Privacy Policy — Plurall

    Your privacy matters to us. This policy explains what data we collect, why, and how you can control it. We will never sell your data or use it to train AI models.
  

1. Who We Are

Plurall ("we", "us", "our") operates the platform available at plurall.pro. For any privacy-related request, contact us at contact@plurall.pro.

2. Data We Collect

Category	Examples	Purpose
Account data	Email address, display name	Authentication & account management
Usage data	Features used, session timestamps	Service improvement
Payment data	Billing info, subscription status	Payment processing (via Stripe)
User content	Questions, debate prompts	Providing the core Service
Technical data	IP address, browser type, cookies	Security & performance

3. Data Storage & Infrastructure

Your data is stored securely on Supabase, whose servers are located in the European Union (EU West — Paris region). Supabase is GDPR-compliant and certified under the EU Data Protection Framework.

Data is encrypted in transit (TLS 1.3) and at rest (AES-256).
Access is restricted to authorized Plurall team members only.
We apply strict row-level security (RLS) controls at the database level.

4. Payment Processing

All payments are processed by Stripe, Inc., a PCI-DSS Level 1 certified payment provider. We never store full card details on our servers. Stripe's privacy policy: stripe.com/privacy.

5. How We Use Your Data

To provide, operate, and improve the Service.
To send transactional emails (account confirmation, billing receipts).
To detect and prevent fraud or abuse.
To comply with legal obligations.

✕ We never use your content or personal data to train AI / ML models.
✕ We never sell your data to third parties.
✕ We never use your data for advertising purposes.

6. Cookies

We use strictly necessary cookies for authentication (session tokens). We do not use third-party tracking or advertising cookies. You can clear cookies at any time through your browser settings.

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

Right of access — request a copy of the data we hold about you.
Right to rectification — request correction of inaccurate data.
Right to erasure — request deletion of your account and all associated data.
Right to portability — request your data in a structured, machine-readable format.
Right to object — object to certain types of processing.
Right to restriction — request that we limit processing of your data.

To exercise any of these rights, email contact@plurall.pro. We respond within 30 days. Account deletion requests are processed within 72 hours.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, all personal data is permanently erased within 30 days, except where we are required by law to retain certain records (e.g., billing history for tax purposes — retained for 7 years).

9. Third-Party Services

Service	Purpose	Privacy Policy
Supabase	Database & authentication	supabase.com/privacy
Stripe	Payment processing	stripe.com/privacy
Vercel	Frontend hosting	vercel.com/legal/privacy-policy
Railway	Backend hosting	railway.app/legal/privacy

10. Data Transfers

Your data is processed within the European Union. If any transfer outside the EU is necessary, it will be governed by Standard Contractual Clauses (SCCs) approved by the European Commission.

11. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a prominent notice on the Service at least 14 days before the change takes effect.

13. Contact & Supervisory Authority

For privacy inquiries: contact@plurall.pro

You also have the right to lodge a complaint with your national data protection authority. In France, this is the CNIL (cnil.fr).