Privacy Policy
Effective date: June 1, 2026 · Last updated: June 1, 2026
Plain language summary: Plotted is a content planning tool. We collect only what we need to make the product work. We do not sell your data. We do not share it with advertisers. You own everything you create. You can delete your account and all associated data at any time.
This policy tells you exactly what we collect, why, and what your rights are. If you have questions, email us at privacy@useplotted.ai.
1. Who We Are
Plotted is an AI-powered content planning application operated by Plotted ("Plotted," "we," "us," or "our") at useplotted.ai. We help marketing agencies and freelancers plan, generate, and organize social media content using artificial intelligence.
We are the data controller for personal information collected through useplotted.ai and any associated services.
Contact: privacy@useplotted.ai · useplotted.ai/privacy
2. What Information We Collect
2.1 Information you give us directly
- Account information: Your name, email address, and password when you create an account. If you use Google OAuth to sign in, we receive your name, email, and profile picture from Google.
- Brand workspace data: Website URLs, Google Business Profile names, and any additional brand context text you paste into the brand setup form.
- Content you create or edit: Captions, topics, carousel slide text, and any edits you make to AI-generated content in your content calendar.
- Communications: If you contact us by email or through support chat, we keep a record of that correspondence.
2.2 Information we collect automatically
- Usage data: Pages visited within the app, features used, buttons clicked, and time spent on each screen. Collected via PostHog analytics.
- Device and browser data: Browser type, operating system, screen size, and IP address. Used for debugging and security.
- Error logs: Technical error reports collected via Sentry when something goes wrong. These may include the page you were on and the action you were taking, but never your content data.
2.3 Information we fetch on your behalf
When you add a brand workspace, Plotted fetches data from third-party sources on your behalf to build your brand profile. This data is processed and stored in your account:
- Website content: We send a server-side request to the website URL you provide and extract publicly visible text (headings, paragraphs, meta descriptions). We do not store the raw HTML — only the extracted text used to generate your brand profile.
- Google Business reviews: If you provide a Google Business Profile name, we query the Google Places API to retrieve up to 5 recent public customer reviews and basic business information (name, rating, review count, city). We store the review text temporarily to generate your brand profile, then retain it as part of the profile JSON in your account.
Important: You are responsible for ensuring you have the right to analyze the website and Google Business data you submit to Plotted. Do not submit URLs or business profiles belonging to third parties without their permission.
2.4 Information we do NOT collect
- Social media account credentials, tokens, or access — Plotted does not connect to Instagram, LinkedIn, TikTok, or any other social platform.
- Payment card numbers — all billing is handled by Stripe; we never see or store your card details.
- Biometric data, location data, or sensitive personal categories.
- Data from children — Plotted is not intended for users under 16.
3. How We Use Your Information
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide and operate the Plotted service | Account info, brand workspace data, content data | Contract performance |
| Generate AI brand profiles and content plans | Website text, Google reviews, user-provided context | Contract performance |
| Generate AI background images via Replicate | Image prompts from your brand profile | Contract performance |
| Render carousel slides via Placid | Slide text, brand colors, image URLs | Contract performance |
| Send transactional emails | Email address | Contract performance |
| Debug errors and improve the service | Error logs, usage data | Legitimate interests |
| Detect and prevent fraud or abuse | IP address, usage patterns | Legitimate interests |
| Comply with legal obligations | Any data required by law | Legal obligation |
| Process payments (when billing is activated) | Billing details via Stripe | Contract performance |
We do not: use your brand data, captions, or content plans to train AI models. We do not use your data for advertising. We do not sell your data to any third party.
4. AI Processing and Your Content
Plotted uses AI services to generate brand profiles, content plans, captions, and images. Here is exactly what happens to your data in those processes:
4.1 Anthropic Claude API
When you generate a brand profile or content plan, we send the following to Anthropic's Claude API: your website text, your Google review text, any additional context you provided, and structured prompts we have written. Anthropic processes this data to return AI-generated text. Anthropic's API data usage policy applies — as of the date of this policy, Anthropic does not use API inputs to train their models. See anthropic.com/privacy for current terms.
4.2 Replicate (Flux image generation)
When we generate background images for your posts, we send image prompt text (describing the scene, mood, and style) to the Replicate API, which runs the Flux Schnell image generation model. We do not send personally identifiable information or your brand name in image prompts. Replicate's privacy policy applies — see replicate.com/privacy.
4.3 Placid (carousel rendering)
When we render carousel slides, we send slide text, your brand colors (as hex codes), and image URLs to the Placid API. Placid renders these into PNG images and returns them. We do not send your account information or brand profile to Placid. See placid.app/privacy for their current terms.
4.4 You own the output
All AI-generated content created within your Plotted account — brand profiles, captions, content plans, carousel images — is owned by you. We make no claim over the creative output of your account. You may use it for any lawful commercial or non-commercial purpose.
5. How We Share Your Information
We share your data only in these limited circumstances:
5.1 Sub-processors
We use the following third-party services to operate Plotted. Each is a data processor acting under our instructions:
| Service | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All account and content data | USA (AWS) |
| Vercel | Application hosting and edge functions | Request data, no content data stored | USA / Global CDN |
| Anthropic | AI text generation (Claude) | Website text, review text, prompts | USA |
| Replicate | AI image generation (Flux) | Image prompt text only | USA |
| Placid | Carousel slide rendering | Slide text, colors, image URLs | EU |
| Google Maps Platform | Places API for business reviews | Business search queries | USA |
| PostHog | Product analytics | Usage events, anonymized | EU |
| Sentry | Error monitoring | Error logs, browser info | USA |
| Resend | Transactional email delivery | Email address, email content | USA |
| Stripe | Payment processing (when activated) | Billing details only | USA |
| Crisp | Customer support chat | Name, email, chat messages | EU |
5.2 Legal requirements
We may disclose your information if required by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Plotted, our users, or the public.
5.3 Business transfers
If Plotted is acquired, merged, or transfers its assets, your data may be transferred as part of that transaction. We will notify you via email and provide an opportunity to delete your account before any such transfer takes effect.
5.4 We never sell your data
Plotted does not sell, rent, or trade your personal information to any third party for their marketing purposes. Ever.
6. Data Retention
- Account data: Retained for as long as your account is active.
- Brand profiles and content plans: Retained until you delete the brand workspace or your account.
- Usage logs and error data: Retained for 90 days, then automatically deleted.
- Billing records: Retained for 7 years to comply with financial regulations (when billing is activated).
- After account deletion: All personal data and content data is permanently deleted within 30 days. Anonymized aggregated usage statistics (no personal identifiers) may be retained indefinitely.
7. Your Rights
Depending on where you are located, you may have some or all of the following rights:
| Right | What it means | How to exercise |
|---|---|---|
| Access | Request a copy of all personal data we hold about you | Email privacy@useplotted.ai |
| Rectification | Correct inaccurate personal data | Edit directly in Account Settings, or email us |
| Erasure | Delete your account and all associated data | Account Settings → Delete Account, or email us |
| Portability | Export your data in a machine-readable format | Use the Export feature in-app, or email us |
| Objection | Object to processing based on legitimate interests | Email privacy@useplotted.ai |
| Restriction | Request we limit processing of your data | Email privacy@useplotted.ai |
| Withdraw consent | Where processing is based on consent, withdraw it at any time | Email privacy@useplotted.ai |
We will respond to all requests within 30 days. We may need to verify your identity before processing requests. If you are located in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority.
8. Cookies and Tracking
Plotted uses a minimal set of cookies and local storage:
- Authentication cookies: Set by Supabase to keep you logged in. Essential — cannot be disabled.
- Analytics (PostHog): We use PostHog in a privacy-first configuration with IP anonymization enabled. PostHog may set a first-party cookie to identify unique sessions.
- Support chat (Crisp): If you open the support chat widget, Crisp may set cookies to maintain your session.
We do not use advertising cookies, third-party tracking pixels, or retargeting scripts. We do not use Google Analytics.
9. Data Security
We take reasonable technical and organizational measures to protect your data:
- All data in transit is encrypted using TLS 1.2 or higher.
- Data at rest in Supabase is encrypted using AES-256.
- Row-level security (RLS) policies in Supabase ensure users can only access their own data.
- API keys and secrets are stored as environment variables, never in code.
- We do not store raw social media credentials — Plotted has no social platform integrations.
- Access to production systems is restricted to the minimum number of people necessary.
No system is 100% secure. If we discover a data breach that affects your personal information, we will notify you within 72 hours of becoming aware of it.
10. International Data Transfers
Plotted is operated from Canada. Our primary infrastructure (Supabase, Vercel, Anthropic) is located in the United States. If you are located in the EU/EEA or UK, your data will be transferred to and processed in countries that may not have equivalent data protection laws to your home country.
Where we transfer data outside of the EU/EEA, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) with our service providers, or transfers to countries covered by an EU adequacy decision.
11. Children's Privacy
Plotted is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us with personal information, please contact us at privacy@useplotted.ai and we will delete that information promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (at the address associated with your account) and update the "Last updated" date at the top of this page. We will give you at least 14 days notice before material changes take effect, during which time you may delete your account if you do not agree with the new terms.
Continued use of Plotted after the effective date of changes constitutes acceptance of the updated policy.
13. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your data:
- Email: privacy@useplotted.ai
- Website: useplotted.ai/privacy
- Response time: We aim to respond to all privacy inquiries within 5 business days.