Privacy Policy

1. Who we are

Plutos is run by Joseph Karaosman, in Rhodes, Greece. Plutos is being registered as a business; its registered name, address and VAT number will be shown here once it is. For the data this policy describes about our customers, our website visitors and the people Plutos itself contacts, the operator of Plutos named here is the controller, and we, us and our mean that operator.

For any question about your data or this policy, write to support@plutosapp.eu. We have not appointed a data protection officer; that address reaches the person responsible.

2. Our two roles

When you use Plutos as a customer, we decide how your account, billing and usage data are used. For that data we are the controller, and this policy applies in full.

When our customers use Plutos to find and contact people, the customer decides who to search for, who to contact and what to say. For the personal data of those people (leads, creators and people who message a customer's accounts), the customer is the controller and we are their processor. We handle that data only on the customer's instructions, under our Data Processing Agreement. Section 6 explains what this means if you are one of those people.

3. Data we collect about you as a customer

• Account: your email address, your name if you add one, and how you sign in. If you use Continue with Google: the name, email address and profile picture your Google account shares, and the sign-in keys Google issues, stored encrypted. If you add a passkey: its public key and its name. The private key never leaves your device.
• Sessions and acceptance: for each sign-in, a session record with a keyed hash of your IP address and browser type, never the raw values. A record of which versions of our terms, Data Processing Agreement and this policy you accepted, and when, with a keyed hash of your IP address.
• Workspace and team: your business name, website, what you sell, country and time zone, and the email addresses and roles of the people you invite.
• Billing: your plan and payments, whether you buy as a business or a person, your tax country, your VAT or business number and billing address, invoices, refunds, credit notes and referral credit. Stripe handles your card. We receive only details such as the card brand, the last 4 digits, the expiry date and a card fingerprint.
• Trial protection: to allow one free trial per person, we keep keyed hashes of your normalized email address, Google account, phone number, card fingerprint and a device identifier, and we look at your IP address and network as signals. We use your phone number to send you the text message code.
• Usage: the actions you take in the app, such as signing in, creating an audience, approving a batch or opening a tab, recorded in our own database with no third-party analytics. These records never contain message text, lead data or contact details. You can turn them off on your account page. We also count the credits, AI credits and messages you use, to apply your plan's limits and the money back.
• Connected accounts: the handles and email addresses of the accounts you connect, their role, status and expiry dates. The keys, access codes and mailbox passwords you give us, such as a Google or Microsoft mailbox sign-in, or an SMTP and IMAP password, are stored encrypted and never shown again in full. We never see or store your Instagram, TikTok or WhatsApp password: you log in to those yourself on your own computer.
• What you create: your audiences and setup chats, templates and messages, call scripts and notes, Customer support instructions, your Never contact list, and the audit log of who did what in your workspace.
• The desktop app: its pairing, public key, operating system, version, whether it is online, and the result of each instruction it carries out. Error screenshots reach us only if you press Send to support.
• Support: what you write to us, its topic and any error code attached, and our replies.
• Emails we send you: sign-in codes, your daily summary, and account and billing notices. They contain no tracking pixels. Links may carry a random code per email so we can count clicks; it is left out if you turned off usage records.
• Technical logs: our hosting provider records requests to the website and the app, such as IP address, time, page and browser type, to run and protect the service.
• Early access list: if you leave your email on our early access page, your email address, what you sell if you tell us, and your approximate country. Section 8 explains this list.

4. Why we use it, and our legal bases

Under Article 6 of the EU General Data Protection Regulation (GDPR), we use your data:

• to provide Plutos under our contract with you: your account, sign-in, workspace, connected accounts, sending, the desktop app, support and service emails. Basis: contract (Article 6(1)(b));
• to bill you, issue invoices and credit notes, and keep tax and accounting records. Basis: contract and legal obligation (Article 6(1)(b) and (c));
• to keep Plutos secure and prevent fraud and abuse, including the one-trial rule, rate limits, spotting the same connected account used in several workspaces, and protecting what we spend with providers. Basis: our legitimate interests in a safe service and in preventing abuse (Article 6(1)(f));
• to understand how Plutos is used and to improve it, from usage records that hold no message text or lead data. Basis: our legitimate interest in improving the product (Article 6(1)(f)). You can turn this off;
• to tell you about changes to Plutos, its terms or this policy. Basis: contract and our legitimate interests;
• to email you once when Plutos opens, if you joined the early access list (section 8). Basis: your consent (Article 6(1)(a)), which you can withdraw at any time;
• to keep a referral code in your browser when you arrive through a referral or partner link. Basis: your consent (Article 6(1)(a)), which you can withdraw at any time;
• to deal with legal claims, enforce our terms and answer authorities. Basis: legal obligation and our legitimate interests (Article 6(1)(c) and (f)).

Where we rely on legitimate interests, you can object at any time (section 13).

5. Data we process for our customers

Plutos searches public sources for the businesses and creators our customers describe: Google Maps listings, business websites, the Meta Ad Library, and public Instagram and TikTok profiles. For each lead it may hold the business or creator name, address and area, the phone numbers, email addresses and social handles they publish, website details, ratings and review counts, active ads, follower counts, engagement and public information about recent posts, a grade with its reasons, the messages the customer sends, the replies the customer gets, call outcomes and notes.

Plutos also processes the messages people send to our customers' connected accounts, so that the customer can read and answer them, and so that Customer support can answer people who wrote first.

We do this only for the customer, on their instructions, under our Data Processing Agreement. Each customer's data is kept apart from every other customer's. We do not sell it, use it for our own marketing, or use it to train AI models.

6. If a Plutos customer contacted you

If you received a message from a business that uses Plutos, that business is responsible for it. It decided to contact you, chose the words and sent the message from its own account. It is the controller of your data, and it must tell you who it is, where it found your details and how to object (Article 14 of the GDPR sets this out).

To stop further messages, reply stop or no, or use the unsubscribe link in any email. Plutos recognizes opt-out replies and blocks further outreach to you from that business's workspace, on every channel.

To see your data or have it erased, ask the business that contacted you. If you cannot reach them, write to us at support@plutosapp.eu and include the message you received. We pass your request to that business without undue delay and help them act on it.

7. If Plutos contacted you about Plutos

We use Plutos to offer Plutos to businesses. If we contacted you, we found your business's published contact details in public sources, such as Google Maps, business websites or public social media profiles, and we are the controller of that data.

We use it only to offer our service to your business, based on our legitimate interest in direct marketing to businesses (Article 6(1)(f)). You can object at any time: reply stop, or use the unsubscribe link, and we will not contact you again. To make sure of that, we keep a one-way code made from your contact details on our block list.

If you do not reply, we delete your details 12 months after our last message.

8. The early access list

Plutos is opening soon. If you leave your email on our early access page, this section explains what happens to it. For this list we are the controller.

• What we collect: your email address, what you sell if you choose to tell us, and your approximate country, taken from your connection when you sign up. The form asks for nothing else and stores nothing in your browser.
• Why: to email you once when Plutos opens. We also send you one confirmation email when you sign up. We do not use the list for anything else. Basis: your consent (Article 6(1)(a)), which you can withdraw at any time.
• Who handles it: Resend, our email provider (section 9), sends your signup to our support mailbox and sends you the confirmation email.
• How long: until Plutos opens and we invite you. Then we delete it, unless you sign up, in which case your email becomes part of your account (section 3).
• Delete it any time: write to support@plutosapp.eu and we delete your entry. Your other rights are in section 13.

9. Who we share data with

We share personal data only with the providers below, each only for its purpose and under data processing terms. We do not sell personal data.

• Supabase: our database, where all app data is stored. Servers in Frankfurt, Germany (EU).
• Vercel: hosts our website and runs the app. A United States company; requests may be processed in the United States and across its global network.
• Anthropic: the AI (Claude) behind the setup chat, search filters, message versions, reply sorting, creator checks and Customer support. United States.
• Apify: runs the searches of public sources. A company in the Czech Republic (EU); its platform may process data in the United States. What we send it holds only search terms and filters, never who our customer is.
• Stripe: payments, invoices and tax calculation. Stripe Payments Europe in Ireland, with processing also in the United States.
• Resend: sends Plutos's own emails to you, such as sign-in codes, summaries, account and billing notices, and the early access emails. United States. It never carries our customers' outreach.
• A text message provider: sends the phone check code in the free trial. We name it on this page before phone checks start.
• Google: Continue with Google sign-in, under Google's own privacy policy.

Services you connect yourself: when you connect Instagram, Facebook, WhatsApp, TikTok, Gmail, Outlook or another mailbox, Plutos sends your messages and reads your replies through those services, on your instructions. They are your own providers, under your own agreements with them, not ours. The same goes for your own Apify account if your searches run on it.

Others: our accountant and legal advisers, under confidentiality; authorities, where the law requires it; and a company that takes over Plutos, if that ever happens, under this policy.

10. Transfers outside the EU

Our database is in the EU. Some of the providers above are in the United States or may process data there. For each, we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses, with extra safeguards where needed. You can ask us for a copy of the safeguards at support@plutosapp.eu.

11. How long we keep data

• Account data: while you have an account. If you ask us to delete your account, we do so within 30 days.
• Workspace data after a plan ends: readable and exportable for 30 days, then deleted. After a free trial that ends without a plan: readable for 30 days, then deleted.
• Setup chats: deleted 30 days after the last message.
• Raw search results from our data collection provider: 90 days. The leads made from them stay in the workspace until the customer deletes them or the workspace is deleted.
• Raw copies of incoming messages, as each channel delivers them: 30 days. The message itself stays in the inbox with the workspace.
• Usage records: 13 months.
• Sessions: they end after 7 days unused, and at most 30 days after sign-in. Sign-in codes expire after 10 minutes.
• Export files: deleted 24 hours after they are made.
• Block lists of people who opted out or were erased: kept as one-way codes for as long as the workspace exists, so those people are never contacted again.
• Trial protection hashes: as long as we need them to apply the one-trial rule.
• Acceptance records: while your account exists, and after that only as long as we may need to show what you accepted.
• Billing and tax records: for the period Greek tax and accounting law requires.
• Support messages: as long as we need them to help you and keep a record of the help given.
• Early access list: until Plutos opens and we invite you, then deleted unless you sign up, or sooner if you ask us to delete it.
• Backups: copies in our database provider's backups are overwritten as those backups expire.

12. How we protect data

• Each workspace's data is kept apart in the database, so one customer cannot reach another's.
• Keys, access codes and mailbox passwords are encrypted with AES-256-GCM under a separate key for each workspace, which is itself protected by a master key kept outside the database. They are never shown again in full.
• We never see or store your Instagram or TikTok password. You log in on your own computer, and the login stays there.
• Plutos accounts have no password to steal: you sign in with an emailed code, a passkey or Google. Sensitive actions, such as saving a key, exporting, erasing a person or cancelling, need a recent sign-in.
• Data is encrypted in transit, and our database provider encrypts it at rest.
• The desktop app pairs only with a one-time code, signs every request with its own key, and can be stopped from our side.
• Our logs never hold message text, keys or passwords, and email addresses and phone numbers in them are masked.
• Our AI treats what other people write as information, never as instructions, and cannot send messages, export data or read keys.
• Plutos staff do not open a customer's workspace unless its owner turns on support access, which lasts 24 hours and is logged, or where a security incident, abuse or the law requires it.

No system is perfectly secure. If a breach puts your data at risk, we tell you and, where the law requires, the Hellenic Data Protection Authority.

13. Your rights

Under the GDPR you have the right to:

• see the personal data we hold about you and get a copy;
• have data that is wrong or incomplete corrected;
• have your data erased;
• restrict how we use it;
• object at any time to our use of it based on legitimate interests, including direct marketing;
• receive the data you gave us in a common, machine-readable format, and have it sent to another provider;
• withdraw your consent at any time where we rely on it, without affecting what we did before;
• complain to a data protection authority. In Greece this is the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, www.dpa.gr. You can also complain in the EU country where you live or work.

To use your rights, write to support@plutosapp.eu. We answer within one month and may first ask you to confirm who you are. If your request is about a lead's data that we hold for one of our customers, see section 6.

14. Cookie policy

This cookie policy covers our website and the Plutos app. We use no advertising and no third-party tracking. This is what we store in your browser:

• To sign in and keep you signed in: a session file, and during sign-up a short-lived file (30 minutes) that carries your acceptance of our terms. These are set without asking, because Plutos cannot work without them.
• Trial protection: a random device identifier, which we read only as a keyed hash together with basic browser settings, so that one person cannot start many free trials.
• Referral, only with your cookie consent: if you arrive through a referral or partner link and accept in the cookie banner, we keep the link's code in your browser for 60 days, so the person who sent you gets the credit. If you decline, nothing is stored, and you can still sign up.

The pages of our public website store nothing in your browser and count no visits. When you use Continue with Google or pay through Stripe, Google's and Stripe's own pages and scripts run under their own privacy policies.

You can delete what we store at any time in your browser settings. Deleting the session file signs you out.

15. Automated decisions

Plutos grades leads with software, but those grades are about businesses and creators, not decisions about you as our customer. Our trial protection can pause a free trial automatically when it sees unusual activity; a person then reviews it and decides. We make no decision about you based only on automated processing that has legal or similarly significant effects on you.

16. Children

Plutos is for people aged 18 and over. We do not knowingly collect data about children, and our customers must not use Plutos to contact anyone under 18. If you think a child's data is in Plutos, write to us and we will act on it.

17. Changes to this policy

We update this policy when Plutos or the law changes. We tell you about important changes by email or in the app before they apply. The date at the top shows the latest version.

18. Contact

Joseph Karaosman, Rhodes, Greece. Email: support@plutosapp.eu. Plutos is being registered as a business; its registered name, address and VAT number will be shown here once it is.