Privacy Policy
Last updated: 2026-10-29
This policy explains how PlenPilot processes personal data when you visit our websites and use PlenPilot and its services, such as PlenLabel, in accordance with the EU General Data Protection Regulation (GDPR).
1. Controller
PlenPilot is the controller for account, billing, support and website data. Contact: support@plenpilot.com.
2. What we collect
Account data: name, email address, organisation and role. Usage and technical data: login times, IP address, browser type and logs needed for security and troubleshooting. Customer content: templates, reference labels, product lists, translation files and generated labels. Communication: messages sent to support.
3. Purposes and legal bases
To provide the Services and manage accounts (performance of contract); to keep the Services secure and prevent misuse (legitimate interest); to provide support and service messages (contract and legitimate interest); for bookkeeping and invoicing (legal obligation).
4. Customer content and AI
Customer content is stored separately per organisation and is only accessible to that organisation’s users. Content is sent to AI providers only when needed to perform a function you request (such as translation or reference analysis). We do not use customer content to train public or third-party AI models, and we do not sell personal data.
Customers should not upload sensitive personal data. Where customer content contains personal data, we process it as a processor on the Customer’s behalf, only on documented instructions (these Terms and the Customer’s use of the Services), with confidentiality, appropriate security measures, approved sub-processors, assistance with data subject requests, and deletion or return at the end of the agreement.
5. Sub-processors and transfers
We use carefully selected providers for hosting, database and file storage, email delivery and AI processing. Where data is transferred outside the EU/EEA, it is protected by the European Commission’s standard contractual clauses or another valid transfer mechanism. A list of sub-processors is available on request.
6. Retention
Account data and customer content are kept while the account is active and deleted within 30 days after termination, unless longer storage is required by law. Accounting records are kept for seven years under Swedish law. Security logs are kept for a limited time.
7. Security
We use encrypted connections, access control per organisation, protected administrator roles and logging of administrative changes. No system is completely secure; in the event of a personal data breach we act in accordance with the GDPR.
8. Cookies and local storage
We only use strictly necessary cookies and browser storage, for example to keep you signed in, remember early-access unlocking and your language choice. We do not use advertising cookies.
9. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing, and to data portability. Contact support@plenpilot.com. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.
10. Changes
We may update this policy. The current version is always published on this page.
Questions? Contact us at support@plenpilot.com