Privacy policy

1. Who we are

Pluged AI ("we", "us", "our") operates the Pluged AI marketing website and video editor. For the purposes of UK data protection law, we are the data controller for personal data described in this notice.

Contact: hello@pluged.ai

2. Personal data we collect

Depending on how you use Pluged AI, we may process:

Account & identity (when you sign in)

• Name, email address, profile photo (via Google sign-in)
• Firebase user ID and authentication session data
• Subscription plan status (free, pro, or team)
• Stripe customer and subscription identifiers (if you subscribe)

Service & usage data

• AI agent usage metrics (e.g. token counts for quota metering)
• Feedback you voluntarily submit
• Share-page metadata if you publish an exported edit
• Technical logs (IP address, browser type, timestamps, errors)

Content you process with AI features

• When you use an AI feature, the relevant content is sent to third-party AI providers to perform your request: your typed prompts and the project summary (AI agent), a downscaled copy of your video (AI footage understanding), extracted audio (captions / transcription), and any text you convert to speech (voiceover). Search terms are sent for stock and sound lookups.
• This content is processed only to return the result you asked for. We do not use it to train our own models or for advertising. Provider handling is governed by their own terms (see §6).

Device & anti-abuse data

• A device identifier derived from your browser/device characteristics (a "fingerprint"), used to detect and prevent abuse of free-tier limits — for example, creating multiple accounts on one device to reset usage. It is computed in your browser and associated with your usage counters.

Payment data

• Subscription and billing details are processed by Stripe. We do not store full card numbers on our servers.

Website analytics

• Anonymised or pseudonymised usage data via Google Analytics 4 (page views, device/browser information, approximate location)

Local data on your device

• Video projects, media files, and editor state are stored primarily in your browser (IndexedDB / local storage). Your raw media stays on your device except when you use an AI feature (which sends the content described above to AI providers) or when you explicitly export or share content.

3. Lawful bases for processing (UK GDPR)

We process personal data only where we have a lawful basis:

• Contract — to provide the editor, manage your account, and fulfil a Pro subscription you purchase.
• Legitimate interests — to secure our services, prevent abuse (including generating a device identifier to stop free-tier limits being reset via multiple accounts), improve reliability, and understand aggregated website usage. We balance these interests against your rights.
• Consent — where required for non-essential cookies and analytics, or for optional communications. You may withdraw consent at any time.
• Legal obligation — to keep records required for tax, accounting, or regulatory purposes relating to payments.

4. How we use your data

• Authenticate you and maintain your account
• Provide free and paid features, including AI editing tools
• Transmit content you choose to process to AI providers to perform the edit, transcription, voiceover, or search you requested
• Process subscriptions and manage billing via Stripe
• Enforce usage limits on free plans (including a device identifier to prevent multi-account abuse) and apply Pro entitlements
• Respond to support requests and feedback
• Monitor security, debug issues, and prevent fraud or abuse
• Measure website traffic and improve pluged.ai
• Comply with applicable law

We do not sell your personal data. We do not use your video content for advertising profiling. Automated checks enforce usage limits and detect abuse, but we do not make decisions producing legal or similarly significant effects about you by solely automated means; you can contact us for a human review of any account restriction.

5. Cookies & similar technologies

We use cookies and browser storage for:

• Strictly necessary — session authentication (e.g. pluged_session) so you stay signed in across pluged.ai and app.pluged.ai
• Functional — editor preferences and locally saved projects in your browser
• Analytics — Google Analytics cookies to understand how the marketing site is used

Non-essential cookies (such as analytics) should only be set after you have been given a clear choice where UK law requires it. You can also block or delete cookies in your browser settings.

6. Third-party processors

We use trusted service providers who process data on our instructions:

• Google / Firebase — authentication and user profile storage (Firestore)
• Stripe — payment processing and subscription management
• Google Analytics — website analytics
• Amazon Web Services (AWS) — cloud hosting, and the Amazon Bedrock models that power the AI agent, AI footage understanding, and hosted transcription (invoked only when you use those features)
• OpenAI / Microsoft Azure OpenAI — text-to-speech voiceover generation (when you use it)
• Pexels and Freesound — stock footage and sound search (your search terms are sent to fulfil the query)
• Upstash — rate limiting to protect the service (uses IP address)
• Hosting / CDN provider (e.g. Vercel) for the marketing site

The device fingerprint is generated on your device by an open-source library (FingerprintJS) running in your browser; the fingerprinting computation itself does not send your data to that library's vendor.

Each processor is bound by contractual terms requiring appropriate security and, where applicable, standard contractual clauses or equivalent safeguards for international transfers. Content you send to AI providers is also subject to those providers' own terms and privacy policies.

7. International transfers

Some providers process data outside the UK. In particular, our AI and infrastructure providers may process data in the United States (e.g. OpenAI, Stripe, Google) and in India (AWS region for the Bedrock AI models). When you use an AI feature, the content you submit is transferred to those locations for processing. Where we transfer personal data outside the UK, we rely on adequacy regulations, the UK International Data Transfer Agreement / Addendum, or other approved transfer mechanisms under UK GDPR.

8. How long we keep data

• Account data — while your account is active, then deleted or anonymised within a reasonable period after you delete your account or request erasure (subject to legal holds).
• Usage & anti-abuse data — usage counters and the device identifier are kept while your account is active and for a limited period afterwards to enforce limits and prevent abuse, then deleted or aggregated.
• AI content — we do not retain your uploaded media, audio, or prompts beyond what is needed to return the result; AI providers may retain inputs briefly per their own policies.
• Billing records — retained as required for tax and accounting (typically up to 6 years in the UK).
• Analytics — according to Google Analytics retention settings (configurable; default periods apply).
• Local editor data — remains on your device until you clear browser storage.

9. Security

We use administrative, technical, and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access controls, and server-side verification of authentication tokens. No method of transmission or storage is 100% secure; please use a strong Google account and keep your devices protected.

10. Your rights under UK GDPR

If UK GDPR applies to our processing of your personal data, you have the right to:

• Access — request a copy of personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data in certain circumstances
• Restriction — ask us to limit processing in certain circumstances
• Data portability — receive certain data in a structured, machine-readable format
• Object — object to processing based on legitimate interests, including profiling
• Withdraw consent — where processing is based on consent

To exercise any of these rights, email hello@pluged.ai. We will respond within one month, as required by law. We may need to verify your identity before fulfilling a request.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk. You do not need to prove financial loss to raise a concern with the ICO about how your data has been handled.

11. Children

Pluged AI is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this notice

We may update this notice from time to time. The "Last updated" date below will change when we do. Material changes will be highlighted on this page. Continued use after an update constitutes acknowledgement of the revised notice where permitted by law.

13. Contact

Questions about this notice or your personal data: hello@pluged.ai

For a GDPR-focused summary of your rights, see our GDPR & data protection notice.