Privacy Policy

Plazas (plazas.ai) is operated by [COMPANY LEGAL NAME], company number [COMPANY NUMBER], [REGISTERED ADDRESS]. Privacy questions and requests: [PRIVACY CONTACT EMAIL]. Data protection officer: [DATA PROTECTION OFFICER, IF APPOINTED]. Representative in the European Union: [EU REPRESENTATIVE, IF REQUIRED].

We play two roles, and this policy covers both:

• For your account (your name, email, plan, coin history and how you use the service) we decide why and how the data is used. In European terms we are the "controller"; under Israeli law, the owner of the database.
• For personal data about other people that you put into Plazas or connect to it (your clients, leads, CRM records, visitors who chat with your website assistant, people in a mailbox or a table you connect), you decide and we process it for you. In European terms you are the controller and we are your "processor"; under Israeli law, we hold the data for you. The Data Processing Addendum applies. If you are one of those people, please contact the business first; we will help it answer you.

For connected tables the server judges every column on every read. Columns that look personal (names, emails, phones, addresses, dates of birth) are locked and are not given to AI employees. Card numbers, bank account numbers and identity numbers are not stored at all, and HubSpot is not asked for people's names or contact details. This check is automatic and can miss a column with an unusual heading.

We do not ask for special categories of data (health, religion, political views, biometric data and the like) and the service is not designed for them. Please do not put them in.

What we do not collect: we run no analytics, advertising or tracking tools, and we do not buy data about you from anyone.

The legal bases below are the ones in the EU and UK General Data Protection Regulation, for people it applies to.

We do not make decisions about you by automated means that have a legal or similarly significant effect on you. How the AI employees work is explained in the AI disclosure.

You are not required by law to give us any of this data. Without an email address and a password we cannot open an account; everything else you put in is your choice.

When an AI employee runs a task, the server builds its instructions and sends them to the model provider. They can contain: the employee's job, your business name, kind and city; your company profile, projects, updates and relevant passages of your knowledge; names and notes of up to 60 clients from Memory (never their contact line); your earlier correction notes; the task you wrote; pages it read from links you gave it or from a web search; rows from the unlocked columns of tables you shared with that employee; and what it read from an app you allowed it to use.

The website assistant sends the model the text you wrote for it and the conversation with the visitor. The setup chat sends the conversation with you.

Your CRM records and your vault are not sent to a model. [CONFIRM PROVIDER TERMS ON TRAINING AND RETENTION]

We do not sell personal data and we do not share it for advertising. We pass data to the companies that run parts of the service for us (sub-processors), only for that purpose:

The current list, with locations, is kept on the Sub-processors page.

Services you connect yourself (Google, HubSpot, GitHub, your mailbox provider) are not our sub-processors: they are your own providers, and we reach them on your instruction.

We may also disclose data when the law requires it, to protect people or the service from serious harm, or to a buyer or successor if the business is sold or merged, under the same commitments. Our own staff with administrator rights can reach account data when that is needed to support you, to keep the service safe or to meet a legal duty.

The database is hosted by Supabase in Frankfurt, Germany, in the European Union.

Some of our providers are in the United States or process data there and in other countries: the AI model providers, the connection provider, the hosting network and Google. This means data leaves Israel, and may leave the European Economic Area.

For transfers from the EEA or the UK we rely on [TRANSFER MECHANISM]. For transfers from Israel we rely on the grounds allowed by the Privacy Protection (Transfer of Data to Databases Abroad) Regulations [CONFIRM]. You can ask us for a copy of the safeguards.

• Your account and everything in it are kept while the account is open. Today nothing in an account is deleted automatically after a period of time: tasks, visitor messages and website assistant conversations stay until you delete the account (or, where the app offers it, the item or the plaza).
• The sign-up fingerprint is deleted after one hour.
• Deleting your account (Settings, Account) removes the account and the rows saved for it from our database at once. It cannot be undone.
• Backups made by our database provider expire on their own schedule: [BACKUP RETENTION PERIOD].
• Payment and tax records are kept for as long as the law requires.
• Data already sent to a model provider is kept by it according to its terms. [CONFIRM PROVIDER TERMS ON TRAINING AND RETENTION]

Things that deleting your Plazas account does not yet remove, and that you should remove yourself first: the sign-ins to apps held by our connection provider (disconnect each app under Connections before deleting the account, or ask us), the Plazas app installed on your GitHub account (remove it at GitHub), and anything you already sent or published outside Plazas.

No system is perfectly safe. These are the measures in place today:

• Traffic between your browser, our servers and our providers is encrypted in transit.
• Every table has row-level rules: an owner can read only their own rows. Task results, coin balances, connected rows and visitor conversations can be written only by the server.
• Rows from connected tables never reach the browser, and columns that look personal are held back from AI employees.
• Secrets for connections (a HubSpot key, a private calendar address) are kept in an encrypted secret store and are never returned to the browser, written to logs or given to an AI employee.
• The vault is encrypted in your browser (AES-GCM with a key derived from your passphrase); we cannot open it, and we cannot recover it if you forget the passphrase.
• Anything an AI employee wants to change in a connected app waits for your approval and is carried out once.
• Public forms and the website assistant have rate limits and daily caps; sign-up is by invitation.
• Our server functions do not log the content of tasks or of visitor conversations.

What we do not have yet: two-step sign-in, an independent security audit, and a formal certification. We will update this list when that changes.

If a security incident affects your personal data, we will notify you and the authorities as the law requires. Report a security problem to [SECURITY CONTACT EMAIL].

Depending on where you live, you may have the right to:

• See the personal data we hold about you and get a copy.
• Have wrong data corrected.
• Have data deleted.
• Receive your data in a file you can take elsewhere.
• Object to a use of your data, or ask us to restrict it.
• Withdraw a consent you gave.
• Complain to a data protection authority: in Israel the Privacy Protection Authority, in the EU the authority of your country.

What you can do yourself today: change your name and password in Settings; export your account details and your saved document (plazas, team, Memory, business brain) as a JSON file in Settings, Account; and delete your account there.

For anything else, write to [PRIVACY CONTACT EMAIL]. We will answer within [REQUEST RESPONSE TIME]. We may need to check that the request really comes from you. The export file does not yet include every table (for example tasks, CRM records, website assistant conversations and connected rows); ask us and we will provide them.

For people in Israel, we handle personal data under the Privacy Protection Law, 5741-1981, as amended by Amendment 13 (in force since 14 August 2025), and the Privacy Protection (Data Security) Regulations, 5777-2017.

• The data is collected for the purposes in section 3 and will be used only for them. Section 5 says who receives it.
• You have the right to look at the data held about you and to ask for it to be corrected or deleted, as the law provides. Write to the address in section 1.
• Database registration and notification: [DATABASE REGISTRATION STATUS].
• Privacy protection officer: [DATA PROTECTION OFFICER, IF APPOINTED]. Data security officer: [DATA SECURITY OFFICER, IF REQUIRED].
• We send marketing messages only as section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982 allows, and every such message has a way to unsubscribe.

Plazas is for businesses. It is not offered to anyone under [MINIMUM AGE], and we do not knowingly collect data from children. If you believe a child has opened an account, tell us and we will remove it.

We set no advertising or analytics cookies. The few things the service keeps in your browser are listed in the Cookie and storage notice.

When we change this policy we change the date at the top. For a change that matters we will tell you in the app or by email at least [NOTICE PERIOD FOR CHANGES] beforehand. This policy takes effect on [EFFECTIVE DATE].

[COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Privacy: [PRIVACY CONTACT EMAIL]. Everything else: [CONTACT EMAIL].