Privacy policy

Version: 24 October 2026

This policy describes how we process personal data on the website getplinio.com and in the plinio® TL application at plinio.app.

1. Controller

Bureau Wehrmann
Owner Dennis Wehrmann
Bahnhofstraße 159
86438 Kissing
Germany

Phone: +49 8233 7395511
Email: info@getplinio.com

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Your rights

Under the GDPR you have the right to:

• access the data we process about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing based on legitimate interests (Art. 21)
• withdraw consent with effect for the future (Art. 7 (3))

To exercise these rights, contact info@getplinio.com.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

3. Visiting the website

3.1 Hosting and server logs

The website is delivered via Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary data:

• IP address
• date and time of access, page requested
• browser, operating system, referrer URL

This processing serves secure and fast delivery and the defence against attacks. The legal basis is Art. 6 (1) (f) GDPR. Cloudflare processes the data on our behalf under a data processing agreement; transfers to the USA rely on the EU-US Data Privacy Framework. Log data is deleted after 7 days at the latest.

All fonts are served from our own hosting; no third-party font service is contacted.

3.2 Cookies

The website does not set cookies for analytics or marketing and does not use a consent tool. Only if you object to audience measurement (section 3.3) does a technically necessary cookie store your objection. The legal basis is section 25 (2) no. 2 TDDDG in conjunction with Art. 6 (1) (f) GDPR.

3.3 Audience measurement with Matomo

We measure use of the website with the open-source software Matomo, which we operate ourselves on servers in the EU. Matomo is configured without cookies and does not read any information from your device. We process:

• IP address, shortened by the last two bytes
• pages visited and time spent
• referrer, browser and operating system
• approximate location at city level

The legal basis is Art. 6 (1) (f) GDPR (interest in improving the website). You can object at any time using the opt-out on this page. The data is deleted after 24 months.

3.4 Forms (Narrative Audit, contact, hosting enquiry, agency waitlist)

Through our forms we process:

• website address (Narrative Audit only)
• agency name (agency waitlist only)
• business email address
• market or topic area (optional)
• up to three competitors (optional)
• message (optional)
• number of client mandates (agency waitlist only, optional)
• time of the request

The details are sent to a server function at Cloudflare and stored as a contact in Brevo (section 3.5), where we handle the request. For the Narrative Audit, we analyse the website you state and the public presence of the competitors you name.

The legal basis is Art. 6 (1) (b) GDPR (steps prior to entering into a contract) or Art. 6 (1) (f) GDPR (answering your request). We delete the data when the request has been completed and no contract is concluded, at the latest after 12 months. If a contract is concluded, the statutory retention periods apply (up to 10 years for tax-relevant records).

3.5 “Early Signal” newsletter (Brevo)

For the newsletter we process your email address, the time of registration and confirmation, and the IP address at registration (as proof). Registration uses the double opt-in procedure: you only receive the newsletter after clicking the link in the confirmation email. We evaluate whether a newsletter was opened and which links were clicked in order to improve the content.

The service provider is Brevo (Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany). The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time via the unsubscribe link in every newsletter or by email to info@getplinio.com. After you unsubscribe, we delete your address; we keep proof of consent for up to three years (Art. 6 (1) (f) GDPR).

4. Using plinio TL (plinio.app)

4.1 Roles

We are the controller for your account data, billing and the security of the Service. For content you bring into plinio TL that contains personal data (such as documents, texts, names of contacts), we process the data as a processor on behalf of your company under a data processing agreement (Art. 28 GDPR). Your company is then the controller.

4.2 Account and login

We process email address, name, company, role in the organisation, login times and technical session data. Login is by email link or password. We send system emails (login, notifications) via Resend (Resend, Inc., USA); transfers to the USA rely on standard contractual clauses.

The legal basis is Art. 6 (1) (b) GDPR. After the account is deleted, we delete the data within 30 days unless a retention obligation applies.

4.3 Free trial and payment

We do not need payment details for the trial. If you book a plan, we process payment via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). Stripe does not pass your payment details (such as card number or IBAN) to us; we only receive name, billing address, VAT ID, amount and payment status. The legal basis is Art. 6 (1) (b) and (c) GDPR (contract, tax obligations). Stripe is certified under the EU-US Data Privacy Framework. We keep billing records for 10 years (section 147 of the German Fiscal Code).

4.4 Company profile and public sources

At the start, plinio TL builds a profile of your company from your website and your public LinkedIn presence and researches competitors and your market in public sources (news, trade publications, registers, search engines). Names and public statements of individuals, such as managing directors or authors, may be processed in the process. The legal basis is Art. 6 (1) (b) GDPR towards you and Art. 6 (1) (f) GDPR towards the third parties concerned (interest in analysing markets and topics based on publicly available information).

4.5 Creating content with AI models

For research, topic selection, briefs and drafts, we transmit the content required in each case (your profile, briefings, documents, drafts) to AI models from established providers. The content is transmitted in encrypted form. The full list of subprocessors is part of the data processing agreement.

• Standard workspaces: providers in the EU and the USA. Transfers to the USA rely on the EU-US Data Privacy Framework or EU standard contractual clauses.
• EU-only workspaces (for regulated industries, on request): processing takes place exclusively through providers processing in the EU. If a request cannot be processed within the EU, it is not executed.
• On-premise (on request): the application runs in your own infrastructure; which data is sent to us or to AI providers is governed by the individual contract.

The AI providers in use are OpenAI (USA), Anthropic (USA), Google (Gemini; Ireland/USA), Mistral AI (France) and Perplexity (USA). Data processing agreements are in place with all of them; transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses.

The legal basis is Art. 6 (1) (b) GDPR or the data processing agreement. The providers are contractually obliged not to use the content to train their models. Learning happens only within plinio TL, for your workspace (section 4.6). Content remains stored as long as you keep it in your account; you can delete it at any time.

4.6 Memory bank

When you save a changed draft, we store the text before and after the change, a short summary of the change and the draft settings. From substantial changes, we derive writing patterns and store them for your user account; members of your organisation can see them. Patterns are never used for other customers. Text pairs are deleted with the draft, derived patterns with your account. The legal basis is Art. 6 (1) (b) GDPR.

4.7 Impact measurement (SEO and GEO)

If you use measurement, we retrieve public search results and AI assistant answers on your topics and evaluate whether your content appears. You add trackable URL parameters (UTMs) to your links yourself; the evaluation takes place in your own analytics tool. We do not process personal data of readers of your content in the process.

4.8 Hosting of the application

We operate the application, its database and the login ourselves on servers of a data centre operator in Germany, with whom a data processing agreement is in place. Data only reaches the USA through the AI providers and service providers named above.

4.9 Support

We handle support requests by email to perform the contract (Art. 6 (1) (b) GDPR) and keep them for 3 years.

5. Data security

All connections to the website and the application are encrypted with TLS. We use technical and organisational measures to protect your data against loss, manipulation and unauthorised access and keep them up to date with the state of the art.

6. Transfers to third countries

Transfers to countries outside the EU and the EEA only take place if there is an adequacy decision of the EU Commission (such as the EU-US Data Privacy Framework), appropriate safeguards under Art. 46 GDPR exist (such as EU standard contractual clauses) or an exception under Art. 49 GDPR applies. Details are given for each service.

7. Changes

We adapt this policy when the law or our Service changes. The version published here applies. We inform existing customers by email about material changes that affect them.

8. Privacy questions

info@getplinio.com