Privacy Policy

Last updated: September 17, 2026

1. Information We Collect

Account Information

When you register, we collect your name, email address, and password. When you create participant profiles, we collect business information such as company name, industry, territories, and contact details.

Integration Data

When you connect third-party services (Shopify, QuickBooks, Stripe, etc.), we receive and store OAuth access tokens and the data you authorize us to access (orders, products, invoices, contacts). Access tokens are encrypted at rest using AES-256-GCM encryption.

Usage Data

We collect standard usage data including pages visited, features used, and interaction patterns to improve the platform.

2. How We Use Your Information

  • To provide and maintain the Plasi platform
  • To match you with relevant business opportunities
  • To facilitate orders, attributions, and commission tracking
  • To sync data from connected third-party integrations
  • To send transactional emails (order updates, notifications)
  • To improve platform features and user experience

3. Data Sharing

We do not sell your personal information. We may share data in these limited circumstances:

  • With other Plasi users: Profile information, opportunities, and order details you choose to share through the platform
  • With connected services: Data necessary to maintain integrations you have authorized
  • Service providers: Hosting (Vercel), database (Supabase), email (Resend) — bound by data processing agreements
  • Legal requirements: When required by law or to protect our rights

4. Data Security

We implement industry-standard security measures including:

  • AES-256-GCM encryption for OAuth tokens and integration credentials
  • HTTPS encryption for all data in transit
  • Secure session management with JWT tokens
  • HMAC-SHA256 webhook signature verification
  • Role-based access controls

5. Third-Party Integrations

When you connect a third-party service, you authorize Plasi to access specific data as defined by the OAuth scopes you approve. You can revoke access at any time by disconnecting the integration in your Plasi settings or revoking access from the third-party service directly.

Each third-party service has its own privacy policy. We encourage you to review them before connecting.

6. Data Retention

We retain your data for as long as your account is active. Upon account deletion, we remove your personal data within 30 days, except where retention is required by law. Integration tokens are deleted immediately upon disconnection.

7. Your Rights

You have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate information
  • Delete your account and associated data
  • Export your data in a portable format
  • Disconnect third-party integrations at any time
  • Opt out of non-essential communications

8. Cookies and Affiliate Attribution

We use essential cookies for authentication and session management. When you arrive through a creator's tracking link we set a first-party attribution cookie (plasi_aff) for the window the seller has chosen, so the creator is credited if you buy from that seller. We log the click with a hashed IP address, your browser's user agent and the referring page, and, if you are signed in, your account, so a purchase you make on another device inside the window can still be attributed. We do not use third-party tracking or advertising cookies.

8a. Payments, Payouts and Marketplace Records

Card payments, subscriptions, boosts and payouts are processed by Stripe; Plasi never sees full card numbers. We keep order, escrow, dispute, commission and payout records for as long as needed for accounting, dispute resolution and legal obligations. Messages between members, including attached listing or order cards, are stored so both parties can refer back to what was agreed; the platform's moderators may review reported messages.

9. Children's Privacy

Plasi is not intended for users under 18. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this privacy policy periodically. We will notify you of material changes via email or platform notification.

11. Contact

For privacy-related inquiries, contact us at victor@plasi.io.

← Back to Plasi