Privacy policy

1. Who is responsible

The controller is Mathis Sportiello, sole trader (entrepreneur individuel, EI), [To fill in: postal address]. Contact for any question about your data: [To fill in: contact email address].

If you run Pluton on your own machine (self-hosted version), your data stays on that machine: the Publisher receives none of it.

2. Two different roles

• For your account, subscription and website data, the Publisher is the controller.
• For the data you process with Pluton, in particular about the people you prospect, you are the controller and the Publisher is your processor (article 8 of the terms of use).

3. Your account data

• Sign-in: the technical identifier Google or Apple sends us, your email address (possibly Apple's relay address) and your name. Purpose: create your account and sign you in. Legal basis: performance of the contract.
• Subscription: your Stripe customer ID, the plan chosen, the subscription status and dates, your invoices. Your card details are entered at Stripe and never reach us. Legal bases: performance of the contract and our accounting obligations.
• Security: server logs (IP address, date, page requested). Purpose: run and protect the Service. Legal basis: our legitimate interest.
• Correspondence: the messages you send us. Purpose: reply to you.

The marketing website sets no cookies and uses no analytics or advertising tools.

4. Data processed on your behalf

To provide the Service, Pluton hosts and processes on your behalf:

• information about your company and your Brain;
• your prospects' data: name, job title, company, LinkedIn profile, work email address, public signals (job posts, technologies, posts);
• your messages, the replies received and sequence history;
• the access you connect (LinkedIn account through Unipile, mailbox, API keys), encrypted with AES-256-GCM.

This data is used only to provide the Service. It is never sold or used to train artificial intelligence models.

5. Recipients and subprocessors

Your data is accessible only to the Publisher and to the providers the Service needs:

• Hetzner Online GmbH (Germany): hosting of the website, app and database;
• Stripe Payments Europe, Ltd. (Ireland): payment and invoicing;
• Google and Apple: sign-in, if you choose to sign in that way;
• Anthropic (United States): the Claude AI, including its web search, on the “All included” plan. On the “Your own AI” plan, this processing goes through your own account.

The services you connect yourself (Unipile for LinkedIn, your mailbox, Hunter, Apify, TheirStack, Slack, HubSpot, Attio, Pipedrive) receive only the data needed for the action you start, under their own terms.

6. Transfers outside the European Union

Your data is hosted in the European Union. Some providers (Anthropic, and where applicable Stripe, Google or Apple) may process it in the United States. These transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

7. Retention

• Account and Customer Content: during the subscription, then 30 days after it ends;
• Invoices and accounting records: 10 years (article L123-22 of the French Commercial Code);
• Server logs: 12 months at most;
• Session cookie: 30 days.

8. Cookies and local storage

The app uses only cookies it needs to work, which do not require your consent:

• pluton_session: keeps you signed in, 30 days;
• pluton_oauth: secures sign-in with Google or Apple, 10 minutes.

It also keeps your display preferences (language, theme, views) in your browser. No advertising or analytics cookies are used.

9. Security

Traffic is encrypted with HTTPS. Session tokens are stored as hashes, never in clear text, and the secrets you save (API keys, access) are encrypted. Server access is restricted to the Publisher.

10. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to set instructions for what happens to your data after your death. To exercise them, write to [To fill in: contact email address]. We reply within one month.

You can also lodge a complaint with the CNIL, the French data protection authority: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

11. Contacted through Pluton?

The company that wrote to you is responsible for your data: send your requests to them first. You can also write to [To fill in: contact email address], and we will pass your request on to the customer concerned.

12. Changes

This policy may change. The update date is shown at the top of the page, and significant changes are notified to customers by email.