Privacy Policy

Effective date: [FILL IN: effective_date]

1. Who we are

PlotKnots is operated by [FILL IN: business_entity_name] ([FILL IN: business_entity_type], registered in England and Wales). We are the data controller under UK-GDPR (the retained-EU General Data Protection Regulation as amended by the Data Protection Act 2018). Contact: [FILL IN: business_email].

2. What we collect and why

• Email address — to identify your account and send magic-link sign-in emails.
• Display name and group membership — so other members of your group can see who wrote which note or vote.
• Group content — plot threads, notes, votes, and (for GMs) prep content you enter into the service.
• AI-usage counters — for enforcing your tier's monthly AI-suggest quota (see Terms §6). We record which AI-suggest kind you invoked and when, not the content of what was generated.
• Stripe billing metadata — if you're on a paid tier. We do not store card details; Stripe holds those on their own systems.
• Session cookie — a single first-party session cookie for keeping you signed in. This is strictly necessary for the service to function (PECR reg. 6(4) exemption; no consent banner required).

We do not use tracking cookies, analytics cookies, advertising cookies, or third-party embeds that set cookies on plotknots.com. Payment is completed on Stripe's own hosted checkout, so Stripe cookies apply on that site, not ours.

3. Who we share data with

• Stripe (payment processor) — for billing paid tiers. Stripe's own privacy notice applies once you reach their hosted checkout.
• Anthropic (AI provider) — when you use an AI-suggest feature, the prompt content is sent to Anthropic's commercial API. Under Anthropic's commercial-API terms, your prompts are not used to train their models.
• Cloudflare (hosting edge and inbound email routing) — as our infrastructure provider. User data at rest is not stored on Cloudflare's servers.
• Our email relay (Brevo) — for sending magic-link sign-in and account emails.

We do not sell your data. We do not share it with advertisers. We do not use any external log-aggregation, error-tracking, or uptime-monitoring third parties beyond those named above.

Where your data lives: PlotKnots data is processed and stored on our own infrastructure located in the United Kingdom. Cloudflare provides the edge and tunnel layer between users and that infrastructure.

4. How long we keep it

• Group content — for the life of the group, plus 30 days after group deletion (recoverable window).
• AI-usage counters — 90 days after your account is cancelled (billing-dispute buffer).
• Stripe billing metadata (Stripe webhook events, subscription records, invoice history) — 6 years (if PlotKnots is operated as a Ltd company) or 5 years (if operated as a sole trader), after your account is cancelled, per HMRC record-keeping requirements.
• Your email and account — after account cancellation, we pseudonymise your email while retaining the account record for referential integrity of historical group content. If all groups you are part of are also deleted, we remove your account record entirely.

5. Your rights under UK-GDPR

You have the right to: access your data (subject-access request); request correction; request deletion (subject to the retention obligations above); object to processing; request data portability; and lodge a complaint with the ICO (ico.org.uk). To exercise any of these, email [FILL IN: business_email] — we will respond within the statutory 30-day window (typically much sooner).

6. Security

We use standard measures to protect your data: HTTPS everywhere, session cookies signed and HTTP-only, magic-link tokens stored hashed, database access limited to the running application. No system is perfectly secure; if we discover a breach affecting your personal data, we will notify you and the ICO within 72 hours as required by UK-GDPR.

7. Changes to this policy

Material changes are notified via the site and by email to account holders at least 14 days in advance.

8. Governing law

This policy is governed by the laws of England and Wales. UK-GDPR complaints may be lodged with the Information Commissioner's Office (ico.org.uk).