Privacy Policy

Basic data protection information

Controller: REDACTALO AI, S.L. (Ploot). Tax ID B22721260.

Contact: C/ Lepant, 270, 08013 Barcelona, Spain. team@ploot.ai.

Purposes: managing the website, requests, the commercial and contractual relationship, accounts, delivery of the service, billing, support, security, analytics and Ploot's communications. When Ploot processes data on behalf of its customers, it provides the contracted features in accordance with their instructions.

Legal basis: performance of a contract or pre-contractual measures, compliance with legal obligations, consent and legitimate interest, depending on the purpose set out in this policy.

Recipients and international transfers: providers that supply services to Ploot, authorities and other third parties where there is a legal obligation or it is necessary to manage the relationship. Some providers involve international data transfers, to which the safeguards provided for in the GDPR apply.

Rights: access, rectification, erasure, objection, restriction, portability, withdrawal of consent and, where applicable, the right not to be subject to automated decisions.

Additional information: full information is set out in the sections below, including information on artificial intelligence, visit analytics, cookies and Ploot Extension.

Introduction

In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation, and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights, this policy explains how REDACTALO AI, S.L. collects, uses and protects personal data relating to Ploot.

It applies to the Ploot website, applications and platform, as well as to commercial, contractual and support relationships. It may be supplemented by specific notices included in certain forms, features or communications.

Ploot processes data lawfully, fairly and transparently, for specified purposes, applying the principles of data minimisation, accuracy, storage limitation and security.

1. Data controller

Controller: REDACTALO AI, S.L. (Ploot).

Tax ID: B22721260.

Address: C/ Lepant, 270, 08013 Barcelona, Spain.

Privacy contact: team@ploot.ai

2. When Ploot acts as controller and when as processor

Ploot acts as controller for the data needed to manage its website, information requests, its commercial activity, contractual relationships, user accounts, billing, support, security, its own analytics and its communications.

When an organisation uses the platform to process content, documents, data about its members, professional profiles, leads, messages, posts, audio, transcripts, visits to its website or other information for its own purposes, that organisation determines the essential purposes and means of the processing. In these cases the customer acts as controller and Ploot as processor, in accordance with documented instructions and the applicable data processing agreement.

The customer must have a valid legal basis, inform the people concerned and use the platform lawfully. Providers that help deliver the service may act as Ploot's sub-processors.

3. How we obtain data

Personal data may come from:

• The data subject directly, when contacting Ploot, requesting a demo, booking a meeting, purchasing, creating an account, using the platform, taking part in an interview or call, requesting support or otherwise communicating with Ploot.

• The customer organisation or other authorised users, when they create accounts, add members, upload content or configure integrations and features.

• Authentication services, social networks and connected accounts, such as Google or LinkedIn, when the user authorises the connection and the corresponding permissions.

• Public and professional sources, LinkedIn profiles and posts, integrations enabled by the user and providers that obtain or enrich professional information.

• Automatically, through cookies and similar technologies, usage events, metrics and technical logs, in accordance with the applicable settings and consent, and through the recording of visits to ploot.ai or to customer websites that use Ploot's visit analytics.

Where Ploot obtains data indirectly and acts as controller, it will provide the information required by law. Where data is obtained on behalf of a customer, it is the customer's responsibility to comply with the duty to inform.

Fields marked as mandatory and data needed to process a request, purchase, create or manage an account, bill, authenticate access or use a feature must be provided for Ploot to manage the relationship or deliver the service. Failure to provide such data may prevent Ploot from handling the request, completing the purchase or enabling the relevant feature. Optional data may be omitted, subject to any features that depend on it.

4. Personal data we process

Depending on the relationship and the features used, Ploot may process the following categories of personal data:

Identification, contact and account data: first name, last name, email address, photograph, language, role, organisation, authentication data, session identifiers and permissions associated with connected accounts.

Commercial and contractual data: company, job title, details of representatives and contact persons, requests, bookings, communications, plan, subscription and relationship history.

Billing and payment data: tax and billing details, customer references, payment status, charges, refunds and other accounting information. Ploot does not store full card numbers.

Usage, browsing and security data: IP address, device, browser, language, cookies, usage events, timestamps, access logs, incidents, errors, logs, metrics and, where consent has been given, session recordings.

Website visit data: IP address, page visited, referring page, browser type and the organisation or company inferred from the IP address.

Content and knowledge sources: texts, instructions, documents, URLs, posts, calendars, preferences, brand kits, strategies and other information added to the service.

Voice, audio and image data: audio, live voice, interviews, calls, transcripts, photographs and base images. Photographs used in Photo AI are not used to biometrically identify the person.

LinkedIn, profile and lead data: name, job title, company, professional profile, posts, reactions, comments, metrics, visits, contact history, invitations, messages, emails, replies and data obtained through enrichment or analysis features.

5. Processing carried out by Ploot as controller

The purposes for which Ploot processes data as controller and the legal bases for that processing are explained separately below.

5.1. Purposes of processing

Ploot will process data only for the purposes set out below, applying the principle of data minimisation:

Contact, demos and support: handling enquiries, commercial requests, bookings, incidents and communications.

Account and service delivery: creating and managing accounts, authenticating access, managing roles, organisations, plans, features and integrations.

Purchasing, payments and billing: managing subscriptions, charges, refunds, invoices and administrative, tax and accounting obligations.

Operational communications: sending verifications, password resets, reminders, reports, service changes and security notices.

Ploot's commercial activity: managing opportunities, professional contacts, meetings and its own sales calls, including recording, transcribing or analysing them where people have been informed in advance.

Commercial communications: sending promotional information about Ploot's products or services and managing preferences and unsubscribe requests.

Analytics and improvement: measuring usage, compiling statistics, understanding how the service works and improving its features.

Visit analytics and company detection: learning which organisations visit ploot.ai from the IP address, as described in section 5.3.

Security and misuse prevention: controlling access, protecting processes and integrations, detecting errors, investigating incidents and preventing fraud or abuse.

Legal obligations and claims: handling data subject rights, requests from authorities and legal obligations, and bringing, exercising or defending claims.

Suppliers and partners: managing contacts, contracts and operations with Ploot's suppliers and partners.

5.2. Legal bases

The applicable legal basis depends on the specific purpose and the relationship with the data subject:

Contact, requests, demos and support: pre-contractual measures requested by the data subject or performance of a contract, Article 6(1)(b) GDPR. Where there is no direct contractual or pre-contractual relationship, Ploot's legitimate interest in handling and managing the enquiries and communications it receives, Article 6(1)(f) GDPR.

Account and service delivery: performance of a contract or pre-contractual measures, Article 6(1)(b) GDPR, where the data subject purchases the service directly. Where the account belongs to a user authorised by a customer organisation, the legitimate interest of Ploot and the organisation in managing access, delivering the contracted service and maintaining the security and operation of the platform, Article 6(1)(f) GDPR.

Purchasing, payments and billing: performance of a contract, Article 6(1)(b) GDPR, and compliance with legal tax, accounting and administrative obligations, Article 6(1)(c) GDPR.

Operational communications: performance of a contract, Article 6(1)(b) GDPR, and Ploot's legitimate interest in keeping users informed about the operation, security and changes of the service, Article 6(1)(f) GDPR.

Ploot's commercial activity: pre-contractual measures, Article 6(1)(b) GDPR; consent, Article 6(1)(a) GDPR, where necessary; and Ploot's legitimate interest in managing opportunities and developing B2B commercial relationships, Article 6(1)(f) GDPR. Sales meetings and calls, including any recording, transcription or analysis, will be processed on these legal bases where participants have been informed in advance and the processing is legally appropriate.

Commercial communications: consent, Article 6(1)(a) GDPR, or a prior contractual relationship for similar own products or services under Article 21(2) of the Spanish Information Society Services Act (LSSI), always offering a simple, free way to opt out.

Analytics and improvement: Ploot's legitimate interest in carrying out strictly technical analytics, compiling statistics and improving the service, Article 6(1)(f) GDPR. For cookies, session recordings and other non-essential technologies, consent, Article 6(1)(a) GDPR and applicable cookie rules.

Visit analytics and company detection: Ploot's legitimate interest in learning which organisations are interested in its services, Article 6(1)(f) GDPR.

Security and misuse prevention: Ploot's legitimate interest in protecting its systems, services, users and integrations, detecting errors, investigating incidents and preventing fraud or abuse, Article 6(1)(f) GDPR. Where applicable, compliance with legal obligations, Article 6(1)(c) GDPR.

Legal obligations and data subject rights: compliance with legal obligations, Article 6(1)(c) GDPR.

Claims: Ploot's legitimate interest in bringing, exercising or defending claims, Article 6(1)(f) GDPR.

Suppliers and partners: performance of a contract or pre-contractual measures, Article 6(1)(b) GDPR, where the data subject is party to the relationship. Where data of representatives, employees or contact persons of an organisation is processed, Ploot's legitimate interest in managing and maintaining the professional relationship, Article 6(1)(f) GDPR.

5.3. Visit analytics and company detection

On ploot.ai we use our own analytics system that records the pages visited, the referring page, the browser type and the IP address used to access the site. We do not place cookies or any other identifier on your device for this purpose.

The IP address is used to infer the organisation or company from which the site is being browsed. To do so, public internet address allocation registries are queried first and, where they do not allow identification, the specialist provider Albacross, which processes the IP address as a processor. For limited periods we may also use other visiting-company identification providers for the same purpose and in the same capacity; where they place cookies or identifiers on your device, they are listed in the Cookie Policy.

We do not identify the specific person visiting the website or build individual browsing profiles. Based on the company identified, Ploot may consult professional sources to find profiles at that company relevant to its services, without linking them to the visit.

The IP address is kept for a maximum of 7 days and then replaced with a pseudonymised value. The legal basis is Ploot's legitimate interest, Article 6(1)(f) GDPR. You can object to this processing by writing to team@ploot.ai.

6. Processing carried out on behalf of customers

Ploot also provides services in which it processes personal data following its customers' instructions. The scope depends on the features each customer enables and the information it adds to or connects with the platform.

Content and knowledge: creating, scheduling or publishing content and managing texts, documents, URLs, knowledge sources, embeddings, strategies and reports.

AI, image and voice: generating or editing texts and images, using Photo AI, processing interviews, audio, calls and transcripts and providing summaries, analyses or recommendations.

LinkedIn and metrics: connecting accounts, publishing authorised content, obtaining profiles, posts and metrics and displaying information related to professional activity.

Leads and messaging: obtaining, enriching, organising or classifying leads, preparing or sending invitations, messages and emails from the accounts connected by the user, managing replies and keeping the contact history.

Website visit analytics: recording visits to the customer's website where the customer installs Ploot's analytics and identifying, from the IP address, the organisation from which the site is browsed. The IP address is kept for a maximum of 7 days and then pseudonymised.

Teams and workspaces: managing users, organisations, agencies, permissions, calendars, settings and shared resources.

In these cases the customer decides the purpose of the processing and its legal basis. Ploot uses the data only to deliver the service, applies the agreed measures and assists the customer in meeting its obligations. If a person exercises a right regarding data processed on behalf of a customer, Ploot may forward the request to that customer or help it respond.

7. Artificial intelligence and automated features

Ploot uses specialist providers of artificial intelligence, image generation, embeddings, transcription and voice to deliver the requested features, including Anthropic, OpenAI and Google (artificial intelligence and image generation), Deepgram (transcription), LiveKit (real-time audio) and Microsoft and Amazon Web Services (speech synthesis). Depending on the feature used, texts and instructions, posts, documents, knowledge sources, audio, transcripts, images, company information, professional profiles, messages or replies may be sent. Information is limited to what is needed to perform the operation.

Ploot does not use its customers' content to train general-purpose models of its own or of third parties. Providers involved in these features will process the information only to deliver the requested service and under the applicable contractual terms.

Classification, prioritisation, recommendation and generation features support the user. Some run automatically according to the settings chosen by the customer: scoring profiles against the ideal customer may discard those below the threshold, reply classification determines how a sequence continues and, once the user launches a campaign, the planned messages, follow-ups and emails are sent without individual review of each one, including those drafted or adapted with artificial intelligence. No profile is added to a campaign unless the user has accepted it beforehand.

Ploot does not on its own account take decisions based solely on automated processing that produce legal effects concerning a person or similarly significantly affect them. The customer decides how these features are configured and remains responsible for reviewing and using the results in line with the purpose of the service, especially before publishing content, contacting third parties or taking decisions that may affect people.

Where applicable, Ploot will adopt the transparency measures required by Regulation (EU) 2024/1689 according to its role in each feature. Certain features or content may include notices or technical mechanisms to inform people that they are interacting with artificial intelligence systems or to identify content generated or manipulated by artificial intelligence. Customers must meet the obligations that apply to them regarding the use and publication of the results.

8. Recipients and providers

To fulfil the purposes described, data may be disclosed or made available to the following recipients:

• Public authorities and courts. Ploot will disclose data when a competent authority requires it or where there is a legal obligation.

• Service providers. Ploot uses providers of hosting, infrastructure, databases, storage, authentication, email, payments, support, analytics, visiting-company identification, professional data enrichment, security, artificial intelligence, image generation, transcription, voice and integrations. These providers will process only the data needed to provide their services.

• Financial institutions and advisers. Data may be provided to payment institutions, advisers, auditors or other professionals where necessary to manage the contractual, accounting or legal relationship.

• Corporate transactions. In the event of investment, restructuring, acquisition or transfer of the business, data may be provided to the parties involved with the appropriate confidentiality and data protection safeguards.

Ploot will select providers that offer adequate guarantees and will put in place the required processing terms. When acting as processor, it will keep the applicable list of sub-processors identified in accordance with the contract with the customer. The list of providers and their locations can be requested by writing to team@ploot.ai.

9. International transfers

Some providers process data outside the European Economic Area or provide services from third countries. In particular, the platform's main database and several of the artificial intelligence and transcription providers provide their services from the United States.

Where there is an international transfer, Ploot will apply the safeguards provided for in the GDPR, such as an adequacy decision, the EU–US Data Privacy Framework where applicable, standard contractual clauses or another valid mechanism. Where necessary, Ploot will also apply supplementary technical, contractual or organisational measures.

Data subjects may request further information about transfers and the safeguards applied by writing to team@ploot.ai.

10. Retention

Personal data will be kept only for as long as strictly necessary to fulfil the purposes for which it was collected. It may then be kept blocked for the periods during which legal or contractual liability may arise, and will be erased or anonymised when no longer needed.

Data linked to an account, a contractual relationship or a request will be kept while the relationship remains active or as long as needed to handle it. Data used for commercial purposes will be kept until the person objects, withdraws consent or it is no longer needed. Tax, accounting and contractual documentation will be kept for the legally required periods.

Where Ploot processes data on behalf of a customer, retention, return, erasure or anonymisation will follow the customer's instructions and the applicable contract. Technical periods of providers, backups and logs will be configured in a limited way proportionate to their purpose.

Call recordings and transcripts will be kept only for as long as necessary for the purpose communicated or, where Ploot acts as processor, in accordance with the customer's instructions and the applicable contract.

IP addresses recorded by visit analytics will be kept for a maximum of 7 days and then replaced with a pseudonymised value.

Technical and security logs will be kept for limited periods proportionate to their purposes of preventing, detecting, investigating and resolving incidents.

Data associated with cookies and similar technologies will be kept for the periods stated in the Cookie Policy or until consent is withdrawn, as applicable.

Erasure from active systems may be completed progressively in backups and technical deletion cycles. During that period the data will remain protected and will not be used for ordinary purposes.

11. Security

Ploot applies technical and organisational measures appropriate to the risk to protect data against destruction, loss, alteration, disclosure or unauthorised access. Measures are reviewed when features, architecture or identified risks change.

Among other measures, Ploot applies role-based access controls and permissions, strong authentication for administrative functions, password and session protection, encryption in transit and at rest, environment separation, secrets management, backups and recovery mechanisms. Access is limited to authorised persons bound by confidentiality obligations.

Ploot applies logging and monitoring mechanisms and will take measures to detect, manage and respond to security incidents. It will also review the security of its integrations and providers. No system guarantees absolute security, so measures are adapted to the state of the art, the nature of the data and existing risks.

12. Data protection rights

Where Ploot acts as controller, data subjects may exercise the following rights free of charge:

• Access. Obtain confirmation of whether Ploot processes their personal data and, if so, access it and the information provided for by law.

• Rectification. Request correction of inaccurate data or completion of incomplete data.

• Erasure. Request deletion of data where any of the circumstances provided for by law apply.

• Restriction of processing. Request that processing be restricted, for example while the accuracy of the data is checked or an objection is resolved.

• Portability. Receive the data provided to Ploot in a structured, commonly used and machine-readable format and transmit it to another controller where applicable.

• Objection. Object to processing based on legitimate interest on grounds relating to their particular situation and, at any time, to the use of their data for direct marketing.

• Automated decisions. Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, except where permitted by law.

• Withdrawal of consent. Withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise these rights, write to team@ploot.ai stating the right you wish to exercise. Ploot may request the information needed to verify your identity where there are reasonable doubts.

If the request concerns data processed on behalf of a customer, Ploot may forward it to the responsible customer or assist it in responding.

If you consider that the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, or at www.aepd.es.

13. Minors and special categories of data

Ploot's services are aimed at businesses, professionals and adults authorised by an organisation, and are not intentionally offered to minors. If Ploot detects that it has received data from a minor without a valid basis, it will take reasonable steps to delete it.

The platform is not designed to process data concerning health, political opinions, trade union membership, religion, sexual orientation, racial or ethnic origin, genetic data or biometric data intended to uniquely identify a person. These categories should not be added unless there is a justified need, a valid legal basis and express contractual authorisation.

15. Ploot Extension

15.1. Purpose and operation. Ploot offers an optional browser extension that complements certain platform features related to LinkedIn. The extension allows professional information and metrics to be synchronised, content activity and performance to be analysed, and certain Ploot features to be used from the browser.

The extension only operates once installed and enabled by the user and within the sites and contexts needed to provide the features described. It does not access browsing outside LinkedIn.

15.2. Data processed. Depending on the features used, the extension may process:

• Professional profile information accessible from the user's LinkedIn session, such as name, photograph, headline, company, profile URL, follower count and other visible professional information.

• Information about posts, such as their text, date, URL, associated images or videos, reactions, comments, reposts and other engagement metrics.

• Metrics available for the user's own posts or profile, such as impressions, reach, profile views or historical trends.

• Professional information about visited profiles when the user expressly uses a Ploot feature that requires obtaining or synchronising that data.

• Technical data needed for the extension to work, such as version and settings, the extension's technical identifier, browser, timestamps, error logs and temporary cache data.

• Technical or session identifiers strictly necessary for the extension to operate within the authenticated LinkedIn session.

Ploot does not request or store the LinkedIn password. The extension does not access browsing outside LinkedIn or the user's private messages.

15.3. Purposes and roles of the parties. Data will be used to connect the extension to the Ploot account, synchronise the requested information, display metrics, provide professional analysis features, maintain the service, resolve errors and protect the security of the extension and the platform.

Ploot will act as controller for the data needed to manage the account, authenticate the user, configure and protect the extension, provide support and technically analyse its operation.

When an organisation uses Ploot Extension to process professional data, profiles, posts, metrics or third-party information for its own purposes, that organisation will act as controller and Ploot as processor, under the applicable data processing agreement.

15.4. Legal bases. Where the user purchases the service directly, providing the requested features will be based on performance of a contract or pre-contractual measures. Where the extension is used as an authorised user of a customer organisation, processing will be based on the legitimate interest of Ploot and that organisation in providing and using the contracted service, managing access and maintaining its security and operation.

Processing strictly necessary to protect the extension, prevent misuse, diagnose errors and ensure the security of the service is based on Ploot's legitimate interest.

Optional technologies or processing not necessary to provide the service will be based on consent where required.

Where Ploot processes data on behalf of a customer organisation, it is for that organisation to determine the applicable legal basis, provide the necessary information to the people concerned and ensure its instructions are lawful.

15.5. Storage and disclosure of data. Certain information may be processed temporarily in the browser to allow the extension to work. Where necessary to provide the requested features, data will be transmitted to Ploot's systems and to the infrastructure, hosting, security and technical support providers acting on Ploot's behalf.

Providers that may receive data from the extension will be identified, as appropriate, in the contractual documentation, the data processing agreement or the up-to-date list of providers that Ploot makes available to its customers. Further information can be requested by writing to team@ploot.ai. Any international transfers will take place in accordance with section 9 of this Policy.

15.6. Retention. Technical or session identifiers will be kept only while necessary to maintain the connection and provide the requested feature.

Data stored temporarily in the browser cache will be deleted or overwritten through the ordinary operation of the extension.

Metrics and other information synchronised with the platform will be kept while the account or integration remains active and, afterwards, for as long as needed to complete their deletion, handle requests or meet legal obligations.

Where data is processed on behalf of a customer, it will be kept and deleted in accordance with the customer's instructions and the applicable data processing agreement.

15.7. User control. The user may stop synchronising information, disconnect their LinkedIn account, disable the extension or uninstall it from the browser.

Uninstalling prevents the extension from obtaining further information but does not by itself automatically delete data already synchronised with the platform. Deletion of that data can be requested through the account settings or by exercising the rights described in section 12.

15.8. Limited use of data. Information obtained through Ploot Extension will be used only to provide, maintain, protect and improve the features of the extension and the platform directly related to the service requested by the user.

Ploot will not sell data obtained through the extension or use or transfer it for personalised advertising, credit profiling, resale of information or purposes unrelated to the communicated operation of the extension.

Human access to this data will be limited to cases necessary to provide support requested by the user, investigate security issues or misuse, comply with legal obligations or work with previously aggregated or anonymised information.

Data processing through Ploot Extension will comply with the Chrome Web Store User Data Policy, including its Limited Use requirements. Extension-specific information is available in the Ploot Extension Privacy Policy.

16. Changes to this policy

Ploot may update this Privacy Policy to reflect regulatory, technical or service changes. The current version will be permanently available through the appropriate channels. Where changes significantly affect data subjects, they will be communicated by reasonable means before they take effect. Where new processing requires consent, Ploot will request it before starting.