Privacy policy

Last updated: 1 November 2026 · Courtesy translation: the French version prevails.

1. Data controller

The data controller is Richard Carrée, entrepreneur individuel, exerçant sous le nom commercial Axoft, reachable at contact@plumeo.ai.

2. Data we process

• Account: email address, password (stored hashed, never in clear text), email-verification status, and your first and last name if you give them to exercise your right of withdrawal.
• Subscription: plan (free or Plus), status, and the records that prove how the contract was performed: date and version of your request for immediate access, withdrawal request, and the amounts refunded and retained. Payment is handled by Stripe; Plumeo never sees your card details.
• Usage: your request counters and, for each request, technical data (technical request identifier, date, plan and verification status at that time, mode, language, number of alternatives requested, text length, duration, AI provider consumption, error codes, app version), never the text itself, and the events of your subscription (activation, end). Without an account, they are linked to the random identifier the app creates for your device. They are used to enforce quotas, measure service cost, feature adoption and reliability, and prevent abuse.
• Website audience: when measurement is enabled, daily counters group public page views and clicks towards downloads, signup and pricing by source category (direct, internal navigation, search engine, social network, other website) and platform (macOS, Windows, other). These statistics store no visitor identifier, IP address, complete page URL, URL parameter or individual browsing history. Sign-in and account pages are excluded from this collection.
• Submitted text: the text you submit for enhancement is sent to an AI service provider established in the United States for processing, and the result is returned to you. Plumeo does not store it on its servers. The provider may retain it for up to thirty days for abuse monitoring before deletion, unless the law requires otherwise, and does not use it to train its models.
• Local history: the app keeps on your device, and nowhere else, the texts you enhance, the results and the alternatives, for the period chosen in its settings (30 days by default, from the current session only to one year). You can clear it at any time from the app.
• Feedback: when you report a bug or suggest an improvement from the app, Plumeo records your message, its type and date, and the email address you provide, if any, which is used only to reply to you. The message is linked to your account if you are signed in, otherwise to the random identifier the app creates for your device. It is kept with our hosting provider: the data controller is only told by email how many new feedback entries have arrived, not what they say.

An email address and a password are required to create an account; without an account, the app works with your device's identifier. Your first and last name are only asked for to exercise the right of withdrawal, and the email address attached to feedback is optional.

3. Legal bases

Processing relies on the performance of the contract (providing the service, managing the account and subscription), legitimate interest (security, abuse prevention, measuring service cost, adoption and reliability, aggregate website audience statistics and proving how the contract was performed; for feedback: replying to you, fixing the problems reported and improving the service) and legal obligations (invoicing).

4. Recipients and processors

• IONOS SARL, 7 place de la Gare, BP 70109, 57201 Sarreguemines Cedex, France, +33 (0)9 70 80 89 11 (hosting, European Union);
• an AI service provider established in the United States (processing of submitted text): this transfer outside the European Union is governed by standard contractual clauses; you can obtain its identity and a copy of these safeguards on request at contact@plumeo.ai;
• Brevo (sending account and subscription emails);
• Cloudflare (forwarding of emails sent to contact@plumeo.ai; storage, in the European Union, of database backup copies) and Google (the Gmail mailbox where those emails are received): both may process the data in the United States; these transfers rely on the European Commission's adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework), under which Cloudflare, Inc. and Google LLC are certified;
• Stripe (subscription payments).

No data is sold or shared with third parties for advertising purposes.

5. Retention

Account data, including the records proving how the contract was performed, is kept for as long as the account exists, then deleted. Invoicing records are kept for ten years as required by law. Technical request data and the log of emails sent are deleted twelve months after they are recorded; the device identifier recorded to track the quota of a device used without an account is deleted twelve months after its last use. Subscription and withdrawal confirmations sent by email are kept for 400 days after they are sent, and for as long as they remain owed if sending failed. Feedback is kept for two years from submission, then deleted. Database backups may hold a copy of this data for up to 90 days after its deletion.

Daily statistics of usage, audience, signups and received or refunded amounts, without account, device, visitor or transaction identifiers, are retained for five years. Technical identifiers used to avoid counting a payment or refund twice in these statistics are deleted twelve months after recording. These periods do not change the retention of accounting records.

6. Your rights

Under the conditions set by the GDPR, you have the rights of access, rectification, erasure, portability, restriction and objection. To exercise them: contact@plumeo.ai. You may also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).

Right to object. You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest, including the handling of your feedback, by writing to contact@plumeo.ai.

7. Cookies and trackers

The Site uses no tracking cookies or visitor identifiers for audience measurement. Do Not Track and Global Privacy Control signals are respected. You can also disable this measurement below. Your browser only stores your theme and measurement opt-out preferences and, once you sign in, your session token, removed when you sign out. Statistics are not linked to your account or shared with advertising networks.

8. Security

Traffic is encrypted (TLS), passwords are hashed, and server access is restricted.