Privacy Policy

Plug-in AI (“we”) operates this platform and is the data controller for the account and usage data described below. Where an agency uses the platform to create work for its own clients, the agency controls the content it generates and we process that content on its behalf.

Privacy questions: privacy@plug-in.ai

• Account data — name, email address, organization, and role, provided when an account is created or invited.
• Content you submit — prompts, uploaded reference images, video and audio, and the settings chosen for each generation.
• Generated output — the images, video, and audio the platform produces for you, plus their generation metadata (model, duration, resolution, cost).
• Usage and billing records — generation counts, the client and job each generation is billed to, credit purchases, and wallet balances.
• Technical data — log entries, IP address, browser and device information, and error diagnostics.

We do not collect special-category personal data, and we ask that you do not upload it. Payment card details are entered directly with our payment processor and never reach our servers.

• To run generations you request and deliver the resulting files.
• To meter usage, charge credits accurately, and produce the per-client cost reports the platform is built around.
• To operate accounts, authentication, invitations, and role permissions.
• To keep the service secure and reliable — abuse prevention, debugging, and capacity planning.
• To comply with legal, tax, and accounting obligations.

We do not sell personal data, and we do not use your prompts or generated content to train our own models.

We process data to perform our contract with you (running generations, billing), on the basis of legitimate interests (security, service improvement, fraud prevention), and where required to meet legal obligations. Where we rely on consent, you may withdraw it at any time.

We use a small number of specialist providers to deliver the service, each processing only what their function requires:

• AI model providers — receive the prompt and any reference media needed to run a generation you request.
• Cloud hosting and storage providers — run the application and store your files.
• Authentication provider — manages sign-in, sessions, and team invitations.
• Payment processor — handles card payments and subscription billing.
• Email delivery provider — sends transactional messages such as invitations and receipts.

These providers act on our instructions under contract. We do not permit them to use your content for their own purposes.

The platform operates internationally, so data may be processed outside your country, including outside the EEA. Where that happens we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

• Generated files and their metadata are retained while your workspace is active, so your team and finance reports can reference them.
• Billing and credit records are retained as long as required by tax and accounting law (typically seven years).
• Reference uploads are retained for as long as the generations that used them remain available.
• On account closure we delete or anonymize personal data within 90 days, except records we must keep by law.

Data is encrypted in transit and at rest. Access to production systems is limited to personnel who need it, workspaces are isolated from one another, and every generation is attributable to the user and organization that requested it.

Subject to local law, you may request access to your personal data, correction, deletion, restriction, portability, or object to certain processing. Contact privacy@plug-in.ai and we will respond within the period required by applicable law (30 days in most jurisdictions). If you are a member of an agency workspace, we may direct your request to that agency, which controls its own content.

EEA/UK users may also lodge a complaint with their local data protection authority.

The platform is a business tool and is not directed to anyone under 16. We do not knowingly collect data from children.

We use only the cookies needed to keep you signed in and to keep the service secure. We do not use advertising or cross-site tracking cookies.

We will update this policy as the service evolves. Material changes will be announced in-product or by email before they take effect, and the date above will always reflect the current version.