Privacy Policy.

Who is responsible

PluginLab is responsible for your personal data (the “data controller”). Contact: contact@pluginlab.app.

What we collect

• Your account: email address, password (stored only as a secure hash, never readable), language, plan, credits and their history.
• Google sign-in, if you use it: your email address and your Google account identifier. We never see your Google password.
• Payments: Stripe handles them. We receive your plan, the amounts, the payment status and Stripe's reference numbers. Your card details stay with Stripe.
• What you do in PluginLab: your searches (software, level, niche), the ideas, the angle and brand name you choose, the prompts generated and your builds.
• PluginLab Builder: your computer's name and operating system, the Builder's version, when it last connected, and the progress messages of each build (for example the versions of Claude Code and of your Adobe software). Your plugin's files stay on your computer: the Builder does not send them to us.
• Technical logs: like any website, our servers and our hosting provider record logs (IP address, browser type, pages requested, errors) to keep the service working and secure.
• Audience measurement, without cookies: the pages visited, the site you came from, your country, the type of device and the language, with a code that changes every day instead of your IP address (details below).

Why we use it

• to provide the service you pay for: account, ideas, prompts, builds and payments;
• to keep it secure: prevent abuse, fraud and attacks, and limit repeated sign-in attempts;
• to meet our legal obligations, such as keeping invoices;
• to improve PluginLab with overall statistics (number of visits, where visitors come from, sign-ups and payments, the real cost of each operation), never to profile you.

Legal bases: the contract between us, our legal obligations, and our legitimate interest in keeping the service secure and improving it.

We never sell your data, and we do not use it for advertising.

What other creators can see

Nobody else can see your account, your ideas or your prompts. When other creators look at a similar idea, they only see an anonymous count, such as “Picked by 3 creators”.

Public demand signals found during searches (posts on forums, Reddit or YouTube) are added to a radar shared by all customers, with no link to you.

Who processes it for us

• our hosting provider (Render (render.com)), which stores the database and the logs;
• Stripe, for payments (stripe.com/privacy);
• Google, if you sign in with Google (policies.google.com/privacy);
• Anthropic, whose AI (the Claude API) runs idea searches and writes prompts: it receives the search details, the idea and your angle, never your email address or payment details;
• Resend, if email sending is turned on, to send account emails (password reset, payment problems).

These providers only use your data to provide their service to us. Some are based in the United States: these transfers are protected by safeguards such as the European Commission's standard contractual clauses.

When PluginLab Builder runs your Claude Code, the prompt and the plugin's files are processed by Anthropic under your own Claude account and Anthropic's privacy policy.

Cookies

PluginLab only uses cookies that are strictly necessary. That is why there is no cookie banner.

• pl_session: keeps you signed in (30 days, or until you sign out);
• pl_lang: remembers the language you chose (1 year);
• pl_oauth: protects Google sign-in (10 minutes).

No advertising, analytics or tracking cookies: audience measurement works without any cookie (see below). Stripe's payment page opens on Stripe's own site and uses its own cookies, under Stripe's policy.

Audience measurement (without cookies)

To know how many people visit PluginLab, where they come from and which pages lead to a sign-up, the site records each page view and the main steps (sign-up, sign-in, payment, idea search, prompt, build). No cookie is set and nothing is stored in your browser.

• what is recorded: the page (without its parameters: links that contain a code or a token are cleaned), the site you came from (its name only, for example google.com), the campaign tags of the link (utm), your country (worked out from your IP address, which is not kept), the type of device (phone, tablet or computer) and the language;
• your IP address and your browser's details are never stored. They are only used, with a secret key, to compute a code that changes every day: it lets us count a visitor once per day, without being able to recognize you the next day or to find your IP address;
• when you are signed in, the steps (sign-up, payment, searches, builds…) are linked to your account to measure conversion; when you create your account, only the source of your visit is noted with it (for example google.com or a campaign name). The pages you visit are never linked to your account: the daily code is not kept with your account;
• visits from robots are ignored; if your browser sends “Do Not Track” or “Global Privacy Control”, your page views are not recorded.

Page views are kept in detail for 31 days, then only as daily totals (number of visits per page, source, country, type of device and language, without the daily code). These totals and the other records are kept 400 days, then erased automatically. They are never shared or used for advertising. If you delete your account, they are detached from it within 24 hours.

How long we keep it

• account data: as long as your account exists. When you delete your account, it is erased, except what the law requires us to keep;
• payment records and invoices: as long as accounting law requires (often up to 10 years);
• sign-in sessions: 30 days; password reset links: 1 hour;
• audience measurement: page views 31 days in detail, then daily totals; everything 400 days at most;
• server logs: a few weeks, depending on the hosting provider.

Your rights

You can access, correct, download and delete your data. Downloading your data and deleting your account are self-service, from your Account page.

You can also object to some uses or ask us to limit them. For anything else, write to contact@pluginlab.app: we answer within one month.

If you think we are not respecting your rights, you can complain to your data protection authority (in France, the CNIL: cnil.fr).

Security

Passwords are hashed, connections are encrypted (HTTPS), builds sent to PluginLab Builder are signed, and the Builder opens no port on your computer. No system is perfect: if a breach affects your data, we will tell you as the law requires.

Children

PluginLab is meant for adults and professionals, not for children under 16.

Changes

If we change this policy in an important way, we will tell you by email or on the site before it applies.

Contact

For any question about your data: contact@pluginlab.app.