Controller
The controller responsible for data processing on this website and in the Plenetic service is:
Plenetic GmbH Carlsfund 1F 38723 Seesen Germany
Email: info@plenetic.com
Data We Collect
We process the following categories of personal data:
Contact form: When you use the imprint contact form, we collect your name, email address, and message, and forward them by email to Plenetic to respond to your inquiry (legal basis: Art. 6(1)(b) GDPR — steps prior to a contract / responding to your request, and Art. 6(1)(f) GDPR — legitimate interest in communicating with inquirers).
Account and sign-in: When you create an account or sign in, we process your email address, name, password hash, and session information to provide the service (legal basis: Art. 6(1)(b) GDPR — contract performance). Sessions store your IP address and browser user agent. If you sign in with Google or Microsoft, that provider sends us your name, email address, and account ID. At signup we store which versions of the terms, DPA, and privacy notice were presented and accepted, with the time and a hashed IP address (legal basis: Art. 6(1)(b) and (f) GDPR).
Customer and business content: In the signed-in workspace, customers may store business data (for example contacts, deals, documents, and related records). For that content, the customer organization is the controller. Plenetic acts as a processor under Art. 28 GDPR and processes such data on the customer’s instructions under the data processing agreement. See the “Data processing agreement” section below.
Server logs: Our hosting processes IP addresses, browser/user-agent data, and timestamps as part of standard HTTP request logging. This supports security, troubleshooting, and abuse prevention. Actions by Plenetic platform administrators are logged with the IP address (legal basis: Art. 6(1)(f) GDPR — legitimate interest).
We do not use automated decision-making or profiling that produces legal or similarly significant effects within the meaning of Art. 22 GDPR. No data protection officer is currently appointed; contact the controller for privacy requests.
Cookies and Local Storage
We use cookies and local storage in accordance with TDDDG §25 and GDPR. They fall into three groups:
Necessary
Required for the site and signed-in service to work.
| Name | Purpose | Retention |
|---|---|---|
| plenetic_consent | Remembers your cookie choice | 365 days |
| Auth / session cookies | Keep you signed in | Session |
Optional
Only if you choose “Accept all”.
| Name | Purpose | Retention |
|---|---|---|
| NEXT_LOCALE | Language preference (EN/DE) | 365 days |
| Umami | Aggregated page views on marketing pages | See analytics section |
Workspace UI
Interface preferences in the signed-in app.
| Name | Purpose | Retention |
|---|---|---|
| theme | Light / dark preference (local storage) | Until changed |
| sidebar_state | Sidebar open / closed | 7 days |
You can change your cookie choice anytime via cookie settings in the footer.
Usage Analytics (Umami)
If you choose "Accept all", we load a self-hosted Umami analytics script on our public marketing pages (including the blog) to understand aggregated page views and referrers. Umami runs on our own infrastructure via Elestio on a Hetzner server in Nürnberg, Germany. The tracker is not loaded if you choose "Necessary only" (legal basis: Art. 6(1)(a) GDPR and TDDDG §25 — consent).
Application logs
Application and access logs stay on our AWS hosting. They are not sent to a third-party error-monitoring service. Secrets are redacted before a log line is stored. Access logs are kept for 7 days and application logs for 30 days (legal basis: Art. 6(1)(f) GDPR — legitimate interest).
Hosting and Infrastructure
The Plenetic website and application are hosted on Amazon Web Services (AWS) in the EU region eu-north-1 (Stockholm). AWS processes IP addresses and standard HTTP request data as part of providing the hosting service. Application data is stored in EU-hosted databases and object storage (including AWS S3 for files).
Connected mailboxes and calendars
Users can connect a Google, Microsoft, or Apple account, or a mailbox over IMAP, to read and send email and sync calendars in the workspace. We store the access tokens or credentials the connection needs and synchronize messages and events into the workspace. That content belongs to the customer organization, and Plenetic processes it as a processor under the DPA. The mailbox or calendar provider is the user’s own provider, not a Plenetic subprocessor.
Plenetic’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail and Google Calendar data only to show, search, write, and send the user’s own email and calendar entries in Plenetic, and to answer the user’s own requests to the AI assistant. We do not use it for advertising, do not sell it, and do not use it to train AI models. People at Plenetic do not read it unless the user asks us to for support, it is needed for security, or the law requires it.
AI assistant
When a user uses the AI assistant, the prompt, any attached files, and the workspace data needed for the answer are sent through OpenRouter’s EU API to OpenAI and Azure only, with no fallback to other hosts. Each request sets zero data retention and denies provider data collection. OpenRouter’s data processing agreement commits it to delete those prompts and answers promptly after the response, except for transient processing, abuse detection, and records the law requires, and not to use them for training. OpenRouter does not guarantee OpenAI’s or Microsoft’s own retention. Under OpenRouter’s EU-only addendum, these prompts and answers are processed in the EU/EEA. Voice input is transcribed with Amazon Transcribe, and spoken replies are created with Amazon Polly.
Prompts and answers are kept as operational traces in our self-hosted Langfuse (Elestio on Hetzner servers in Nürnberg) for 14 days and are deleted earlier when the workspace is deleted. Changes the assistant proposes are applied only after a user confirms them, and that confirmation is logged. The assistant tells users that they are talking to an AI. For workspace content, Plenetic acts as a processor under the DPA.
Services loaded in your browser
Some features call external services directly from your browser. Those services receive your IP address and the request itself:
• Address search uses OpenStreetMap Nominatim (OpenStreetMap Foundation, United Kingdom). It receives the address text you type.
• Weather and place search on the dashboard use Open-Meteo (Switzerland). They receive the place you search for or the coordinates of the place you chose.
• Checkout for paid plans uses Stripe. Stripe receives the payment and billing details you enter and sets cookies it needs for payment and fraud prevention.
These calls happen only when you use the feature (legal basis: Art. 6(1)(b) GDPR — providing the feature you use).
Billing
For paid plans, Stripe processes the payment. We receive the billing contact, billing address, VAT ID where given, the plan, and invoice records (legal basis: Art. 6(1)(b) GDPR — contract, and Art. 6(1)(c) GDPR — legal obligation). Invoices and accounting records are kept for 8 or 10 years, as §147 AO and §257 HGB require.
Recipients and Processors
The companies that process personal data for us are listed at /subprocessors: Amazon Web Services (hosting, storage, and transactional email in eu-north-1, plus transcription and speech for voice input), Stripe (payments), OpenRouter, OpenAI, and Microsoft Azure (AI assistant), and Elestio, which runs our Umami analytics and AI traces on Hetzner servers in Nürnberg.
Mailbox and calendar providers that a user connects are that user’s own providers, not our processors. We share data only as needed to operate the service, to comply with law, or on your instruction.
Transfers outside the EU
OpenRouter, Inc. is based in New York. Prompts and answers are sent through its EU API. Its data processing agreement incorporates the EU standard contractual clauses (Art. 46(2)(c) GDPR, Module 2) and an EU-only addendum: those prompts and answers are processed in the EU/EEA and are not intentionally accessed from outside it, except where the law requires it. OpenRouter account and operations data may be processed in the United States under those clauses. OpenRouter is not certified under the EU–US Data Privacy Framework. OpenAI and Azure are reached only through OpenRouter.
Stripe Payments Europe, Ltd. (Ireland) may transfer data to Stripe, Inc. in the United States under the EU–US Data Privacy Framework (Art. 45 GDPR) and standard contractual clauses. If you sign in with Google or Microsoft, those providers transfer data to their US parent companies under the Data Privacy Framework.
The OpenStreetMap Foundation (United Kingdom) and Open-Meteo (Switzerland) are in countries with an EU adequacy decision (Art. 45 GDPR). Hosting, storage, analytics, and AI traces run on servers in the EU.
Data processing agreement (AVV / DPA)
Where Plenetic processes personal data on behalf of a customer organization in the signed-in workspace, Plenetic acts as a processor under Art. 28 GDPR. The Data Processing Agreement at /dpa is part of the contract and is concluded when the customer accepts the Terms of Service. The subprocessors are listed at /subprocessors.
Retention
We keep personal data only as long as needed for the purposes above:
• Account and workspace data: for the contract, then 30 days so the customer can export them. The workspace is then deleted.
• Sessions: 7 days after the last activity.
• Database backups: 30 days.
• Access logs: 7 days. Application logs: 30 days.
• AI traces: 14 days, or earlier when the workspace is deleted.
• AI confirmation log and administrator audit log: 12 months.
• Acceptance records: for the contract and 3 years after it ends, the regular limitation period (§195 BGB).
• Billing records and invoices: 8 or 10 years (§147 AO, §257 HGB).
• Contact requests: not stored in the database. The only copy is the notification email.
Umami does not set cookies and does not store IP addresses.
Do you have to provide data?
You need to give your name and email address to create an account, request access, or get an answer to a contact request. Without them we cannot provide the service or reply. Everything else is optional. There is no legal obligation to provide personal data to us.
Your Rights
Under the GDPR, you have the right to:
• Access (Art. 15) — Request a copy of your personal data.
• Rectification (Art. 16) — Request correction of inaccurate data.
• Erasure (Art. 17) — Request deletion of your data in certain circumstances.
• Restriction (Art. 18) — Request limitation of processing in certain cases.
• Data portability (Art. 20) — Receive your data in a structured, commonly used format.
• Withdraw consent (Art. 7(3)) — Withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing before it.
Your right to object is set out separately below. To exercise these rights, contact us at info@plenetic.com.
Right to object (Art. 21 GDPR)
Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), for example server logs or acceptance records, you have the right to object at any time on grounds relating to your particular situation. We then stop that processing unless we can show compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed to establish, exercise, or defend legal claims. We do not use your data for direct marketing. To object, write to info@plenetic.com.
Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Plenetic GmbH is:
Die Landesbeauftragte für den Datenschutz Niedersachsen (LfD Niedersachsen) Prinzenstraße 5 30159 Hannover Germany
Website: www.lfd.niedersachsen.de
Contact
For questions about this privacy policy or to exercise your rights, please contact us at info@plenetic.com or by post at the address above.