Data Processing Agreement

1. Parties and roles

This agreement is between you, the customer using Plutos (the controller), and Joseph Karaosman, in Rhodes, Greece, who runs Plutos (Plutos, the processor). Plutos is being registered as a business; its registered name, address and VAT number will be shown here once it is.

You decide whose data is processed and why: who to search for, who to contact, what to say and what to keep. Plutos processes that data only to run the service for you.

If you use Plutos for your own clients and act as their processor, Plutos is your sub-processor, and this agreement applies in the same way. You make sure your agreements with your clients allow this.

Data protection law means the GDPR and any other data protection law that applies to the processing, such as the UK GDPR. Words such as personal data, processing, controller, processor, data subject and personal data breach have the meaning the GDPR gives them.

2. Subject matter and duration

Plutos processes personal data to provide the Plutos service under the Terms of Service: finding and grading leads, writing and sending the messages you approve, receiving and answering replies, and the features around them.

This agreement lasts as long as Plutos processes personal data for you: while you have an account, and until your workspace data is deleted 30 days after your plan or trial ends (section 14).

3. Nature and purpose of the processing

Plutos, on your instructions:

• collects public business and creator data from the sources you choose (Google Maps, business websites, the Meta Ad Library, and public Instagram and TikTok profiles) through its data collection provider;
• stores the results, removes duplicates, checks location, grades leads and finds the contact details they publish;
• writes and checks message versions and suggested answers with AI;
• sends the messages you approve through your own connected accounts and through the desktop app on your computer;
• receives replies and messages to your connected accounts, sorts them, and answers them where you switched on Customer support;
• applies opt-outs, your Never contact list and erasure requests;
• exports data when you ask, and deletes it.

The purpose is to help you find and reach potential customers or partners, and to manage the conversations that follow.

4. Personal data and the people it is about

The people concerned (data subjects):

• owners, managers and staff of businesses whose contact details are published by or for their business;
• creators and influencers with public profiles;
• people who send messages to your connected accounts;
• people you add yourself, to your leads or to your Never contact list.

The types of personal data:

• names, business names and roles, business addresses and area;
• published phone numbers, email addresses, websites and social handles;
• public profile information: bio, follower counts, engagement, public information about recent posts, ratings and review counts, and active ads;
• grades and the reasons for them;
• messages sent and received, call outcomes, notes and meeting times;
• opt-out and erasure records, kept as one-way codes.

Plutos is not built to process special categories of personal data (such as health, religion, sex life or political views) or data about criminal convictions, and you must not instruct it to. Messages people send you may still contain such data; Plutos handles it like the rest of the message.

5. Your instructions

Plutos processes personal data only on your documented instructions. Your instructions are the Terms of Service, this agreement, and what you do in the app: the searches you approve, the leads you keep, the messages and batches you approve, your settings and your Customer support instructions.

You also instruct Plutos to act on any opt-out or objection it receives about a person in your workspace, by blocking further outreach to that person from your workspace.

If the law requires Plutos to process the data in another way, Plutos tells you first, unless the law forbids that. If Plutos believes an instruction breaks data protection law, it tells you and may refuse to carry it out.

6. Your responsibilities

You confirm that:

• you have a lawful basis for the processing you instruct, including for contacting each person on each channel;
• you give people the information Article 13 or 14 of the GDPR requires, normally at the latest in your first message, and you honor their rights;
• your instructions comply with data protection law, the rules on electronic marketing and the terms of the platforms you use;
• you keep the accounts you connect, and the computer that runs the desktop app, secure. Data the desktop app keeps on your computer is under your control.

You are responsible for any data you export from Plutos.

7. Confidentiality and staff access

Plutos makes sure that everyone it allows to process your personal data is bound by confidentiality, and gives access only to those who need it to run the service.

Plutos staff do not open your workspace's data unless your workspace owner turns on support access in Settings, which lasts 24 hours and is logged, or where a security incident, abuse or the law requires it.

8. Security measures

Plutos keeps the technical and organizational measures Article 32 of the GDPR requires, including:

• Workspace isolation: every workspace table in the database enforces row-level security, so a request reads only its own workspace, and a missing check fails closed instead of exposing data.
• Encryption: data is encrypted in transit and at rest. Keys, access codes and mailbox passwords are also encrypted with AES-256-GCM under a separate data key for each workspace, wrapped by a master key kept outside the database, and are never shown again in full.
• No platform passwords: Instagram and TikTok logins happen on your computer, in a separate browser profile. Plutos never sees or stores those passwords, and the login sessions stay on your computer.
• Access control: sign-in by emailed code, passkey or Google, with no Plutos passwords; sessions end after 7 days unused and at most 30 days after sign-in; roles for each member; and a recent sign-in for sensitive actions, such as saving keys, approving batches, exporting, erasing a person, changing roles, pairing the desktop app and cancelling.
• The desktop app: paired with a one-time code, every request signed with its own key, no rules or limits stored on the computer, and it can be stopped from our side at any time.
• Minimal sharing: search inputs sent to our data collection provider hold only search terms and filters, never your identity. Usage records hold no message text or lead data. Logs hold no message text, keys or passwords, and mask email addresses and phone numbers.
• AI safety: text written by others is treated as information, never as instructions. The AI cannot send, approve, export or read keys. Customer support answers only from your approved facts, and a test suite of attacks must pass before it ships.
• Erasure: Erase this person deletes a person's data across your workspace and keeps only one-way codes so they are not contacted again. An automated test checks that no trace of an erased person is left behind.
• Exports: only the workspace owner, after a recent sign-in, can export. The file can be downloaded only while signed in, and it is deleted after 24 hours.
• Audit: an append-only log of actions in your workspace, which the owner can read.
• Abuse limits: rate limits, caps on paid calls and a pause switch protect the service from misuse.

Plutos may update these measures over time, as long as the overall level of security does not go down.

9. Sub-processors

You give Plutos general authorization to use the sub-processors below. Each is bound by data protection terms that give at least the protection of this agreement, and Plutos remains responsible to you for them.

• Supabase: database hosting for all workspace data. Data stored in Frankfurt, Germany (EU).
• Vercel: hosting and running the app. A United States company; processing may take place in the United States.
• Anthropic: AI processing (Claude) for message versions, reply sorting, creator checks, suggested answers and Customer support. United States.
• Apify: collection of public data from the sources you choose, while searches run on Plutos's own Apify account. A company in the Czech Republic (EU); processing may take place in the United States.

Plutos also uses Stripe for billing and Resend for its own emails to you. They do not receive the personal data this agreement covers.

Plutos tells you at least 30 days before it adds or replaces a sub-processor, by email to your workspace owner and on this page. If you object on reasonable data protection grounds within that time, we look for a solution together. If we cannot find one, you may cancel, and we refund the unused part of any period you paid for in advance. If a sub-processor must be replaced urgently to keep the service secure or running, we may do it sooner and tell you as soon as we can.

Your own providers are not Plutos's sub-processors: Meta, TikTok, Google, Microsoft, your email provider, and your own Apify account if your searches run on it. Plutos sends and receives data through them on your instructions, under your own agreements with them.

10. Help with people's requests

Plutos gives you tools to answer requests from the people whose data you hold: viewing and correcting a lead, export on paid plans, Erase this person, the Never contact list, and automatic blocking after an opt-out reply.

If a person contacts Plutos directly about data in your workspace, Plutos passes the request to you without undue delay and does not answer it itself, unless you ask it to or the law requires it. Where the tools are not enough, Plutos helps you as far as is reasonable.

11. Personal data breaches

If Plutos becomes aware of a personal data breach affecting your data, it tells you without undue delay, and aims to do so within 48 hours. It tells you what happened, what data and roughly how many people are likely affected, the likely consequences, what it has done and what it suggests, and who to contact. If not everything is known at once, Plutos sends what it knows and adds the rest as it learns it.

Plutos takes reasonable steps to contain the breach and limit harm, and helps you meet your own duties to notify the authority (within 72 hours under the GDPR) and, where needed, the people affected. Telling you about a breach is not an admission of fault.

12. Other help

Taking into account the nature of the processing and the information available to it, Plutos helps you with data protection impact assessments and prior consultations with authorities, where these concern Plutos. For help that goes beyond what the service and this page provide, Plutos may charge a reasonable cost, and tells you before.

13. Transfers outside the EU

Your workspace data is stored in the EU. Some sub-processors are in, or may process data in, the United States. For each such transfer, Plutos relies on the EU-US Data Privacy Framework where the sub-processor is certified under it, and otherwise on the EU Standard Contractual Clauses (Commission Decision 2021/914), module three, between Plutos and that sub-processor.

If you are outside the European Economic Area and Plutos sends personal data back to you, module four of the Standard Contractual Clauses applies where the law requires it, and it is part of this agreement by reference. If the clauses and this agreement conflict, the clauses win.

14. Deletion or return at the end

When your plan ends, you can read and export your workspace for 30 days. When a free trial ends without a plan, you can read it for 30 days. Then Plutos deletes your workspace's personal data, unless the law requires it to keep part of it. Copies in our database provider's backups are overwritten as those backups expire. You can ask for earlier deletion at support@plutosapp.eu.

During use, some data is deleted sooner: raw search results after 90 days, raw copies of incoming messages after 30 days, setup chats 30 days after the last message, and export files after 24 hours.

15. Audits and information

Plutos makes available the information needed to show that it meets this agreement: this agreement, the sub-processor list, a written summary of its security measures, and answers to reasonable security questionnaires.

If that is not enough, or an authority requires it, you may audit Plutos, or have an independent auditor bound by confidentiality do so, once a year, with at least 30 days' notice, during working hours, without access to other customers' data, and at your own cost. We agree the scope together first.

16. What Plutos does as a controller

Plutos is the controller, not your processor, for: your account, billing and usage data, as described in our Privacy Policy; statistics about how the service is used, which contain no lead data or message text; security, fraud and abuse prevention, including checking whether one connected account is used in several workspaces; and records the law requires.

Plutos does not use the personal data this agreement covers for its own marketing, does not sell it, does not share it with other customers, and does not use it to train AI models.

17. Liability and which text wins

Each party's liability under this agreement follows the liability section of the Terms of Service, except where data protection law does not allow a limit.

If this agreement and the Terms of Service conflict on data protection, this agreement wins.

18. Changes and contact

We may update this agreement when the law, our sub-processors or Plutos change, with the notice the Terms of Service describe.

Questions: support@plutosapp.eu. Joseph Karaosman, Rhodes, Greece. Plutos is being registered as a business; its registered name, address and VAT number will be shown here once it is.