Privacy Policy

PodPlex is the data controller for account and marketing data, and a processor for the content your workspace submits. For privacy questions or to reach our data protection contact, email privacy@podplex.app. A Data Processing Agreement (DPA) is available on request.

• Account data — name, email, hashed password, workspace and role.
• Workspace content — chats, prompts, skills, uploaded files, and knowledge you add.
• Usage & billing data — message counts, model/skill usage, plan, and (once live) Stripe customer identifiers.
• Diagnostics & analytics — error reports and, with consent, product-analytics events.
• Marketing leads — email and company submitted through website forms.

• To provide the service (Art. 6(1)(b) — contract): run chats, skills, and workspaces.
• To secure and improve it (Art. 6(1)(f) — legitimate interests): abuse prevention, diagnostics, aggregate analytics.
• Analytics & support cookies (Art. 6(1)(a) — consent): only after you accept in the cookie banner.
• Legal compliance (Art. 6(1)(c)): records we are required to keep.

Open-source models used by PodPlex do not train on your content.

We share data only with the processors needed to run the service:

• Linode / Akamai (EU) — VPS hosting & self-hosted Postgres database (EU (Frankfurt)).
• Together, Groq, Fireworks — Open-source model inference (EU / US).
• Resend — Transactional & auth email (EU / US).
• Sentry — Error monitoring (EU / US).
• PostHog — Product analytics (with consent) (EU).
• Intercom — Support messaging (with consent) (EU / US).
• HubSpot — Website lead / CRM (marketing site only) (EU / US).
• Slack — Internal lead notifications (marketing site only) (US).

Core application and database hosting is in the EU. Where a processor operates outside the EU, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

We keep personal data for as long as your account is active. When you delete your account or workspace, associated data is removed or anonymized, except where we must retain limited records to meet legal obligations.

Under the GDPR you can:

• access, correct, or delete your personal data;
• export your data (self-serve account export is available in the app);
• restrict or object to processing, and withdraw consent at any time; and
• lodge a complaint with your local supervisory authority.

Delete your account or workspace from Settings, or email privacy@podplex.app to exercise any right.

Every workspace is isolated at the database layer, access is authenticated with signed tokens, and secrets such as bring-your-own-key credentials are encrypted at rest. No system is perfectly secure, but we design for least privilege and tenant isolation.

See the Cookie Policy for details on cookies and consent. PodPlex is not intended for anyone under 16. We may update this policy; material changes will be notified in-app or by email.