Privacy policy

Plyto is a product of ClientFuse LLC, a United States company. ClientFuse LLC is the data controller for the personal data described here, except the contact data businesses keep in Plyto (see "Your contacts' data"). Reach us at support@plyto.ai. If you are in the European Economic Area, the United Kingdom or Switzerland, the sections headed "Europe, the UK and Switzerland" below also apply to you.

Account details you provide (name, email) via our sign-in provider (Auth0); business data you or your team put into Plyto (contacts, companies, deals, tasks, emails, websites, blog posts); billing details processed by Stripe (we never store card numbers); usage and diagnostic data (pages visited, actions taken, errors) used to keep the product working and improve it; and records of your agreements and approvals (accepting the Terms of service, approving a campaign launch, a resume or a budget increase), each with the date, your network address and your browser, kept as evidence of the authorization for as long as your account exists. On our marketing pages we also use ad measurement cookies from Google, Meta and OpenAI so we can tell which of our own ads brought you here; you can turn those off any time from "Cookie preferences" in the footer.

To provide the service: storing your CRM data, sending email you compose or approve, running automations you activate, publishing websites and blog posts you create, and running ad campaigns you explicitly approve. We also use AI providers (such as Anthropic) to power the Plyto agent: the content of your requests and relevant business records are processed to fulfill them. We do not sell your data or your contacts' data to anyone.

You own the contact data you bring to Plyto and are responsible for having a lawful basis to contact those people. Plyto enforces unsubscribe handling and do-not-contact flags on email sends. For this data you are the controller and ClientFuse LLC is your processor: we use it only to provide Plyto to you and on your instructions, under the data processing terms in our Terms of service. If one of your contacts asks us about their data, we pass the request to you and help you answer it.

We use these providers to run Plyto. Each processes personal data only to provide its part of the service to us:

Vercel: hosting and file storage. Neon: the database. Auth0 by Okta: sign-in. Stripe: billing. Resend: email delivery. Inngest: background jobs. Anthropic, OpenAI and Google: the AI models behind the agent, ad copy, pictures and video.

When you connect Google Ads or Meta, data you ask us to send there goes to your own account on that platform, under that platform's terms. We update this list before adding a provider that processes personal data.

Data is stored with the providers above, in the United States, encrypted in transit and at rest. OAuth tokens for connected ad accounts are encrypted with keys we control.

When you connect Google Ads, you grant Plyto two permissions and nothing else. Google Ads (adwords) lets us read your campaign performance and, only when you approve a change, create and edit campaigns, ad groups, keywords, negative keywords, ads, budgets and bidding settings on your behalf. Data Manager (datamanager) lets us send your own conversions back to your Google Ads account: when a lead Plyto captured through your form becomes a customer, we upload that outcome against the original ad click so Google can optimize toward the ads that produce real business. We do not upload your contact lists to Google or build Google audiences from your customer data.

On Meta, if and only if you explicitly ask us to, Plyto can build a custom audience or lookalike audience from one of your own contact lists, inside your own Meta ad account. Email addresses are hashed before upload, Meta discards entries it cannot match, and you can delete the audience in Meta at any time. We never build audiences on our own initiative, never share them across businesses, and never upload anyone to a platform you have not connected.

Plyto's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide and improve the features you connected it for, we never sell it, we never transfer it except as required to provide those features or by law, we never use it for advertising of our own, and no human reads it except with your explicit permission for support or where required by law. Disconnect at any time in Settings, Integrations; we delete the stored tokens immediately and the performance data we cached within 30 days.

Essential cookies (session authentication, your active-business selection, and your cookie choice itself) are always on; the product can't work without them. Analytics and marketing cookies are used only if you choose “Accept all” in the cookie banner, and you can change your choice any time via “Cookie preferences” in the footer.

Your data is retained while your account is active. Delete your account (or email us) and we remove your business data within 30 days, excluding minimal records we must keep for tax or legal reasons.

The GDPR, the UK GDPR and Swiss law require a legal basis for each use of your personal data. Ours are:

Contract: to provide Plyto to you, including your account, your CRM, the campaigns you approve, and billing.
Legitimate interests: to keep Plyto secure, prevent fraud and abuse, fix errors, improve the product, and tell customers about changes to it. You can object to any of these (see your rights below).
Consent: for analytics and marketing cookies on our site, and for marketing emails where the law requires consent. You can withdraw consent at any time; it does not affect what happened before.
Legal obligation: to keep tax and accounting records and to answer lawful requests from authorities.

Plyto does not make decisions about you that have legal or similarly significant effects based solely on automated processing.

You can ask us to give you a copy of your personal data, correct it, delete it, restrict how we use it, or send it to you or another company in a machine-readable form. You can object to our use of it based on legitimate interests, and you can always object to direct marketing. Email support@plyto.ai; we answer within one month. If your data is in a Plyto customer's CRM, that business decides how it is used, so we pass your request to them and help them answer.

You can also complain to a data protection authority: in the European Economic Area, the authority in your country; in the United Kingdom, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner.

ClientFuse LLC is in the United States, and our providers process data there. When a business in the European Economic Area, the United Kingdom or Switzerland uses Plyto, the European Commission's Standard Contractual Clauses (controller to processor), with the UK International Data Transfer Addendum and the adjustments for Switzerland, apply to the data we process for them, as set out in our Terms of service. Our providers commit to protecting that data under the EU-U.S. Data Privacy Framework (with its UK Extension and the Swiss-U.S. Data Privacy Framework) or under Standard Contractual Clauses.

Plyto is a service for businesses and is not directed at anyone under 16. We do not knowingly collect personal data from children.

Questions or deletion requests: support@plyto.ai.