Privacy Policy

Plutonapps is a trading name of Bose and Turing Innovations FZCO ("Plutonapps", "we", "us"), a company incorporated in the United Arab Emirates (an IFZA free zone company), trade licence number 54549 (IFZA trade licence), registered at IFZA Properties, A1 - 3641379065, Dubai Silicon Oasis, Dubai, United Arab Emirates. We are the controller of the personal data described in this policy.

For anything about your data, email hello@plutonapps.com.

Which laws apply: we are based in the UAE, so the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies. Because we offer our services to people and businesses in the EU and EEA (including Norway) and the UK, the EU General Data Protection Regulation (GDPR, Article 3(2)) and the UK GDPR also apply to that processing. This policy is written to meet all of them.

If you are in the EEA or the UK, you can contact us about your rights at hello@plutonapps.com.

We have not appointed a Data Protection Officer. Our processing is not large-scale monitoring or large-scale special-category data, so GDPR Article 37 does not require one.

Where our customers use us to build and run their products, we process their end users' data on the customer's behalf. That is covered by our Data Processing Agreement, not by this policy; the customer is the controller and their privacy policy applies.

We do not use advertising or tracking tools on this site, and we do not sell personal data or use it for automated decisions with legal effect.

We do not ask for special-category data (health, religion and so on). Please do not put it in messages unless it is needed for the work.

The Plutonapps app for iPhone and Android signs you in to the same account as the Control Room, so everything above applies to it too. The app has no analytics, advertising or crash-reporting tools, does not track you, and does not read your location, your contacts or your phone's calendar. These are the parts that are specific to the app:

• Push notifications: if you turn them on, we store your device's push token, whether it is an iPhone or an Android phone, and your notification choices for that device (chat, releases and meetings), linked to your account. We use them only to send you the app's notifications. Each notification's title and text go with the token to Expo's push service, which passes them to Apple or Google to deliver. Signing out of the app deletes the token from our servers. If Apple or Google tell us a token no longer works, we mark it inactive and send nothing more to it. Deleting your account deletes the tokens for all your devices.
• Video notes and screen recordings: a video note is a video with sound from your camera. A screen recording captures everything on your screen, including any notifications that appear, with spoken narration if you choose, for up to 10 minutes. Neither is ever streamed live. When you add one to a chat message, it is uploaded to private file storage with our database provider, Supabase. Once you send it, the people on your company's account and the Plutonapps team who answer your chat can see it. A recording you upload but never send expires and is deleted after 24 hours. A sent recording is kept with your account's messages like any other attachment: you or we can remove it at any time, and it is deleted when your account's data is deleted.
• SOS voice calls: an SOS call from the app is live audio between your phone and our team. It is never recorded or stored. We keep the same record of it as of any SOS call (see the table above), including that it happened, how long it lasted and who answered, which also appears in your chat, and the description of the problem you type before you call.
• Inviting a teammate: when you invite someone, we store the name and email address you enter, the role you give them and who invited them, with our sign-in provider Clerk, which emails them the invitation. We use them only to send the invitation and to give that person access to your projects once they accept.
• Google Calendar: you can connect a Google Calendar from the app's Integrations page; the connection itself is made on our website, and the app never reads your phone's calendar. We read only your free and busy times, never the contents of your events, so we can offer call times that suit you. We write only the events for the calls you book with us. We store the connected Google account's email address and an encrypted refresh token. To disconnect, choose Disconnect on the Integrations page in the app or in the Control Room: we revoke our access at Google and delete the token. Events we already added stay in your calendar until you delete them.
• Deleting your account: in the app, open Account and choose Delete account. You can also use the account deletion page or email us. A person on our team confirms with you by email and finishes the deletion within 30 days. That page lists what we delete and what we keep.

Plutonapps' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use a small number of service providers (processors) to run Plutonapps. Each only processes data on our instructions. The current list, with what each one does and where, is on our Sub-processors page.

Stripe processes payments as an independent controller for fraud prevention and its own legal obligations; see stripe.com/privacy.

We may disclose data if the law requires it, or to protect our rights, and to a buyer if Plutonapps is sold or merged (you will be told).

Our team works from Norway, the United States, the United Arab Emirates and India, and may access your data from any of those places to do the work.

If you are in the EU, EEA or UK, your data leaves it: we are a UAE company, our team also works from the United States and India, and our main providers (Clerk, Supabase, Stripe, Resend and DigitalOcean) process data in the United States; our database is hosted by Supabase in AWS us-east-1 (North Virginia, USA). The UAE and India do not have an EU adequacy decision.

Where personal data is transferred outside the EEA or UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data) or the EU–US Data Privacy Framework where the provider is certified.

Data you give us directly from the EU/EEA or UK is collected by us in the UAE under GDPR Article 3(2) and the UK GDPR, and we apply the protections in this policy to it wherever it is handled. The same safeguards cover access by our staff in the UAE, the United States and India.

You can ask us for a copy of the safeguards that apply.

• Account and project records: for as long as you are a customer, then 12 months unless you ask us to delete them sooner. When a project is removed we archive it rather than delete it straight away, so it can be restored if the removal was a mistake.
• Messages with your Key Account Manager: kept with the account. Attachments can be removed by you or us at any time; message text is kept as a record of what was agreed until the account's data is deleted.
• Billing and invoices: as long as accounting law requires (at least 5 years under UAE tax law).
• Inquiries: 24 months after our last contact, unless they become a customer relationship.
• Production-readiness check requests: 24 months after you ask for the report, unless they become a customer relationship.
• Server and security logs: kept by our hosting providers for their standard periods.
• Google Calendar connection: until you disconnect it or the account's data is deleted; disconnecting revokes our access at Google and deletes the token.

Deleting data at the end of an account is currently done by us on request rather than automatically. Email us, or ask from the app or the account deletion page, and we will do it.

Under the GDPR, the UK GDPR and the UAE PDPL you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; and give it to you in a portable format. Where we rely on consent you can withdraw it at any time. We answer within one month.

Email hello@plutonapps.com. We may need to confirm who you are first.

You can also complain to a data protection authority: in Norway, Datatilsynet (datatilsynet.no); in the UK, the ICO (ico.org.uk); in the EU, the authority where you live or work; in the UAE, the UAE Data Office. We would appreciate the chance to fix things first.

If you are in a US state with a consumer privacy law (for example California), you have similar rights to know, correct and delete your data. We do not sell or share personal information for cross-context behavioral advertising.

Database access needs credentials held only by our servers and a small number of named engineers, and customer data is also protected by row-level security; sign-in is handled by Clerk; card data is handled only by Stripe; and staff access to customer dashboards is recorded. No system is perfectly secure, and we will tell you and the authorities without undue delay if a breach puts your data at risk.

We use only cookies and browser storage that the site needs to work, such as keeping you signed in. See our Cookie notice.

Plutonapps is a business service and is not meant for anyone under 16.

If we change this policy in a way that matters, we will update the date at the top and tell customers by email before it takes effect.