Privacy Policy

1. Introduction

Plinth B.V. ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share information when you use Plinth's applications for iOS, macOS and Android (the "App") and web portal (together, the "Service").

This policy applies to all users of the Service and covers both personal data and usage information. Available features and sign-in methods vary by platform and release.

2. Data Controller

Plinth B.V. is the data controller responsible for your personal data. We are registered in the Netherlands and comply with applicable data protection laws, including the General Data Protection Regulation (GDPR).

3. Information We Collect

3.1 Account Information

When you create or use an account, we collect the following information, depending on your sign-in method:

• Email address: For account authentication and communication
• Password hash: A one-way hash for accounts using email and password. We do not store the password in readable form.
• Username: Optional display name for your account
• Company name: Optional business information
• Apple sign-in information: Your Apple account identifier, email and any name Apple provides, plus encrypted authorization credentials used to manage the connection
• Google sign-in information: Your unique Google account identifier, email address and verification information from Google's signed sign-in proof, where this method is offered
• Policy acceptance: Your Terms and Privacy acceptance choices and dates, and the document versions recorded for Google signup
• Session information: Plinth session credentials and device-session identifiers used to keep you signed in and manage account access

For Google signup, we retain the verified Google account identifier and email and create a Plinth username from the email address. Connecting Google to an existing account retains that account's Plinth profile. We use Google's email-verification information and, where present, Workspace domain to determine whether additional Plinth email verification is required; the domain does not assign you to a Plinth workspace.

Google sign-in requests basic identity information only. We do not receive your Google password or request access to Gmail messages, Google Drive files, Google Photos or contacts through this sign-in flow. The Google ID token is used to verify sign-in and is not stored in your Plinth account record. Any proof temporarily held while you complete signup is discarded on cancellation or expiry.

3.2 Content and Media

Through your use of the App, we process:

• Photographs and images: Content you capture or upload for 3D reconstruction
• Project metadata: Information about your capture sessions and projects
• Camera parameters: Technical data about camera settings used during capture
• Generated 3D models: Processed results from your uploaded content

3.3 Technical Information

We automatically collect certain technical data:

• Device information: Device model, operating system version, unique device identifiers
• App usage data: Features used, session duration, performance metrics
• Log data: Error logs, crash reports, and debugging information
• Network information: IP address, connection type (for service delivery)
• App and device verification: App identity, version and signing certificate, app licensing status, device-integrity results and a hashed request-verification value when protected actions use Google Play Integrity. Apple platforms may use Apple App Attest verification information.

3.4 Purchase Information

Depending on the purchase channel, we process transaction information from Apple's App Store or Stripe on the web portal:

• Purchase history: Credit purchases and transaction IDs
• Payment verification: App Store receipts and transaction information, or Stripe payment and subscription identifiers, used to validate purchases and manage billing

Google sign-in and Play Integrity verification do not themselves make a payment or create a paid subscription.

4. How We Use Your Information

5. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract performance: To provide our 3D reconstruction services
• Legitimate interest: To improve our services and ensure security
• Consent: For optional features like email notifications
• Legal obligation: To comply with applicable laws and regulations

6. Data Sharing and Disclosure

6.1 Third-Party Service Providers

We share data with trusted service providers who help us operate our services:

• Cloud infrastructure providers: For data storage and processing
• Authentication services: Apple for Sign in with Apple and Google for Sign in with Google, where offered
• App and device security services: Apple App Attest and Google Play Integrity for verification of protected actions
• Payment providers: Apple for App Store purchases and Stripe for web portal purchases
• Analytics providers: For app performance monitoring (anonymized data)
• Customer support tools: For handling user inquiries

When Google sign-in or Play Integrity is used, Google processes information under its Privacy Policy. Play Integrity handles app metadata, request-verification information, app licensing status and device-attestation information to check app and device integrity. Plinth uses these checks for security and fraud prevention.

6.2 Legal Requirements

We may disclose your information when required by law or to:

• Comply with legal processes or government requests
• Protect our rights, property, or safety
• Prevent fraud or security threats
• Enforce our Terms of Service

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, user information may be transferred as part of the transaction, with appropriate notice to users.

7. Data Retention

We retain your data only for the periods needed to run the service, comply with law, and honor the lifecycle safeguards described in our Data Retention Policy:

• Account data: Stored while your account remains open. Eligible inactive free accounts may be removed after 3 years of inactivity under our Data Retention Policy.
• Free-tier projects: Unpurchased projects are limited to three at a time and each preview lasts 14 days. We send in-app/email warnings on Day 7 and push notifications on Day 12 before deletion.
• Subscriber previews: Active subscribers receive a 30-day preview window for unpurchased projects with reminders on Day 23 and Day 28 so you can upgrade or buy before deletion.
• Cancelled subscriptions: If you cancel, all projects remain accessible for 3 months. We notify you at Day 75 (email), Day 83 (email + push), and Day 89 (push) before permanent removal. Reactivating within that window preserves your content.
• Purchased projects: Available indefinitely while your account is active. After 12 months of inactivity we may archive them to cold storage for cost efficiency, but they remain restorable within hours upon request.
• Purchase records: Retained for 7 years to satisfy tax and legal obligations.
• Technical logs: Kept for up to 90 days for diagnostics and security monitoring.

These automated retention rules run alongside the manual deletion tools available in the app, giving you control while ensuring predictable cleanup.

Account-data retention also covers linked Apple or Google identifiers and policy-acceptance records. We may retain records required for security, fraud prevention or legal obligations after account deletion, including the purchase records described above.

The expiration of an email-verification link does not automatically delete a pending signup. You may contact [email protected] to request deletion of a pending signup.

8. Data Security

We implement robust security measures to protect your data:

• Encryption: Data encrypted in transit and at rest
• Access controls: Role-based access to personal data
• Regular audits: Security assessments and vulnerability testing
• Infrastructure security: Secure cloud hosting with enterprise-grade protection
• Employee training: Staff trained on data protection and security practices

9. Your Rights

Under GDPR and other applicable laws, you have the following rights:

9.1 Access and Portability

• Request a copy of your personal data
• Export your projects and content

9.2 Correction and Updating

• Update your account information through the App
• Request correction of inaccurate data

9.3 Deletion

• Delete your account and associated data
• Request deletion of specific content

You can request account deletion through the App settings or by contacting [email protected]. We may require recent authentication or other identity verification. Deleting your Plinth account does not delete your Apple or Google account or cancel a subscription with your payment provider; manage subscriptions through the provider or the web portal's billing controls.

If an account belongs to a shared workspace, deletion may require coordination with support to protect other members' access to shared data.

9.4 Restriction and Objection

• Object to processing based on legitimate interest
• Restrict processing in certain circumstances

9.5 Exercising Your Rights

To exercise your rights, contact us at [email protected]. We will respond within 30 days and may require verification of your identity.

10. International Data Transfers

Your data may be processed in countries outside the European Economic Area. We ensure adequate protection through:

• Adequacy decisions by the European Commission
• Standard Contractual Clauses with service providers
• Certification schemes and codes of conduct

11. Children's Privacy

Our App is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover we have collected such information, we will delete it immediately.

12. Cookies and Tracking

Our native applications use session credentials and local storage for account access and app functionality. Our website and web portal may use cookies and browser storage for secure sessions, language preferences and service functionality. We may use:

• Device identifiers: For analytics and crash reporting
• Session tokens: For authentication and security
• Local storage: For app preferences and cached data

Native apps store Plinth session credentials in encrypted platform storage. Captured images, drafts and downloaded models may remain in app storage on your device, including after upload or sign-out, until you delete them or clear the app's data.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable laws. We will:

• Notify users of material changes through the App
• Post the updated policy on our website
• Send email notifications for significant changes

Continued use of the App after changes constitutes acceptance of the updated policy.

14. Contact Information

15. Supervisory Authority

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority or the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

© 2026 Plinth B.V. All rights reserved.