Privacy Policy

1. Who we are

Platoya operates an AI-governance and compliance software-as-a-service platform. For questions about this policy or your data, contact us at PlatoyaOfficial@gmail.com.

2. Data we collect

Account data. When you register, we collect your name, email address, and authentication details. Authentication is handled by our identity provider (Clerk).

Organization and usage data. We collect the information you and your team enter into the Service — including assessment responses, policy documents, tasks, and configuration — as well as technical usage data such as log-in times and feature usage.

Billing data. Payments are processed by our reseller and Merchant of Record, Paddle.com. Paddle collects and processes the payment information needed to complete your purchase (such as card details and billing address). We do not store your full payment-card details on our systems; we receive limited information from Paddle such as your plan, subscription status, and country for tax purposes.

Third-party AI provider keys (BYOK). If you connect your own AI provider key, we store it encrypted at rest and use it only to perform the AI actions you request.

Technical data. We collect standard technical information such as IP address, browser type, and device information, and we use cookies and similar technologies necessary to operate the Service and keep you signed in.

3. How we use your data

We use personal data to: provide and operate the Service; authenticate you and secure your account; process subscriptions and provide billing support (together with Paddle); respond to your requests; improve and develop the Service; and comply with legal obligations. We rely on the legal bases of contract performance, legitimate interests, consent (where required), and legal obligation.

4. How we share your data

We share personal data only as needed to run the Service, with:

• Paddle — our Merchant of Record, for payment processing, billing, and tax compliance.
• Clerk — for authentication and account management.
• Supabase — for secure database hosting of your account and organization data.
• Vercel — for application hosting and delivery.
• AI providers you connect — only when you use a BYOK feature, and only to fulfil your request.

We do not sell your personal data. We may disclose data if required by law or to protect our rights, users, or the public.

5. International transfers

Our providers may process data in countries other than yours. Where personal data is transferred internationally, we rely on appropriate safeguards as required by applicable law.

6. Data retention

We retain personal data for as long as your account is active and as needed to provide the Service, then for any additional period required to meet legal, tax, or accounting obligations. You can request deletion of your account data as described below.

7. Your rights

Depending on your location, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact PlatoyaOfficial@gmail.com. For billing-data requests, you may also need to contact Paddle as the Merchant of Record. You may have the right to lodge a complaint with your local data-protection authority.

8. Security

We use industry-standard measures to protect personal data, including encryption in transit, encryption at rest for sensitive values such as connected provider keys, and access controls at the database level. No method of transmission or storage is completely secure, but we work to protect your data and to promptly address any issues.

9. Children

The Service is not directed to individuals under 18, and we do not knowingly collect data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by reasonable means, and the "Last updated" date above will change accordingly.

11. Contact

For any privacy question or request, contact us at PlatoyaOfficial@gmail.com.