← Back to plotwins

Privacy Policy

Version 1 — September 2026

This Privacy Policy describes how your personal data is collected, used, and shared when you use plotwins, visit plotwins.com, or interact with our services.

The terms "user", "you", and "your" refer to any person using our services. The terms "plotwins", "we", and "our" refer to Pixel Family S.L. (Tax ID B99489205, Calle Alameda 22, 28014 Madrid, Spain). Privacy email: privacy@plotwins.com.

What counts as personal data at plotwins?

We treat as "personal data" any information that identifies or can identify a person, or that we can link to them, regardless of where they live. This includes data that identifies you directly (such as your name or email) and data that can reasonably be used to do so (such as a device identifier).

Aggregated and anonymized data is not considered personal data for the purposes of this Policy.

This Policy covers the plotwins web application, the plotwins.com website, and any communication with us. plotwins may link to third-party services or integrate third-party tools; this Policy does not apply to how those third parties use data. We recommend reading their privacy policies.

What are your privacy rights?

We respect your right to know, access, rectify, transfer, restrict the processing of, and delete your personal data. If you choose to exercise these rights, you will not receive discriminatory treatment or a lower-quality service. You can withdraw your consent at any time.

To exercise your rights you can:

  • From the app: in Settings you can change your profile details and revoke any access token you created for an AI agent.
  • By email: contact us at privacy@plotwins.com for any access, rectification, portability, restriction, objection, or deletion request — including deleting your account and all associated data.

We will respond to all requests within a maximum of 30 days. In some cases we may need additional information to verify your identity, or to let you know we need more time.

There may be situations where we cannot fulfill your request — for example, if you ask us to delete data we are legally required to keep, or if the request would compromise the security of other users. In those cases we will explain why.

If you are not satisfied with our response, you can address your complaint to the Spanish Data Protection Agency (aepd.es) or to the data protection authority of your country of residence.

What personal data does plotwins collect?

We only collect the data we need to run the service. The data we collect depends on how you use plotwins.

  • Account information: your email, name, optional profile picture, authentication method (email and password, Google, or Microsoft), sign-up date, and account status.
  • Workspace content: the projects and tasks you create — titles, descriptions, subtasks, labels, time horizons and due dates, positions on the impact/effort matrix, assignments, and completion history.
  • Team information: who belongs to each shared space. If you join a shared space, its members see your name, your profile picture, and your activity on shared work (such as tasks you create, assign, or complete), including in notifications and the activity timeline.
  • AI agent access: if you connect an AI assistant through MCP, we store the access tokens you create (hashed — we never keep the plain token) or the OAuth grants you approve, with their creation and last-used dates. The agent acts as you and sees what your account sees, only while you keep its access alive.
  • Transaction information: your subscription plan and status, managed through Stripe. We have no access to card numbers or full payment data.
  • Technical information: IP address, browser and device type, and the cookies needed to keep your session open.
  • Usage data: pseudonymized product analytics (pages visited, features used) through PostHog. We do not analyze the content of your tasks for analytics purposes.

What data does plotwins NOT collect?

  • Your precise location (GPS).
  • Your contacts, photos, videos, or device files.
  • Your browsing history outside plotwins.
  • Advertising identifiers.
  • Financial data, card numbers, or banking information.
  • Biometric data.

How does plotwins use your personal data?

plotwins uses your personal data to power its services, keep teams in sync, communicate with you, ensure security, and comply with the law, always with a valid legal basis:

  • Powering our services: authentication, storing your projects and tasks, and showing them on the matrix (performance of contract, Art. 6.1.b GDPR).
  • Team features: showing your name, picture, and activity to the members of spaces you join (performance of contract, Art. 6.1.b GDPR).
  • AI agent access: executing the actions an agent you authorized asks for, exactly as if you did them yourself (performance of contract, Art. 6.1.b GDPR).
  • Billing: managing subscriptions, trials, and invoices through Stripe (performance of contract and legal obligation, Art. 6.1.b and 6.1.c GDPR).
  • Communicating with you: transactional emails such as sign-up confirmation; marketing only if you consent, with the option to unsubscribe at any time.
  • Analysis and service improvement: aggregated, pseudonymized usage data through PostHog (legitimate interest, Art. 6.1.f GDPR; you can object at privacy@plotwins.com).
  • Complying with the law: tax and regulatory obligations or court orders (Art. 6.1.c GDPR).

plotwins does not use your data for third-party advertising, does not share it with data brokers, and does not sell it.

We keep personal data only for as long as necessary: account data and content are deleted within 30 days of a deletion request (content you added to a shared space may remain visible to that space if its owner keeps it); analytics are kept in aggregated form for a maximum of 24 months; and tax records for as long as required by law (a minimum of 5 years in Spain).

Who does plotwins share your personal data with?

We may share personal data with service providers acting on our behalf and under our instructions. We do not share data with third parties for their own marketing purposes. We do not sell your personal data.

Our main providers are:

  • Supabase (EU): backend, database, and authentication.
  • Vercel (US): hosting of the application and website.
  • Stripe (US/EU): subscription billing; card data is handled exclusively by Stripe, never by us.
  • Google and Microsoft (US): authentication, if you sign in with them.
  • PostHog (US): analytics with pseudonymized data.

AI assistants and your data

plotwins does not send your data to any AI model on its own. If you connect an AI assistant through MCP, that assistant accesses your account under your instruction, and what its provider does with the data is governed by that provider's own terms and privacy policy — you choose the assistant, and you can revoke its access at any time from Settings. We recommend connecting only assistants you trust.

How does plotwins protect your personal data?

If you find a security vulnerability, we would appreciate you reporting it to privacy@plotwins.com.

  • Encryption in transit: all communications use HTTPS/TLS.
  • Encryption at rest: stored data is encrypted.
  • Row Level Security: each user can only access their own projects and the shared spaces they belong to.
  • Agent tokens are stored hashed, can be revoked at any time, and show their last use.
  • Restricted access and continuous review of security measures.

Minors

plotwins is not aimed at people under 16 and we do not knowingly collect their data. If you believe a minor in your care has provided us with personal data, contact privacy@plotwins.com.

Cookies, local storage, and analytics

plotwins uses strictly necessary cookies to keep your session open. It does not use advertising cookies or third-party marketing trackers.

For analytics, PostHog stores an anonymous visitor identifier and a session identifier in your browser's localStorage (keys prefixed with ph_). It is configured for data minimisation: no session recording, no surveys, and no identified profiles for anonymous visitors. To opt out you can enable Do Not Track in your browser (PostHog respects this signal and will not collect any data from your visit), use a tracking blocker, clear the ph_ entries from your browser's site data, or write to privacy@plotwins.com.

International transfers

Our main database infrastructure is in the European Union. Some providers process data in the US with appropriate safeguards: standard contractual clauses, adequacy decisions, or the EU-US Data Privacy Framework.

Privacy questions

If you have questions about this Policy or how we handle your data, write to us at privacy@plotwins.com. Most inquiries receive a response within 7 days.

When a substantial change is made to this Policy, we will post a notice on the website at least 7 days in advance.