Privacy policy for buyers of partner plugins

This policy is for you if you bought a plugin from one of our partner brands and use the account, licences, installer, downloads, updates or support we provide for it.

1. Who we are

PLUGINMAKER.AI sp. z o.o., os. Piastowskie 94/26, 61-162 Poznań, Poland (KRS 0001238740, NIP 7822969104). We run The Plugin Studio and pluginmaker.ai.

The brand sells you the plugin. We provide your account, licences, the installer, downloads, updates and technical support. For this we are an independent controller of your personal data: we decide how it is used, as described here. The brand is a separate controller for the sale and for the data it sees about you (section 5), under its own privacy notice.

Contact: privacy@pluginmaker.ai.

2. What data we use and where it comes from

• From the brand’s store, or from the brand directly: your email address, your order number and the plugins you bought.
• From you: your email address, your password (we store only a secure hash of it), your name if you give it, your support messages and any screenshots you attach, and the device details (operating system, installer and plugin versions) our support chat adds to your first message, which you can remove.
• From your computer, through the installer and the plugins: an identifier of your computer (we store only a one-way hash of it), the operating system and its version, the installer and plugin versions, your IP address and browser or device type, and a record of your sign-ins and licence activations.
• Only if you agree: crash reports and diagnostic data from the installer and the plugins, and installer usage data.

You need to give us your email address to get an account and a licence. Without it we can’t provide the plugin’s licence.

3. Why we use it, and on what legal basis

• Your account and what you bought: the account, licences and computer activations, downloads, updates, sign-in codes and support. Basis: providing the account, licences and service you signed up for (GDPR Art. 6(1)(b)).
• Security and abuse prevention: sign-in and activation records, limits on repeated attempts, checks that a free trial is used only once per account and computer, preventing licence fraud and piracy, and handling legal claims. Basis: our legitimate interest in protecting our service, our partners’ plugins and our users (Art. 6(1)(f)).
• Running and improving our service with AI agents (section 4): answering support, finding and fixing errors, and running our operations. Basis: our legitimate interest in providing and improving our service efficiently with a small team (Art. 6(1)(f)).
• Crash reports, diagnostics, installer usage data and analytics cookies. Basis: your consent (Art. 6(1)(a)). You can withdraw it at any time in the installer’s settings, or by clearing our site’s cookies and site data in your browser. This doesn’t affect what happened before.

4. AI agents

We do much of our work with AI agents: Claude from Anthropic, and ChatGPT and Codex from OpenAI. Some of these models run on Microsoft Azure. They work inside our systems and can access the data we hold about you.

We use them to answer support, find and fix problems, and run and improve our service.

Anthropic Ireland, Limited and OpenAI Ireland Limited receive this data, and it then goes to the United States (sections 5 and 6). When an OpenAI model runs on Microsoft Azure, Microsoft Ireland Operations Limited receives the data instead and may process it in the EU or in other countries where Azure runs, including the United States. You can object to this use of your data (section 8).

5. Who receives your data

• The brand you bought from. In its dashboard it sees your email address, when you signed up and last signed in, any failed sign-in attempts, your computers and licence activations (with IP address and device type), your purchases and trials, and your support conversations. It can sign you out and remove a computer from your licence. The brand uses this data as a separate controller.
• Our service providers, who handle data for us: OVHcloud (servers, EU), Neon (database, EU), Microsoft Azure (copies and backups of our database, EU), Cloudflare (file storage and downloads), Vercel (our web pages and sign-in), Amazon Web Services (licence signing), Resend (account emails), Sentry (error and crash reports), Google Workspace (support email), Attio (our contact list), Slack and Linear (our support team’s tools), and Plausible and PostHog (website statistics).
• OpenAI, Anthropic and Microsoft Azure (AI agents and tools, section 4). The data goes to OpenAI Ireland Limited, Anthropic Ireland, Limited and Microsoft Ireland Operations Limited, which receive it under their own terms and privacy policies (OpenAI’s, Anthropic’s and Microsoft’s). OpenAI and Anthropic then move it to the United States; Microsoft may process it in the EU or in other countries where Azure runs, including the United States.
• Courts and authorities, when the law requires it.

We don’t sell your personal data.

6. Transfers outside the European Economic Area

OpenAI, Anthropic and Microsoft can take the data outside the European Economic Area. OpenAI and Anthropic receive it in Ireland and move it to the United States. Microsoft may process it in the EU or in other countries where Azure runs, including the United States. They do so under their own safeguards, described in their privacy policies (section 5). Some of our other service providers are US companies and may process data in the United States. The copies and backups of our database that we keep on Microsoft Azure are stored in the EU.

7. How long we keep it

• Account, licences, computers and purchases: as long as your account exists. When you ask us to delete your account, we delete them.
• Copies and backups of our database on Microsoft Azure: deleted after about 8 weeks.
• Records of free trials: as long as the brand sells its plugins with us, so a trial can’t be started twice.
• Sign-in and licence-activation records (with IP address and device type): as long as your account exists.
• Sign-in codes: valid for 15 minutes, kept as long as your account exists.
• Installer sign-ins: end after 90 days without use, or after one year at most, and are deleted 30 days after they end.
• Support chats in the installer and their screenshots: 12 months after the last message, or sooner if you ask.
• Support emails: as long as we need them to help you, or until you ask us to delete them.
• Our servers’ request logs: deleted automatically after a short time.
• Crash reports and diagnostics you agreed to: installer diagnostic logs 30 days, crash reports up to 90 days.

8. Your rights

You can ask us for access to your data, a copy of it in a common format, its correction or deletion, or a restriction of its use. Where we rely on your consent, you can withdraw it at any time. Write to privacy@pluginmaker.ai. We reply within one month.

Your right to object

You can object at any time to our use of your data based on our legitimate interests, including our use of AI agents (section 4). Write to privacy@pluginmaker.ai or say so in a support message. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data for legal claims.

Complaints

You can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or to the data protection authority in the EU country where you live or work. If you live in the United Kingdom, you can also complain to the UK’s Information Commission (ICO, ico.org.uk).

9. Age and changes

Accounts are for people aged 16 or older. When we change this policy, we update the date at the top.