Privacy policy for buyers of partner plugins

This policy is for you if you bought a plugin from one of our partner brands and use the account, licences, installer, downloads, updates or support we provide for it. If you create plugins on pluginmaker.ai, our main privacy policy applies instead.

1. Who we are

PLUGINMAKER.AI sp. z o.o., os. Piastowskie 94/26, 61-162 Poznań, Poland (KRS 0001238740, NIP 7822969104). We run The Plugin Studio and pluginmaker.ai.

The brand sells you the plugin. We provide your account, licences, the installer, downloads, updates and technical support. For this we are an independent controller of your personal data: we decide how it is used, as described here. The brand is a separate controller for the sale and for the data it sees about you (section 5), under its own privacy notice.

Contact: privacy@pluginmaker.ai.

2. What data we use and where it comes from

• From the brand’s store, or from the brand directly: your email address, your order number and the plugins you bought.
• From you: your email address, your password (we store only a secure hash of it), your name if you give it, your support messages and any screenshots you attach.
• From your computer, through the installer and the plugins: an identifier of your computer (we store only a one-way hash of it), the operating system and its version, the installer and plugin versions, your IP address and browser or device type, and a record of your sign-ins and licence activations.
• Only if you agree: crash reports and diagnostic data from the installer and the plugins, installer usage data, and the device details you choose to share in a support chat.

You need to give us your email address to get an account and a licence. Without it we can’t provide the plugin’s licence.

3. Why we use it, and on what legal basis

• Your account and what you bought: the account, licences and computer activations, downloads, updates, sign-in codes and support. Basis: providing the account, licences and service you signed up for (GDPR Art. 6(1)(b)).
• Security and abuse prevention: sign-in and activation records, limits on repeated attempts, checks that a free trial is used only once per account and computer, preventing licence fraud and piracy, and handling legal claims. Basis: our legitimate interest in protecting our service, our partners’ plugins and our users (Art. 6(1)(f)).
• Running and improving our service with AI agents (section 4): answering support, finding and fixing errors, and running our operations. Basis: our legitimate interest in providing and improving our service efficiently with a small team (Art. 6(1)(f)).
• Crash reports, diagnostics, installer usage data and analytics cookies. Basis: your consent (Art. 6(1)(a)). You can withdraw it at any time in the installer’s settings or the cookie settings. This doesn’t affect what happened before.

4. AI agents

We do much of our work with AI agents: Claude from Anthropic, and ChatGPT and Codex from OpenAI. They work inside our systems and can access the data we hold about you: your account details (email address and name), your licences and computers, your purchases and trials, your sign-in and activation records (with IP address and device type), your support conversations and screenshots, and the crash reports and diagnostic data you agreed to share.

We use them to answer support, find and fix problems, and run and improve our service.

Anthropic Ireland, Limited and OpenAI Ireland Limited receive this data, and it then goes to the United States (sections 5 and 6). You can object to this use of your data (section 8).

5. Who receives your data

• The brand you bought from. In its dashboard it sees your email address, when you signed up and last signed in, your computers and licence activations (with IP address and device type), your purchases and trials and, if the brand answers support, your support conversations. It can sign you out and remove a computer from your licence. The brand uses this data as a separate controller.
• Our service providers, who handle data for us: OVHcloud (servers, EU), Neon (database, EU), Cloudflare (file storage and downloads), Vercel (these web pages), Amazon Web Services (licence signing), Resend (account emails), Sentry (error and crash reports), Google Workspace (support email), Slack and Linear (our support team’s tools), and Plausible and PostHog (website statistics).
• OpenAI and Anthropic (AI agents and tools, section 4). The data goes to OpenAI Ireland Limited and Anthropic Ireland, Limited, which receive it under their own terms and privacy policies (OpenAI’s and Anthropic’s) and then move it to the United States.
• Courts and authorities, when the law requires it.

We don’t sell your personal data.

6. Transfers outside the European Economic Area

OpenAI and Anthropic receive the data in Ireland and move it to the United States, so it leaves the European Economic Area. They do so under their own safeguards, described in their privacy policies (section 5). Some of our other service providers are US companies and may process data in the United States, under the safeguards in their data protection terms with us. You can ask us for details.

7. How long we keep it

• Account, licences, computers and purchases: as long as your account exists. When you ask us to delete your account, we delete them.
• Records of free trials: as long as the plugin is offered, so a trial can’t be started twice.
• Sign-in and licence-activation records (with IP address and device type): as long as your account exists.
• Sign-in codes: valid for 15 minutes, deleted within a week after that.
• Installer sign-ins: end after 90 days without use, or after one year at most, and are deleted 30 days after they end.
• Support conversations and screenshots: 12 months after the last message, or sooner if you ask.
• Our servers’ request logs: 30 days.
• Crash reports and diagnostics you agreed to: installer diagnostic logs 30 days, crash reports up to 90 days.

8. Your rights

You can ask us for access to your data, a copy of it in a common format, its correction or deletion, or a restriction of its use. Where we rely on your consent, you can withdraw it at any time. Write to privacy@pluginmaker.ai. We reply within one month.

Your right to object

You can object at any time to our use of your data based on our legitimate interests, including our use of AI agents (section 4). Write to privacy@pluginmaker.ai or say so in a support message. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data for legal claims.

Complaints

You can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or to the data protection authority in the EU country where you live or work. If you live in the United Kingdom, you can also complain to the UK’s Information Commission (ICO, ico.org.uk).

9. Automated checks

We don’t make decisions about you based only on automated processing that have legal or similarly significant effects. Automatic checks can stop a free trial from starting, for example with a throwaway email address or after too many attempts. If that happens to you, contact us.

10. Age and changes

Accounts are for people aged 16 or older. When we change this policy, we update the date at the top.