Privacy policy

1. What we collect

• Account data. Your email address, your business name, and the plan you are on.
• Site and brand data. The website you connect and the public pages we read from it to build your brand brief and content plan.
• Channel credentials. The access tokens or application passwords you provide so we can publish to your site, social accounts or mailing list.
• Content records. Drafts, sources, revisions, your approval decisions and the resulting published URLs.
• Operational logs. Request and job records needed to run the pipeline, diagnose failures and prevent abuse.
• Payment data. Handled by our payment processor. We receive a customer reference, the plan, and the status of the subscription. We do not receive or store your full card number.

2. Why we collect it

To run the service you asked for: to research and write content in your voice, to publish it to the channels you connected, to keep a record of what you approved, to bill you, and to support you when something breaks. We also use aggregate usage data to find and fix problems.

That includes reviewing how a piece was produced, which means its brief, the sources fetched, the drafts, the results of the automated checks, the reviewing model's report and the published result. The review is carried out by us, including by automated tooling, for three purposes: to find and fix faults, to check quality, and to improve how the service works. Section 3 below still applies to it, and the full clause is section 6 of the terms of service.

3. What we do not do

• We do not sell your data.
• We do not use your business content to train our own models.
• We do not place advertising or third-party tracking scripts on this marketing site.

4. Credentials

Channel credentials are encrypted at rest with AES-256-GCM and are decrypted only at the moment they are needed to publish on your behalf. They are never shown back to you in full, never written to logs, and never shared with a third party other than the platform they authenticate against. Revoking a connection from your side stops us using it immediately.

5. Processors we rely on

Running the service means using infrastructure and providers, including our hosting and database provider, the AI providers that generate and review content, our payment processor, and an email provider for transactional messages. Each receives only what it needs for its function. A current list will be published with the final policy.

6. How long we keep it

• Account and billing records: while you have an account, then as long as tax law requires.
• Content, sources and approval records: while you have an account. Approval records are retained because our publishing controls depend on them.
• Operational logs: a short rolling window, then deleted.
• After you close your account: working data is deleted within 30 days, except records we are required to keep.

7. Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to a particular use. Ask through the dashboard and we will respond within 30 days. If you are in the UK or the EU, you also have the right to complain to your data protection authority.

8. This website

These marketing pages set no cookies and run no analytics or tracking scripts. If that changes, this section changes with it and a notice will appear here first. The dashboard, which is a separate application, uses a session cookie that is strictly necessary to keep you signed in.

9. Children

PlainQuill is a business service and is not directed at children. We do not knowingly collect data from anyone under 16.

10. Contact and changes

Privacy questions go to support through the dashboard. When we change this policy we will post the updated version here with a new effective date, and we will notify active customers of material changes.

Status: draft. Effective on launch. Last revised August 2026.