Privacy Policy

Who we are

Plimo ("Plimo", "we", "us") runs the Plimo website and services and is responsible for the personal data described in this policy. You can contact us about privacy at support@plimo.ai.

What we collect

Data	Where it comes from
Name, email address and profile picture	Your Google account, if you sign in with Google
Email address	You, if you sign in with an email code
IP address and language when you create your account	Your browser
The country your IP address points to when you create your account, as a two-letter code	Worked out by us from your IP address
Where you first came to Plimo from: the source, medium and campaign named in the link you followed (for example utm parameters or an ad click), the website you came from (its domain only) and the first page you opened. It is saved with your account if you sign up within 30 days	Your browser, through the `plimo.attr` cookie
A device fingerprint: a code your browser calculates from its own and your device's settings, such as screen, fonts and graphics features, and sends when you sign in with an email code. We store it only when that sign-in creates a new account, and we store only the code, not the settings	Your browser
IP address and browser information (user agent) each time you sign in, stored with your sign-in session	Your browser
Photos and files you upload, prompts you write, images and videos you create	You
Credit balance and records of your generations (model, settings, status, credits used)	Created when you use Plimo
Your plan and records of your payments, refunds and chargebacks (amount, date, status). You enter your card details on Stripe's payment page, and we never see your full card number	Stripe, when you pay
Emails you send to support and our replies	You
Records of content checks that rejected a request or could not be completed, including the prompt involved	Created when you use Plimo
Basic technical logs, such as request times and error messages	Created when you use Plimo
Analytics data: pages you visit, clicks and other actions on the site, the type of device and browser you use, your screen size, your approximate location and the website you came from. Yandex Metrica also records session replays and click maps (see Analytics)	Your browser, through Google Analytics and Yandex Metrica

We work out the country with an IP location database stored on our own servers, so your IP address isn't sent to anyone for this. IP geolocation by DB-IP, licensed under CC BY 4.0.

We don't ask for sensitive information, and we ask you not to upload it.

How we use it and why

Purpose	Legal basis
Create and run your account, sign you in, generate your images and videos, keep your credit balance and history	Performance of a contract with you (these terms)
Take payments, run your subscription, add the credits you paid for, and handle refunds and chargebacks	Performance of a contract with you
Answer your support emails	Performance of a contract with you
Prevent abuse, such as duplicate accounts collecting trial credits, and keep Plimo secure. For this we compare a new account's device fingerprint and IP address with accounts created in the previous 24 hours and its email address with existing accounts, and we use Cloudflare Turnstile to check that a person, not a bot, is asking for an email sign-in code	Our legitimate interests in protecting Plimo and its users
Check your prompts and uploads against our Content Policy before anything is generated	Our legitimate interests in keeping Plimo safe and lawful
Understand how people find and use Plimo and improve it: visitor statistics, session replays and click maps, and which websites, campaigns and countries sign-ups and payments come from	Our legitimate interests in understanding and improving Plimo
Enforce our Terms of Service and Content Policy	Our legitimate interests
Comply with legal obligations	Legal obligation

We do not use your content to train AI models.

Who processes your data

We use these service providers to run Plimo. They process personal data on our behalf, only for the purposes below.

Provider	What they do for Plimo
Google	Google sign-in; Gmail for sending and receiving support emails; Google Analytics for visitor statistics
Yandex	Yandex Metrica for visitor statistics, click maps and session replays. Text typed into input fields is masked in replays
Supabase	Database
Railway	Servers that run Plimo
Cloudflare	DNS, file storage and content delivery (R2), forwarding of support emails; Turnstile, which checks that a person, not a bot, is asking for an email sign-in code
Resend	Sending sign-in code emails and support replies
Stripe	Payments: the checkout page, card payments, subscriptions, refunds and payment receipts. Stripe receives your email address and the payment details you enter. It also uses payment data under its own privacy policy, for example to prevent fraud
OpenAI and Sightengine	Automatic content checks. When you upload a photo or video, a copy of it (for a video, still frames taken from it) is sent to one of them, normally OpenAI, to check it against our Content Policy. When you start a generation, your prompt may be sent for the same check
Third-party AI model providers	Running the AI models that generate your images and videos. Each request goes only to the provider that runs the model you chose

To create an image or video, we send your prompt, settings and any photos you uploaded to the AI model provider that runs the model you chose. These providers process this data under their own terms and privacy policies, which may allow them to keep it for a limited time, for example to prevent abuse. Our promise not to use your content for training applies to Plimo; we can't control what each provider does beyond its terms.

Analytics

Plimo uses Google Analytics and Yandex Metrica to see how the site is used: which pages are visited, what is clicked, which devices and browsers are used, roughly where visitors are (worked out from their IP address) and which websites they came from. We use this to understand which pages and features work and to improve Plimo.

Yandex Metrica also records session replays and click maps. A replay shows the page as you saw it, with mouse movements, clicks and scrolling. Everything typed into input fields, such as prompts, email addresses and sign-in codes, is masked and not recorded, and so are prompts, names and email addresses shown on the page. Images and videos shown on the page, such as your uploads and creations, may appear in replays. Google and Yandex also process analytics data under their own terms and privacy policies.

We don't send your prompts, your email address or your account ID to Google Analytics or Yandex Metrica.

Analytics isn't needed for Plimo to work. To block it, see Your rights.

International transfers

Our providers store and process data in the United States and other countries, which may have different data protection laws from where you live. When personal data is transferred from the European Economic Area, the United Kingdom or Switzerland, we rely on the safeguards each provider offers in its data processing terms, such as the European Commission's standard contractual clauses. Where a provider does not offer such terms, the transfer is governed by that provider's own terms.

How your creations are stored

Your uploads and creations are stored in public cloud storage so they can be shown in your browser quickly. Each file has a long, random address that can't be guessed, and it isn't listed anywhere. However, anyone who has the address of a file can open it, so be careful where you share links.

How long we keep data

Each creation is kept for a period set when you create it: 7 days without an active subscription, 30 days on Plus, 90 days on Pro and 360 days on Ultra. When that period ends, it disappears from your list and its file is removed from storage shortly after.
When you delete a creation, it disappears from your list right away and its file is removed from storage shortly after. Copies cached by our content delivery network can stay reachable at the old address for up to a day. We keep a record of the generation (without the file) for accounting.
Photos you uploaded are not deleted together with a creation, because they can be reused for other creations. They are kept until your account is deleted.
Sign-in codes are stored only as a one-way hash and expire after 10 minutes.
Account data and your content are kept until you delete your account, unless the law requires us to keep them longer. What we keep after that is described at the end of this list.
Payment notifications that Stripe sends us, which include details such as your email address and the last four digits of your card, are usually kept for 13 months. This lets us look into a payment question across a full yearly billing period.
Support emails are kept as long as needed to help you and keep a record of our conversation.
Photos and videos that fail a content check are not kept. Records of content checks that rejected a request or could not be completed, including the prompt involved, are kept until your account is deleted.
Your device fingerprint is kept with your account until it is deleted. The country worked out when you created your account and where you first came to Plimo from are kept as described below. The plimo.attr cookie itself lasts 30 days.
Google Analytics keeps event data for 14 months. Yandex Metrica keeps statistics and session replays for the periods Yandex sets for its service.
When you delete your account, we sign you out on every device, cancel your subscription right away, delete your creations, uploads and prompts, and remove your name, email address, profile picture, IP address and device fingerprint from your account. Files are removed from storage shortly after, and copies cached by our content delivery network can stay reachable at the old address for up to a day. For accounting, tax, chargeback handling, statistics and preventing abuse, we keep the following, no longer linked to your email address, name or IP address: records of your payments, orders, refunds and chargebacks; your plan history and credit history; generation costs (model, time and cost, without prompts or files); the country and source you signed up from; and a one-way hash of your email address, so that signing up again with it doesn't give you trial credits again. Stripe keeps its own payment records under its privacy policy.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, and to object to or restrict how we use it. You also have the right to complain to your local supervisory authority (data protection authority).

You can delete your account yourself at any time: open the account menu with your profile picture at the top right of the page (on a phone, open the menu first), choose Delete account and type your email address to confirm. To use any of the other rights, email support@plimo.ai from the email address on your account. We will complete your request within 30 days, or tell you within that time why we need longer or can't do it.

You can stop Google Analytics and Yandex Metrica from collecting data about you by blocking their scripts in your browser settings or with an ad blocker, and Plimo will keep working. Blocking cookies alone may not be enough. You can also use the Google Analytics opt-out browser add-on or Yandex Metrica's opt-out options.

Children

Plimo is not directed at children under 13, and children under 13 may not create an account. If we learn that an account belongs to a child under 13, we will delete it.

Adults may upload photos of their own children, or of children they have permission to photograph, to create images and videos. We process those photos only to create what the adult asked for and to check them against our Content Policy, under the same rules as other uploads, and the Content Policy applies in full.

Parents can contact us at support@plimo.ai.

Cookies and browser storage

Plimo uses cookies it needs to work, a cookie that records where you first came to Plimo from, and analytics cookies set by Google Analytics and Yandex Metrica (see Analytics). We don't use advertising cookies.

Cookie	What it does	How long it lasts
`plimo.session_token`	Keeps you signed in	7 days, renewed while you use Plimo
`plimo.state`	Protects Google sign-in from forged requests	5 minutes
`NEXT_LOCALE`	Remembers the language you last viewed Plimo in, so it opens in that language next time	1 year
`plimo.attr`	Records where you first came to Plimo from, so it can be saved with your account if you sign up. Set only when you arrive from another website, or from a link with campaign or ad click details	30 days
`_ga`	Google Analytics: tells apart visitors using different browsers	Up to 2 years
`_ga_92VNY48CF0`	Google Analytics: remembers your current visit	Up to 2 years
`_ym_uid`	Yandex Metrica: recognizes your browser between visits	1 year
`_ym_d`	Yandex Metrica: the date of your first visit	1 year
`_ym_isad`	Yandex Metrica: whether your browser blocks ads	About 20 hours
`_ym_visorc`	Yandex Metrica: makes session replays work	About 30 minutes

On secure (HTTPS) connections, the first two cookies are named with a __Secure- prefix, for example __Secure-plimo.session_token. Google Analytics and Yandex Metrica may also set other short-lived cookies and keep similar data in your browser's local storage.

Plimo also keeps a draft of your current prompt and settings in your browser's session storage, so they are still there after you sign in. It is cleared when you close the tab.