Privacy Policy

Plutonapps is a trading name of Bose and Turing Innovations FZCO ("Plutonapps", "we", "us"), a company incorporated in the United Arab Emirates (an IFZA free zone company), trade licence number 54549 (IFZA trade licence), registered at IFZA Properties, A1 - 3641379065, Dubai Silicon Oasis, Dubai, United Arab Emirates. We are the controller of the personal data described in this policy.

For anything about your data, email [email protected].

Which laws apply: we are based in the UAE, so the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) applies. Because we offer our services to people and businesses in the EU and EEA (including Norway) and the UK, the EU General Data Protection Regulation (GDPR, Article 3(2)) and the UK GDPR also apply to that processing. This policy is written to meet all of them.

If you are in the EEA or the UK, you can contact us about your rights at [email protected].

We have not appointed a Data Protection Officer. Our processing is not large-scale monitoring or large-scale special-category data, so GDPR Article 37 does not require one.

Where our customers use us to build and run their products, we process their end users' data on the customer's behalf. That is covered by our Data Processing Agreement, not by this policy; the customer is the controller and their privacy policy applies.

We do not use analytics, advertising or tracking tools on this site, and we do not sell personal data or use it for automated decisions with legal effect.

We do not ask for special-category data (health, religion and so on). Please do not put it in messages unless it is needed for the work.

We use a small number of service providers (processors) to run Plutonapps. Each only processes data on our instructions. The current list, with what each one does and where, is on our Sub-processors page.

Stripe processes payments as an independent controller for fraud prevention and its own legal obligations; see stripe.com/privacy.

We may disclose data if the law requires it, or to protect our rights, and to a buyer if Plutonapps is sold or merged (you will be told).

Our team works from Norway, the United States, the United Arab Emirates and India, and may access your data from any of those places to do the work.

If you are in the EU, EEA or UK, your data leaves it: we are a UAE company, our team also works from the United States and India, and our main providers (Clerk, Supabase, Stripe, Resend and DigitalOcean) process data in the United States; our database is hosted by Supabase in AWS us-east-1 (North Virginia, USA). The UAE and India do not have an EU adequacy decision.

Where personal data is transferred outside the EEA or UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data) or the EU–US Data Privacy Framework where the provider is certified.

Data you give us directly from the EU/EEA or UK is collected by us in the UAE under GDPR Article 3(2) and the UK GDPR, and we apply the protections in this policy to it wherever it is handled. The same safeguards cover access by our staff in the UAE, the United States and India.

You can ask us for a copy of the safeguards that apply.

• Account and project records: for as long as you are a customer, then 12 months unless you ask us to delete them sooner. When a project is removed we archive it rather than delete it straight away, so it can be restored if the removal was a mistake.
• Messages with your account manager: kept with the account. Attachments can be removed by you or us at any time; message text is kept as a record of what was agreed until the account's data is deleted.
• Billing and invoices: as long as accounting law requires (at least 5 years under UAE tax law).
• Enquiries: 24 months after our last contact, unless they become a customer relationship.
• Server and security logs: kept by our hosting providers for their standard periods.

Deleting data at the end of an account is currently done by us on request rather than automatically. Email us and we will do it.

Under the GDPR, the UK GDPR and the UAE PDPL you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; and give it to you in a portable format. Where we rely on consent you can withdraw it at any time. We answer within one month.

Email [email protected]. We may need to confirm who you are first.

You can also complain to a data protection authority: in Norway, Datatilsynet (datatilsynet.no); in the UK, the ICO (ico.org.uk); in the EU, the authority where you live or work; in the UAE, the UAE Data Office. We would appreciate the chance to fix things first.

If you are in a US state with a consumer privacy law (for example California), you have similar rights to know, correct and delete your data. We do not sell or share personal information for cross-context behavioural advertising.

Our database is not reachable from the public internet except through our own server code; sign-in is handled by Clerk; card data is handled only by Stripe; and staff access to customer dashboards is recorded. No system is perfectly secure, and we will tell you and the authorities without undue delay if a breach puts your data at risk.

We use only cookies and browser storage that the site needs to work, such as keeping you signed in. See our Cookie notice.

Plutonapps is a business service and is not meant for anyone under 16.

If we change this policy in a way that matters, we will update the date at the top and tell customers by email before it takes effect.