Privacy Policy

Plot ("we", "us") builds websites for small businesses. This policy explains what personal data we collect, why, how we look after it, and the rights you have under the EU General Data Protection Regulation (GDPR). We are based in Copenhagen, Denmark, and act as the data controller for the data described below.

What we collect

• Account data — your name, email address, and a securely hashed password (we never store passwords in plain text).
• Site content — the text, images, menus, and settings you add to the sites you build with Plot.
• Contact submissions — messages sent to your published sites' contact forms, and messages you send us.
• Billing data — when paid plans go live, payment is handled by a third-party payment processor; we store only the plan and status, not your card details.
• Technical data — basic request information needed to operate and secure the service (e.g. IP address, browser type).

Why we use it

• To create and run your account and the sites you build (performance of a contract).
• To respond to your messages and provide support (legitimate interest).
• To process payments and manage subscriptions when paid plans are active (performance of a contract).
• To keep the service secure and prevent abuse (legitimate interest).

Business contact details from public listings

If we emailed you about your business and you never gave us your details, this section explains where they came from and what you can do about it.

• What we hold — your business name, its address and opening hours, the public email address and phone number published for it, its website or booking-page address, and the town it operates in. Where the business is run under a personal name, that name is personal data, which is why this policy applies.
• Where we got it — public business listings, principally Google Maps, and the business's own publicly available website or booking page. We do not buy contact lists and we do not collect details that a business has not published itself.
• Why we use it — to contact the business once, by email, about whether a website from Plot would be useful to it. We rely on legitimate interest (GDPR Article 6(1)(f)): direct marketing to a business at its published business address, weighed against the limited intrusion of a single email thread you can stop at any time.
• How long we keep it — up to 12 months from collection, or until you ask us to stop, whichever comes first. If you ask us to stop, we keep your email address on a suppression list so that we do not contact you again by mistake. That is the only reason we keep it.

You can object at any time, and we will act on it. Reply "stop" to any email we send you, or write to hello@getplot.ai, and we will stop emailing you. You do not have to give a reason. You have the same rights over this data as over any other data in this policy — including the right to see what we hold, have it corrected or erased, and complain to the Danish Data Protection Agency (Datatilsynet).

Who processes your data

We use a small number of trusted processors to run Plot:

• Cloudflare — hosting, database, file storage, and content delivery.
• Google (via Cloudflare AI Gateway) and Cloudflare Workers AI — to power the AI text and image generation features. Content you choose to generate with AI is sent to these providers to produce the result.

These providers process data on our instructions. Where data is transferred outside the EU/EEA, it is covered by appropriate safeguards such as the EU Standard Contractual Clauses.

How long we keep it

We keep your account and site data for as long as your account is active. If you delete your account, we delete the associated personal data within a reasonable period, except where we must retain certain records to meet legal obligations.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased ("right to be forgotten").
• Receive your data in a portable format.
• Object to or restrict certain processing.
• Lodge a complaint with the Danish Data Protection Agency (Datatilsynet).

To exercise any of these rights, email us at hello@getplot.ai.

Cookies

Plot uses a single essential cookie to keep you signed in. We don't use advertising or third-party tracking cookies. See our Cookie Policy for details.

Changes

We may update this policy as Plot grows. We'll change the "last updated" date above when we do, and for significant changes we'll let you know directly.

Contact

Questions about your data? Email hello@getplot.ai.