

We use trusted service providers that process data on our behalf, only as needed to run the Service:

When you use Plinth AI, your prompt and the relevant parts of your site are sent to the AI provider that serves the model you selected. Please avoid including sensitive personal data in prompts. We may also disclose data where required by law, to protect our rights or users' safety, or as part of a transfer of the Service.

Our providers operate globally, so your data may be stored and processed outside India, including in Japan, the United States and other countries. We transfer data only as permitted by applicable law and rely on our providers' security and contractual commitments.

We keep your data while your account is active. When you ask us to delete your account, we delete your personal data, site repository and deployments within 30 days, except where we must keep some information to meet legal, tax or security obligations. Content that was public may still exist in copies made by others. Service logs are kept for a limited period for security and then deleted.

Depending on where you live, you have the right to:

• access the personal data we hold about you and get information about how it is used;
• correct or update inaccurate or incomplete data;
• have your data erased;
• withdraw your consent at any time (this does not affect processing already carried out, and we may need to close your account if the Service cannot work without it);
• nominate another person to exercise your rights if you die or become incapacitated;
• raise a grievance with us, and, if you are not satisfied, complain to the Data Protection Board of India or your local data protection authority.

To use any of these rights, send a request through our privacy request form. We may need to verify that the request comes from you. We respond within 30 days, or sooner where the law requires.

Plinth is for people aged 13 and over. Users under 18 may use it only with the verifiable consent of a parent or legal guardian, who accepts these terms on their behalf. We do not track or profile children for advertising, and we do not knowingly collect data from children under 13. A parent or guardian who believes we hold a child's data without proper consent can ask us to delete it through the request form.

We use encryption in transit, encrypt integration secrets at rest with AES-256-GCM, run site previews in isolated environments, restrict access to production systems, and keep secrets out of public repositories and published sites. No system is perfectly secure. If a personal data breach affects you, we will notify you and the relevant authorities as the law requires.

We only use cookies that are essential to the Service: a session cookie that keeps you signed in, and short-lived cookies that protect sign-in with GitHub. We do not use advertising or cross-site tracking cookies.

Our Grievance Officer is Sumit Verma. For questions, requests or complaints about your personal data, use our privacy request form.

We may update this policy. When we make material changes we will update the date above and ask you to review and accept the new version before you continue using the Service.