Privacy Policy

How plugwith.me handles personal data — as controller for our own customers, and as processor for the visitors who open our customers' links. Information under Articles 13 and 14 GDPR.

1. Controller and contact

For privacy matters write to info@plugwith.me with "Privacy" in the subject line. We answer within one month (Article 12(3) GDPR).

Data protection officer. We are not required to designate one: we do not meet the thresholds of Article 37(1) GDPR or § 38 BDSG. Requests go to the address above.

Representatives. We are established in the European Union, so no representative under Article 27 GDPR is required.

On the United Kingdom: Article 27 of the UK GDPR requires a UK representative from a controller outside the UK that offers goods or services to data subjects in the UK. We have assessed this and consider that we do not: the Service is offered globally in English only, priced in US dollars, with no UK-specific marketing, domain, currency, language or payment method, and no UK-targeted advertising — the factors the test actually turns on. A UK resident can sign up, but mere accessibility of a website is not an offer directed at a territory. We keep this under review and will appoint and name a UK representative here if we begin targeting the UK or if UK users become a material part of our customer base. If you are in the UK and want to exercise a right, write to the address above — nothing about this assessment reduces your rights or our response times.

2. What the Service does, and the two roles we play

plugwith.me is a multi-tenant SaaS platform. Customers create short URLs of the form plugwith.me/<slug> that either redirect straight to a destination they choose, or show a page of buttons. When such a page is opened inside a social-media app's in-app browser, it can hand the visitor out to the device's real browser or to a native app.

Customers can also place forms, quizzes and embedded players on such a page, and connect their own systems through our API. That produces clearly separated data flows, with different responsibilities:

If you are an end visitor and want to exercise your rights over data collected on a slug page — including an entry you sent through a form there — the controller is the customer who owns that slug. Contact us anyway — we will forward your request to them without undue delay and help them answer it.

3. Categories at a glance

4. Visiting the marketing site

4.1 Server logs

Every request reaches an edge node of our hosting provider, Netlify, which records the IP address, date and time, the URL and HTTP method, the user agent and referrer where sent, the status code and the number of bytes transferred. Purpose: delivering the site, defending against abuse, and enforcing the rate limit of 60 requests per IP per minute. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in operating the Service securely; there is no less intrusive way to serve a web page or to stop an attack. Netlify retains these logs under its own policy, as a rule for no longer than 30 days. We do not copy them into our application database.

4.2 Fonts

The "Inter" typeface (SIL Open Font License 1.1) is served from our own domain as two WOFF2 files under /assets/fonts/. Google Fonts is not embedded anywhere on this site and no font request leaves our domain. (An earlier version of this policy listed Google as a recipient for fonts. That was wrong and has been corrected.)

4.3 No tracking on our own pages

The marketing site, the legal pages, the blog, the free tools and the signup and login pages run no analytics, no advertising tags, no heatmaps, no A/B tooling and no third-party embeds. There is no consent banner on those pages because there is nothing to consent to. The only storage we place is listed in section 6.

4.4 Free tools

The tools under /free-tools/ — the QR code generator, the UTM builder and the URL cleaner — run entirely in your browser. What you type into them is processed on your device and is not sent to us or to anyone else; the QR code is drawn by a library served from our own domain. The only record of your visit is the ordinary server log described in 4.1.

5. Registration, dashboard and support

5.1 Signing up

We collect a display name, an email address and a password. The password is only ever stored as a bcrypt hash by our processor Supabase; we never see it in clear text and cannot recover it. Legal basis: Article 6(1)(b) GDPR. Providing these three items is necessary to conclude the contract — without them we cannot create an account (Article 13(2)(e) GDPR).

At signup we also record that you accepted the Terms, the Acceptable Use Policy and the DPA, and that you confirmed you are 18 or older, together with the timestamp and the version of each document. We need this to demonstrate that the contract was validly concluded and that we meet our age and content obligations. Legal basis: Article 6(1)(c) and (f) GDPR.

5.2 Email confirmation and password reset

Confirmation and password-reset emails are sent by Supabase Auth using its built-in mail delivery. Signing up for an account does not subscribe you to anything: the newsletter is a separate, opt-in mailing described in section 5.6, and having an account neither adds you to it nor is required for it.

5.3 Your link configuration

Slugs, buttons, page blocks (including the questions of your forms and quizzes), uploaded images, geo-block lists, routing rules, UTM and split-test settings, pixel identifiers, model and profile names and all other settings are stored in your tenant row in our Postgres database at Supabase. Legal basis: Article 6(1)(b) GDPR. Kept for the term of the contract; deleted from production within 30 days of termination and from backups within a further 90 days (section 12).

Images you upload go into a publicly readable storage bucket, because they are used as avatars and as Open Graph preview images on public pages. Do not upload anything you are not willing to make public.

5.4 Payments and invoices

When you take a paid plan, Stripe Payments Europe, Ltd. (Ireland) and its affiliates collect your name, billing address, VAT ID where given, and payment-instrument data directly, as their own controller. We never see full card or bank details; Stripe passes us a customer ID, a subscription ID, a status and invoice metadata. Legal basis: Article 6(1)(b) GDPR for performing the contract, and Article 6(1)(c) GDPR for the invoice content required by § 14 UStG.

We mirror the invoice PDFs Stripe issues into a private storage bucket so that we can meet German record-keeping duties (GoBD) and so that you can download them from the dashboard. Those PDFs are kept for 10 years and are outside the scope of an erasure request (Article 17(3)(b) GDPR).

Stripe's own privacy notice: stripe.com/privacy.

5.5 Support

If you email us we process the content of your message, your address and any information you choose to include, to answer you. Legal basis: Article 6(1)(b) GDPR where it concerns the contract, otherwise Article 6(1)(f). Our mailbox is hosted by our email provider; correspondence is kept for three years from the end of the year of the last message.

5.6 The newsletter

The newsletter is optional and entirely separate from having an account. We only ever send it to an address that has confirmed itself by answering a confirmation email — a double opt-in. Until that confirmation arrives we send nothing else to the address, and if it never arrives the record is discarded (section 12).

What we store, and nothing beyond it: the email address; the status of the subscription; the times at which it was requested, confirmed and, if applicable, withdrawn; which wording of the consent you were shown, by version; which page and language the sign-up came from; a one-way hash of the confirmation link's token together with its expiry; and our own record of whether the welcome email was handed to the delivery provider. We do not store your IP address, your browser string, or anything about which messages you opened or which links you clicked.

Legal basis: Article 6(1)(a) GDPR — your consent. We keep the record of that consent, including the version of the wording you agreed to, in order to be able to demonstrate it (Article 7(1) GDPR). You can withdraw at any time (Article 7(3) GDPR), with the unsubscribe link at the bottom of every message or the unsubscribe button your email client offers. Withdrawing is as easy as consenting and costs nothing; it does not affect the lawfulness of what we sent beforehand.

What happens to the record when you withdraw. We do not delete it. We mark the address as withdrawn and keep it on a suppression list, so that it is not written to again and so that we can show, if asked, that a message sent earlier rested on a consent that existed at the time. If you sign up again later it takes a fresh confirmation — an earlier withdrawal is never reversed by following an old link. To have the record itself erased rather than suppressed, write to us (section 10); we will weigh that against our need to evidence the earlier consent and tell you the outcome.

No tracking, and it is structural rather than a promise. Our messages contain no tracking pixel, no open tracking, no click tracking and no remotely loaded image, font or stylesheet. Nothing is fetched when you open one, so there is nothing for us or anyone else to record. The unsubscribe link carries a code derived from your address, not the address itself, so it does not appear in a web address, a referrer header or a server log.

Delivery provider. The messages are sent for us by Resend, Inc. (San Francisco, USA), which receives the recipient address and the message itself and nothing else. The transfer to the USA rests on the EU Standard Contractual Clauses together with Resend's data processing agreement; see the subprocessor list and the transfer assessment in section 7.1. For the newsletter we are the controller in our own right — a subscriber is our own contact, not data a customer has entrusted to us — so this is a processor engaged on our own behalf, not a subprocessor under the customer DPA.

5.7 API keys, webhooks and the MCP endpoint

On plans that include it, you can create API keys, register webhook endpoints and connect an AI assistant of your choice through our MCP endpoint, so that your own systems can read and change your links. Only the account owner can manage keys in the dashboard; a key with the corresponding scope can also manage webhook endpoints.

What we store about a key: the name you give it, its first characters so that you can recognise it, a one-way SHA-256 hash of it, its scopes, which login created it, and when it was created, last used and revoked, together with a short-lived counter for the rate limit. The key itself is shown to you once and is never stored. We keep no log of individual API or MCP requests — no IP address, no user agent and no path is recorded against a key. About a webhook endpoint we store its address, the events you chose, whether it is active, and the secret we sign each message with (it has to be stored, because we need it to sign). For each message we keep a delivery record — a copy of the message, its status, the number of attempts and the HTTP status code your server answered with, never the body of that answer — for 30 days, then it is deleted automatically. Legal basis: Article 6(1)(b) GDPR. Keys and endpoints are deleted with the account; a revoked key stays on record, unusable, until then, so that you can see which keys existed.

What leaves our systems, and to whom. Webhook messages carry your own link data — the configuration of a link when it is created or changed, its slug when it is deleted — and a daily summary of click counts per link. They never carry data about an individual visitor and never carry form entries. They go to the address you entered, which may be anywhere in the world; that recipient is chosen by you, is not our processor, and the transfer to it is made on your instruction (section 2.7 of the DPA). The same applies to an AI assistant you connect through MCP: it receives what it asks for with your key, and its provider is your recipient, not ours. Our servers do not contact any AI provider.

5.8 Cancelling or withdrawing online

“Cancel contracts here” at the bottom of every page leads to plugwith.me/cancel, where you can cancel a contract without logging in (§ 312k BGB). “Withdraw from contract” leads to plugwith.me/withdraw, where a consumer can withdraw from a contract without logging in (§ 356a BGB); during your withdrawal period the same function is also shown in the dashboard under Billing.

What we process: the name, email address and plan you enter; the type of declaration (ordinary or extraordinary cancellation, or withdrawal); for a cancellation, when you want the contract to end and, for an extraordinary cancellation, a reason if you give one; the date and time we received it; a reference number; and what we then did — which subscription we found and changed, and whether the confirmation was sent. We use the email address to find your account and subscription and to send you the confirmation the law requires. We pass the instruction to end or not renew the subscription to Stripe, which holds your subscription as its own controller (section 5.4). Where a person has to act — no account matched, an extraordinary cancellation, a refund after a withdrawal, or an automatic step that failed — the same details go to our own mailbox at info@plugwith.me.

Purpose: carrying out your cancellation or withdrawal and being able to prove that it was received and when. Legal basis: Article 6(1)(b) GDPR (the contract) and Article 6(1)(c) GDPR (§ 312k and § 356a BGB require the confirmation, and the record evidences it); where no contract matches the address you gave, Article 6(1)(f) GDPR — our interest in being able to show what we received and how we answered.

Where it is kept, and for how long. The record is stored with our hosting provider Netlify, separately from our database. It is kept for the term of the contract it concerns plus three years; where no contract matched, for three years from receipt. Both the confirmation to you and the note to our own mailbox are delivered by Resend, Inc., which receives the recipient address and the message and nothing else (see section 7 and the subprocessor list). We do not store your IP address with the declaration. To stop the form being used to send mail to strangers in bulk, we count submissions per connection and hour under a keyed one-way hash of your IP address and the hour, which holds a number and nothing else; reaching the limit never prevents your declaration from being received.

6. Cookies and storage on your device

Full inventory, including what customers' pixels place on visitors' devices, is on the Cookie Policy page. In summary, on our own pages we use only what is strictly necessary within the meaning of § 25(2) no. 2 TDDDG and Article 5(3) of Directive 2002/58/EC, so no consent is required:

Every one of these is first-party. Since version 2.2 no third-party script is loaded into any page of this service — the Supabase client the customer area needs is served from our own domain. There are two things a visitor can choose to load on a customer's page, and nothing loads before that choice: a customer's marketing pixel, after "Accept" (section 9.4), and an embedded YouTube or Spotify player, after a click on it (section 9.8). Such a player runs in a separate frame from its provider, and whatever it stores on the device is set by that provider, not by us. Forms and quizzes store nothing on the device. The pw_consent entry is itself strictly necessary — it exists solely to give effect to the choice you made and to avoid asking again — but it is only ever written once you have made that choice.

7. Recipients and processors

We disclose personal data only to the processors below, each under a contract meeting Article 28(3) GDPR, and to public authorities where we are legally obliged to. We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use it to train machine-learning models. Where a customer sends their own data onwards — to a webhook address, through the API or to an AI assistant connected through MCP — the recipient is the customer's choice and not one of ours (section 5.7).

The authoritative, dated list — which we update before any change takes effect — is at plugwith.me/subprocessors. Customers are notified 30 days before a subprocessor is added or replaced, can subscribe a further address there, and may object under section 11 of the DPA.

7.1 International transfers — including where your account data actually lives

Netlify and Stripe are certified under the EU–US Data Privacy Framework, so transfers to them are covered by the European Commission's adequacy decision of 10 July 2023 and need no further instrument. Netlify's edge network serves EU visitors from EU points of presence, but as a US company with a global network it may also handle requests and run background jobs outside the EU.

Supabase stores the data in Frankfurt. Our contract partner is Supabase Pte. Ltd. in Singapore, a company of the Supabase group to which Supabase, Inc. in the United States also belongs, and the infrastructure is operated by Amazon Web Services. Supabase staff in several countries may access the systems for support, maintenance and incident response. Access to EU-stored data from a third country is itself a transfer under Chapter V GDPR, and Singapore has no adequacy decision, so this access rests on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 3, processor to processor) in Supabase's data processing agreement, supplemented by the UK Addendum and the Swiss annex where those regimes apply. We do not rely on the Data Privacy Framework for Supabase. The clauses are reflected in section 14 of the DPA, which also passes them through to you.

Resend, which delivers our own emails (sections 5.6 and 5.8), is in the United States; that transfer rests on the Standard Contractual Clauses in Resend's data processing agreement.

Our transfer impact assessment, in short

The Court of Justice requires that the SCCs actually deliver essentially equivalent protection in practice. We assessed this and record the result here rather than asserting a conclusion:

• What is exposed, and how. The data is at rest in Frankfurt. What remains is remote access by provider staff for operating the service, and access a foreign authority could compel from a provider. Exposed categories: account data (display name, email, bcrypt password hash), link configuration, uploaded images, click events and form entries. No payment credentials and no government identifiers; special-category data is excluded by contract (section 7.3 of the DPA).
• The click events are the bulk of the data and carry no identifier at all — no IP, no raw user agent, no cookie or device ID, nothing linking two events by the same visitor (section 9.1). An authority compelling that table would obtain records that identify nobody. This is a design decision rather than a contractual promise.
• The residual risk is the identifying layer — a customer's name and email address, and the name, email address, phone number or message a visitor enters in a customer's form. That is real and we do not minimise it. It is the reason forms were released only after the data had moved to the EU.
• Legal exposure. Because the Supabase group includes a US company and the infrastructure is operated by a US company, US law such as the CLOUD Act can in principle require production of data in their possession, custody or control even when it is stored in Frankfurt, and FISA § 702 can apply to a provider that qualifies as an electronic communications service provider. Storage in the EU does not remove that possibility; it means that any such access has to be compelled from the provider rather than taken from a server on US soil, and that the provider would face the conflict with Article 48 GDPR. We are not aware of any request having been made. Under section 14.6 of the DPA we commit to notice of any binding request where notice is lawful, a challenge to any request that appears unlawful or excessive, and disclosure of the minimum permissible.
• Technical measures. Encryption in transit (TLS 1.2+) and at rest (AES-256); passwords stored only as bcrypt hashes and never recoverable; API keys stored only as hashes; row-level security with no public policies, so the data is reachable only through our own server-side functions; the service-role key never leaves the server; no IP address stored with click events or form entries.
• Conclusion. We consider the safeguards adequate for the data actually involved, and the risk materially lower than before the move. We keep this under review; if the storage location changes again, this section changes first, and a move out of the EU would be announced at least 30 days in advance (section 14.7 of the DPA).

You can request a copy of the relevant clauses from us; commercially sensitive commercial terms may be redacted. If you object to a transfer, tell us — for account data we can discuss options, and you can exercise the rights in section 10 at any time.

7.2 Other disclosures

We disclose data to courts, law-enforcement or supervisory authorities where a valid legal obligation requires it, and to our tax adviser and, if it ever becomes necessary, to legal counsel or a debt-collection service — in each case limited to what is needed. In the event of a sale or reorganisation of the business, data may pass to the acquirer; we would inform you in advance and you could terminate (section 16.1 of the Terms).

8. Automated decisions and profiling

We do not carry out automated decision-making producing legal effects or similarly significant effects within the meaning of Article 22(1) GDPR, and we do not build profiles of individuals.

Bot detection, geo-blocking and smart routing evaluate a single request as it happens and either serve a public page, do not serve it, or send the visitor to the destination the customer set for that kind of request — by device, app, country or browser language. A split test picks one of the customer's variants at random for each visit. Nothing is stored about the individual and no profile is built. The "traffic quality" figure in the dashboard is a share calculated from counts — how many visits passed the filters — and says nothing about any person. Abuse detection may flag content automatically, but no account is suspended and no appeal is decided by automated means alone — a person always decides (section 6.4 of the AUP).

Artificial intelligence. plugwith.me contains no AI system. We neither provide nor deploy one within the meaning of Regulation (EU) 2024/1689, we do not use AI to make or prepare decisions about you, and we do not use customer data or visitor data to train any model.

9. When someone opens a customer's link

For everything in this section we act as processor on behalf of the customer who owns the slug. That customer is the controller. The DPA governs it and applies to every plan, including the free plan.

9.1 Click statistics

One event row is written per page open and per button click, containing:

• the slug that was opened;
• a timestamp;
• a coarse device class — ios, android, desktop or other — derived from the user agent;
• a coarse browser class — for example safari, chrome, or instagram for a visit from the Instagram in-app browser;
• an ISO country code, which Netlify derives from the IP address at the edge;
• flags recording whether bot protection or the geo-block filtered the request, and why;
• for a button click, the button's label and destination URL;
• for a visit served under one of the customer's routing rules or split tests, the number of that rule or variant;
• for a completed quiz, which quiz and which of its results was reached — never the answers given.

No IP address, no raw user agent, no cookie identifier, no device fingerprint and no account identifier is stored on these rows, and nothing links two events by the same visitor. We consider the result anonymous within the meaning of recital 26 GDPR. We say so having applied the reasonable-means test, and we are aware that a supervisory authority might take a different view of a rare combination such as a single visit from a very small country; the design is deliberately kept coarse so that this stays theoretical. Legal basis, in so far as personal data is involved at all: Article 6(1)(f) GDPR — the customer's legitimate interest in knowing whether their links work, with a very low impact on the visitor. Raw events are kept for 90 days; the aggregates derived from them are anonymous and are kept indefinitely.

9.2 Bot protection, geo-block and smart routing

The user agent and the country code derived from the IP address are evaluated in the request itself, to reject automated traffic or to redirect visitors from countries the customer has excluded. Where the customer has set routing rules, the same request data — device class, app, country, and the first language in the browser's language preference — decides which of the customer's destinations the visitor is sent to; a page answered under such a rule is not cached, so one visitor's variant is never served to the next. Nothing persistent is created and the language is not stored. Where the customer has switched on UTM tagging, the campaign parameters the customer chose are added to the outgoing link; they are the same for every visitor and identify the campaign, not the person. Legal basis: Article 6(1)(f) GDPR.

9.3 The in-app browser escape

The hand-off from an in-app browser to the system browser is executed entirely on the device by a script that attempts a sequence of URL schemes. It sends no data to us or to anyone else. It reads nothing from the device beyond the user agent string already present in the request.

9.4 A customer's own marketing pixels

A customer can add their own Meta (Facebook), Google Analytics, TikTok or Snap pixel to a page. Where one is configured, the third party receives the visitor's IP address, browser identifiers, the URL and page-view events, and may set or read its own cookies for its own purposes.

Who is responsible. The controller for the processing carried out by these third parties is the customer who enabled the pixel — in some configurations jointly with the pixel provider. It is not plugwith.me: we neither determine the purposes nor receive the data. Our customers are contractually required to have a valid legal basis for it (section 7.3 of the Terms). To exercise your rights against a pixel provider, use their own channels: Meta, Google, TikTok, Snap.

9.5 What we do not do

We set no cookie of our own on slug pages, run no advertising network, operate no cross-site identifier, and do not combine data from different customers' links. We do not read, use, analyse or pass on the entries visitors send through customers' forms for any purpose of our own.

9.6 Forms on a customer's page

A customer can place a form on their page — for example to collect sign-ups, enquiries or answers. What the form asks for, why, and what happens with your entry afterwards is decided by that customer, who is the controller. We store the entry for them, show it to them and to the members of their team who may edit their links, let them export it as a spreadsheet file and delete it, all on their instruction. We do not send it by email, do not pass it to anyone else, and do not use it for statistics or for anything of our own.

What is stored with an entry: the values you enter in the fields the customer set up — depending on the form a name, an email address, a phone number, a short or longer text, a choice from a list or a ticked box — with the labels of those fields; the page and form it was sent from; the time it was sent; where a quiz on the same page leads into the form, the title of the result you reached; and the date on which it will be deleted.

The consent box. Where a form contains a field that can identify you, it shows an unticked box with the customer's own wording and a link to the customer's own privacy notice, and cannot be sent until you tick it. We store that wording and that link with your entry, together with the time of sending, so that the customer can show what you were told and agreed to (Article 7(1) GDPR). The wording is the customer's, and so is the decision whether consent or another legal basis applies to what they do with your entry.

What is not stored: your IP address, your user agent, any cookie or any device identifier. To stop automated mass submissions, the form carries a hidden field that people do not fill in and a minimum filling time; our edge server counts submissions per connection for up to ten minutes in memory; and with the entry we store a keyed hash of your IP address and the calendar day, computed with a secret key only we hold, so that it changes every day and cannot be turned back into the address without that key. A daily job removes that hash once it is two days old, so it exists for at most three days. It is pseudonymised personal data, used only for this protection. Legal basis for that protection: Article 6(1)(f) GDPR together with Article 32 GDPR, applied on behalf of the customer.

How long. The entry is deleted automatically when the period the customer chose for that form runs out — 30, 90, 180 or 365 days, 90 unless the customer chose otherwise — earlier if the customer deletes it, and in any event when the customer's account is deleted. Removing the form or the page does not delete entries already received; they remain available to the customer until their period ends. Entries are stored in the EU (section 7.1) and are not part of our own daily backup export; the database provider's backups expire on their normal rotation (section 12).

Your rights. Contact the customer — their privacy notice is linked next to the consent box. If you contact us instead, we pass your request to them without undue delay (section 2).

9.7 Quizzes

A quiz on a customer's page runs entirely in your browser. Your answers are not sent to us or to anyone else. When you finish, the page reports which quiz was completed and which of its results was reached, without your answers and without any identifier, in the same way as a button click (9.1).

9.8 Embedded video and music players

A customer can embed a YouTube video or a Spotify player on their page. Nothing is loaded from YouTube or Spotify until you click the player. Before that, the page shows only a placeholder from our own server — no image, script or other request goes to either provider. The placeholder says which provider the player connects you to and that it may set cookies, and links to this section and to the same content on the provider's own site. Your click is the choice to load it; it is not remembered, so the player stays unloaded on your next visit until you click again.

Once you click, your browser connects directly to Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for YouTube, through its privacy-enhanced domain youtube-nocookie.com, or to Spotify AB (Regeringsgatan 19, 111 53 Stockholm, Sweden) for Spotify. The provider then receives your IP address, information about your browser and device, and — as the referrer — our domain name, and may store or read information on your device, such as cookies or local storage, under its own policy. It may transfer data outside the EU on its own account. Nothing of this passes through our servers and we receive nothing back.

Who is responsible. The customer who chose to embed the player decides whether it appears, and is responsible for it — for the transmission to the provider possibly jointly with that provider. The provider is responsible for its own processing after that. We are not a processor for it: we supply the placeholder that keeps the player unloaded until you choose. Legal basis: your consent, given by the click (Article 6(1)(a) GDPR and § 25(1) TDDDG). The providers' notices: Google, Spotify.

10. Your rights

You have the right, free of charge, to:

• access your data and the details of its processing (Article 15 GDPR);
• rectify inaccurate data and complete incomplete data (Article 16);
• erase your data (Article 17), unless a retention duty applies — see section 12;
• restrict processing (Article 18);
• receive the data you gave us in a structured, commonly used, machine-readable format and have it transmitted to another controller (Article 20). The dashboard offers a self-service export;
• object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) (Article 21). Where we cannot show compelling legitimate grounds that override your interests, we stop;
• withdraw consent at any time with effect for the future, without affecting the lawfulness of processing before withdrawal (Article 7(3));
• complain to a supervisory authority (Article 77).

Write to info@plugwith.me. We may ask for information to confirm your identity — only where we have genuine doubts, and only as much as is needed. We answer within one month, extendable by two months for complex requests, in which case we tell you why.

Complaining to a supervisory authority. You may lodge a complaint with a data protection supervisory authority — in particular the authority of the member state where you live, where you work, or where you believe the infringement took place (Article 77(1) GDPR). Any of them will take your complaint and forward it to the competent authority if it is not itself competent, so you do not have to work out which one that is. If you would rather write to the authority responsible for us, ask us at info@plugwith.me and we will name it and pass on its contact details.

11. Additional rights in other jurisdictions

11.1 United Kingdom

Where UK GDPR applies, the rights in section 10 apply equivalently and you may complain to the Information Commissioner's Office (ico.org.uk). Transfers into the UK are covered by the UK adequacy regulations; transfers out are covered by the International Data Transfer Addendum to the EU SCCs.

11.2 Switzerland

Where the Swiss FADP applies, references to the GDPR are read as references to the corresponding FADP provisions and the supervisory authority is the FDPIC (edoeb.admin.ch).

11.3 United States — notice at collection and state rights

This section is the notice at collection required by § 1798.100(a) CCPA and serves the equivalent notices under the comprehensive privacy laws of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware and the other states that have adopted them.

Categories collected, why, and for how long

Sources: you, directly; your browser and device, automatically; and Stripe, for payment status. We disclose these categories only to the service providers in section 7, and only for the business purposes named there.

No sale, no sharing, no targeted advertising

We have not sold personal information, and have not shared it for cross-context behavioural advertising, in the preceding 12 months — and we do not intend to. This includes the personal information of minors, whom we do not knowingly serve at all. We do not process personal information for targeted advertising, and we do not use or disclose sensitive personal information for any purpose that would trigger a right to limit. Because there is no sale or sharing, there is no "Do Not Sell or Share My Personal Information" link to provide.

Your rights

• Know and access — what we collect, use and disclose, and a copy in a portable format.
• Correct inaccurate personal information.
• Delete, subject to the statutory retention duties in section 12.
• Opt out of sale, sharing, targeted advertising and profiling — nothing to opt out of, but the request will be honoured and confirmed.
• Non-discrimination. We will not deny you the Service, charge you a different price, give you a lower quality of service, or penalise you in any way for exercising a privacy right. We operate no financial-incentive or loyalty programme.

How to exercise them

Email info@plugwith.me with "Privacy request" in the subject. We confirm receipt within 10 business days and respond substantively within 45 days, extendable once by a further 45 days where reasonably necessary, in which case we tell you why before the first period ends.

Verification. We verify a request by matching it against the email address on the account. For a deletion or a copy of your data we may ask you to confirm from that address or, where the account is inactive, to confirm two additional data points we already hold. We ask for the minimum needed and never for a copy of an identity document.

Authorised agents. An agent may act for you if they provide written permission signed by you, and we may still contact you to confirm it and to verify your own identity. An agent acting under a valid power of attorney does not need the separate confirmation.

Appeal. If we refuse a request, we tell you why and how to appeal. To appeal, reply to our refusal with "Appeal" in the subject within 60 days. A person reviews it and we answer in writing within 45 days, explaining the reasons. If the appeal is denied, you may contact your state Attorney General — the address is given in our decision. This appeal process is offered to residents of every state, not only those whose law requires one.

Opt-out preference signals and Do Not Track

We honour the Global Privacy Control signal. On a customer link page carrying a marketing pixel, a GPC signal is treated as a refusal and the pixel is never loaded — no banner is shown, because you have already answered. On our own pages there is nothing a signal would need to switch off. There is no industry consensus on the older "Do Not Track" header, so we do not respond to it separately; GPC covers the same ground.

California Shine the Light

California Civil Code § 1798.83 lets California residents ask, once a year and free of charge, for a list of the personal information disclosed to third parties for those parties' own direct marketing. We make no such disclosures. Requests may still be sent to info@plugwith.me and we will confirm this in writing.

Who is responsible for a customer's pixel

Where a customer's marketing pixel is involved, the business under US state law is that customer, not us. We act as their service provider and process the data only on their documented instructions, on the terms in section 13 of the DPA.

11.4 Brazil, Canada and elsewhere

Where the LGPD, PIPEDA or a comparable law applies, we honour the equivalent rights on the same terms and through the same contact address.

12. How long we keep things

Deleting your account in the dashboard starts this schedule immediately. Data that must be retained is blocked from all other use.

13. Security

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR). In particular:

• TLS 1.2 or higher enforced on every connection, with HSTS including subdomains and preload;
• a Content Security Policy that enumerates every permitted script and connection host, plus X-Frame-Options: DENY, X-Content-Type-Options: nosniff and a restrictive Permissions-Policy;
• passwords stored only as bcrypt hashes, by Supabase Auth; API keys stored only as SHA-256 hashes and shown once; every webhook message signed (HMAC-SHA-256) and sent only to public HTTPS addresses;
• rate limiting of 60 requests per IP per minute at the edge;
• tenant isolation enforced in every query by tenant_id, on tables with row-level security enabled and no public policies — all access runs through server-side edge functions;
• the invoice bucket is private with no public read and time-limited signed URLs;
• uploads restricted to JPEG, PNG and WebP up to 2 MB;
• form entries accepted only from the page that served the form, capped in size, stripped of markup and checked against the form as stored, with a hidden honeypot field, a minimum filling time and limits per connection, per page and per account;
• production access limited to authorised persons with multi-factor authentication;
• secrets held only in the hosting provider's encrypted environment store, never in the repository.

The full list is Annex II to the DPA. Our security overview and responsible-disclosure policy are at plugwith.me/security.

Breaches. If a personal data breach occurs we notify the competent supervisory authority within 72 hours where the breach is likely to result in a risk to individuals (Article 33), and we inform affected individuals without undue delay where the risk is high (Article 34). Where we act as processor, we notify the customer without undue delay so that they can meet their own deadline.

14. Children

The Service is for adults. You must be 18 or older to hold an account (section 4.1 of the Terms), and we do not knowingly collect data from anyone under 18. Customers must not use forms to collect data from children (section 7.9 of the DPA). If you believe a minor has given us data, tell us at info@plugwith.me and we will delete it and close the account.

15. Changes to this policy

We update this policy when the processing changes, and publish the update no later than the change itself, so that the text never describes something other than what happens. The version and effective date at the top always identify the applicable text. Where a change materially affects how we process your own data as an account holder, we notify you by email and in the dashboard; where it adds a new purpose for, or a new kind of recipient of, data you have already given us, we do so at least 30 days in advance. Previous versions are available on request.

Hinweis für deutschsprachige Nutzerinnen und Nutzer

Diese Datenschutzerklärung ist in englischer Sprache verfasst, weil der Dienst ausschließlich auf Englisch angeboten wird. Sie enthält sämtliche Pflichtangaben nach Art. 13 und 14 DSGVO. Verantwortlicher ist Eray Yilmaz, Europaring 90, 53757 Sankt Augustin. Eine Beschwerde können Sie bei jeder Datenschutz-Aufsichtsbehörde einreichen, insbesondere bei der Ihres Wohnorts, Arbeitsplatzes oder des Orts des mutmaßlichen Verstoßes (Art. 77 Abs. 1 DSGVO); ist sie nicht zuständig, leitet sie Ihre Beschwerde weiter. Ihre Rechte auf Auskunft, Berichtigung, Löschung, Einschränkung, Datenübertragbarkeit, Widerspruch und Widerruf einer Einwilligung sowie das Beschwerderecht ergeben sich aus Art. 15 bis 21 und Art. 77 DSGVO und sind in Abschnitt 10 beschrieben. Auf Anfrage an info@plugwith.me stellen wir Ihnen eine deutschsprachige Zusammenfassung dieser Erklärung zur Verfügung.