Privacy Policy
1. Who we are
Plainzy is an AI-powered contract analysis service. When this policy refers to "we", "us" or "our", it means Plainzy, operated by Thoughtloom Digital Limited, a company registered in England and Wales (company number 17525958) with its registered office at 124 City Road, London, EC1V 2NX. We are the data controller for information you provide. Contact us at hello@plainzy.com.
2. What data we collect
Contract text or files you submit (including PDFs, Word documents and photos of printed contracts), including both contracts when you use Compare. We process them to produce your analysis and do not keep the original document. We also collect usage data in aggregate and account information if you register. You can sign up or sign in with email, Apple or Google; if you use Apple or Google, we receive the basic details they share with us, such as your name and email address.
Payments for the mobile app are handled directly by Apple or Google's payment systems, and RevenueCat manages your subscription status on our behalf. Payments on our website are taken by Stripe, and its service Onelink (which may also appear as Link) handles the payment and issues your receipts. We never see or store your card details. Stripe and Onelink each have their own privacy policy; Onelink's is at onelink.com/privacy.
On the mobile app and the web app, we also generate an anonymous device identifier (on the web it is kept in your browser’s local storage, not in a cookie) used to enforce the Free plan's one-analysis-per-month limit and its follow-up question allowance. If you're not signed in, this identifier is not linked to your name or any other personal information we hold, and is never used for advertising or tracking. If you sign in, we link your device to your account so your usage and history follow you.
To protect the service from abuse, on both web and mobile we keep short-lived rate-limit counters, keyed to a hashed (not raw) form of your IP address and device or account identifier, deleted within 2 days.
For people who are not signed in, we also count free analyses per hashed IP address (never the raw address) to stop abuse; these records are kept for 35 days. On the web, Vercel BotID checks whether a request comes from a real browser before an analysis starts.
We use your IP address to work out roughly which country you are in, so we can check whether Plainzy is available there. We look at the country each time you use the service and do not store it. The IP address itself is handled as described above.
If you turn on reminders in the mobile app, we store your push notification token, your reminder settings, and a log of the notifications we've sent. Tokens are passed to Expo, Apple and Google to deliver notifications. If you turn on reminders in your web browser, we store that browser’s push subscription (a web address and two keys from your browser’s push service, such as Google, Mozilla or Apple) and your reminder settings, and use them only to send the reminders you chose. We send service emails through Resend. These are messages about your account and subscription, such as a welcome message after you subscribe, trial and renewal notices, confirmation of changes to your plan or access, and confirmation if you delete your account. If you contact us through the support form, we receive your email address, your message, the category you choose and any technical details you leave in the form (such as app version and device type, which you can edit or delete before sending). We use them only to reply and to fix the problem. We send an automatic confirmation through Resend. Messages sent to hello@plainzy.com, including from the support form, are forwarded by our email forwarding provider (ImprovMX) to our mailbox, where we read and reply to them. Please do not include your contract or other private documents. We keep support messages for as long as needed to deal with your enquiry and for a reasonable period afterwards in case you write to us again. We do not currently send marketing emails; if we ever do, we will ask for your consent first.
Our website uses Vercel Web Analytics to measure page views in aggregate. It does not use cookies and does not identify you personally.
If you create an account and sign in, we additionally store the results of your analyses — the plain-English summary, risk score, flagged clauses (including short extracts of the contract text that triggered each flag), your obligations checklist, any follow-up questions you ask and their answers, and your recent comparisons from the Compare feature — linked to your account, so they're available if you sign in again on a different device. Your Free plan usage count also becomes linked to your account rather than just your device. We do not store the full text or file you submitted, even for signed-in accounts.
3. How we use your data
To provide the service, improve analysis quality, send service communications, and comply with legal obligations. We do not use your contracts to train AI models. We do not store the full text of your contract. If you sign in, short extracts of flagged clauses are kept as part of your saved analysis — see Section 5 for full detail on what is and isn't retained.
4. Legal basis (GDPR)
Contract performance, legitimate interests, legal obligation, and consent for marketing (which you can withdraw anytime). The device identifier, rate-limit counters and free-analysis network log described in Section 2 are processed under legitimate interests — specifically, preventing abuse of the Free plan's usage limit and keeping the service secure. Push notifications are sent with your consent. Where you create an account, storing your analysis results, comparisons and Q&A against it is processed under contract performance — it's the service you've asked us to provide by signing in. Anonymized billing records, described in Section 5, are retained under legal obligation — UK tax and accounting law requires us to keep them for a set period regardless of account status.
5. Data retention
Original contract text or files: not stored beyond your active session, whether or not you have an account.
Signed out: your analysis history, follow-up Q&A and recent comparisons are stored only on your own device, not on Plainzy's servers — they will be lost if you clear the app's data or browser data, uninstall the app, or switch devices. If you later sign in, they are copied to your account.
Signed in: your analysis results (including flagged-clause extracts), follow-up Q&A and comparisons are stored on our servers, linked to your account, until you delete them or delete your account. You can delete individual entries, clear your comparisons, or delete your account at any time (see Section 7).
Anonymous usage records (Free plan usage counts, follow-up question counts, the records that let you keep asking follow-up questions on a Free analysis, and notification logs) are deleted automatically after 35 days.
Account details and usage: your account details and, if you're signed in, your Free plan usage count are kept until you delete your account.
Personal plan analyses: the record that lets you keep asking unlimited follow-up questions on a contract analysed on the Personal plan is kept until you delete your account, even if you later downgrade. If you are signed out and want it removed, email hello@plainzy.com.
Push tokens: removed automatically once you have turned off both reminders and the token has been unused for 180 days. Web browser subscriptions follow the same rule, and are also deleted as soon as your browser’s push service tells us they are no longer valid.
Rate-limit counters (hashed IP address and device or account identifier): deleted within 2 days.
Free-analysis network log (hashed IP address, signed-out use only): deleted within 35 days.
Account deletion removes your account details, saved analyses, comparisons, follow-up question records, usage limits, credits, push tokens and browser push subscriptions, notification history, device links and related records.
Anonymized billing records: one category of data is retained even after account deletion — anonymized subscription and billing records (what was purchased and when) are kept for approximately 6 years to meet UK tax and accounting obligations. These records are stripped of anything linking them back to you or your device at the point of deletion.
Payment providers: Stripe, Onelink and RevenueCat keep their own payment and subscription records, under their own policies and the laws that apply to them. When you delete your account, we cancel any website subscription, ask RevenueCat to delete your customer record and delete your customer record in our Stripe account. Stripe and Onelink keep the payment records they are legally required to keep. If you made a Onelink account of your own, you can ask Onelink to delete it. Apple and Google keep their own billing records. If you keep an Apple or Google subscription going and keep using the app, RevenueCat may create a new anonymous record (with no name or email).
6. Sharing your data
We share only with Anthropic (AI analysis), Supabase (accounts, authentication and data storage — hosted in the UK/EU), RevenueCat (subscription and purchase management), Apple and Google (sign-in, in-app payments and push notifications), Expo (push notifications), Resend (service emails), Stripe and its service Onelink, also shown as Link (website payments), Vercel (hosting, website analytics and bot protection), and law enforcement only if legally required. We never sell your data.
7. Your GDPR rights
Access, rectification, erasure, restriction, portability, objection, and consent withdrawal. Email hello@plainzy.com. Complaints to the ICO at ico.org.uk. The one exception to erasure is anonymized billing records, retained as described in Section 5.
8. Cookies and similar technologies
The website uses only essential cookies — no advertising or tracking cookies — and its analytics is cookie-free. The mobile app does not use cookies; the device identifier described in Section 2 serves the equivalent purpose of enforcing the Free plan's limit, and is disclosed here rather than through a cookie banner.
9. International transfers
Anthropic and some of our other providers (for example Vercel, Expo, Resend, RevenueCat and Stripe) may process data in the United States or elsewhere outside the UK. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, or adequacy arrangements.
Questions? Email hello@plainzy.com — we respond within 5 working days.