Privacy

What we hold

Two things. The first is your workspace: the apps, tables, automations, documents, messages, files and records you and your team put into Plyxl. The second is your account: your name, your email address, the workspace you belong to, your plan, and the ordinary logs a service keeps to stay up and to bill correctly, such as timestamps, IP addresses and error traces.

We do not buy data about you, and we do not sell or rent what you give us.

Where it is stored

Everything in your workspace lives in a managed Postgres database and object store run by Supabase, hosted on Amazon Web Services in us-east-1, Northern Virginia, United States. It is encrypted in transit with TLS and encrypted at rest on disk. Each row is scoped to a workspace, so one workspace cannot read another’s.

If you need your data held in a particular country or region, that is an Enterprise plan conversation. Write to us and we will tell you plainly whether we can do it.

The tools you connect

When you connect Gmail, a calendar, a CRM or anything else, you grant Plyxl a set of permissions through that provider’s own consent screen. We store the resulting access token, encrypted at rest, and use it only to do the work you or your agent asks for inside those permissions. We do not read beyond the scopes you granted, and we do not copy an entire account across unless you ask us to sync it.

Disconnect a tool at any time and we delete its tokens. You can also revoke Plyxl from the provider’s side, which cuts our access immediately.

Gmail and Google Calendar

When you connect Gmail or Google Calendar, Plyxl reads your mail and your events through our sign-in partner, Composio, so it can show them to you in Plyxl and do the work you or your agent ask for. Plyxl’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain words:

• We use your Google data only to provide the features you asked for.
• We pass it on only to the companies listed below that are needed to do that work, such as OpenAI when you ask the agent about an email.
• We never sell it, and never use it for advertising.
• We never use it to train AI models, ours or anyone else’s.
• No person at Plyxl reads it, unless you ask us to, it is needed to deal with abuse or a security problem, or the law requires it.

The agent and AI models

When you ask the agent to do something, your instruction and the workspace content needed to answer it are sent to OpenAI’s API to produce the response. OpenAI does not use data submitted through its API to train its models, and neither do we. We do not train any model on your workspace, and we do not use your content to improve the product for anyone else.

Who else processes it

These are the companies that handle data on our behalf. Each is bound by a data processing agreement and each is used for the one job listed.

• SupabaseDatabase, file storage and sign-inAWS us-east-1, United States
• OpenAIThe models behind the agentUnited States
• ComposioThe connections to your other toolsUnited States
• StripeSubscription payments and billingUnited States
• FirecrawlReads your business’s website when you set upUnited States
• VercelHosting, and the sandbox that runs browser automationUnited States
• Apple (APNs)Push notifications to the mobile appUnited States
• ExpoDelivering push notifications to the mobile appUnited States
• Google (Gmail)The mailbox Plyxl sends its own outbound email fromUnited States
• CloudflareServing plyxl.comGlobal edge network
• PostHogUsage counts, and masked session replay outside the EU, EEA, UK and SwitzerlandUnited States

How long we keep it

Workspace data is kept while your account is open. Delete something and it goes from the live database; encrypted backups roll off within 30 days. Close your account, or write to us asking for deletion, and we remove the workspace within 30 days, except where we must keep an invoice or a record to satisfy tax or accounting law.

Your rights

You can ask for a copy of what we hold, ask us to correct it, or ask us to delete it. If you are in the UK, the EU or the EEA, you have those rights under the GDPR; if you are in California, you have them under the CCPA. Either way the route is the same: email team@plyxl.net and we will answer within 30 days.

Cookies and analytics

The app sets the cookies needed to keep you signed in. Both this site and the app use PostHog to count which pages and features get used and where people get stuck, so we can make Plyxl better. Those counts never include anything you typed or anything in your workspace.

In the app, for visitors outside the EU, the EEA, the UK and Switzerland, PostHog also records masked session replays and clicks: the shape of how a screen was used, with every piece of text and every input masked in your browser before it is sent. Apps you build and email messages are never recorded at all. Sessions on this site are never recorded. We use replays only to find and fix problems, never to read your data. If you would rather we did not record your sessions or count your usage, email team@plyxl.net and we will turn it off for your account.

Security

TLS everywhere, encryption at rest, access to production limited to the people who need it, and workspace isolation enforced in the database rather than only in the application. If you believe you have found a vulnerability, write to team@plyxl.net and we will treat it as the first thing we do that day.

Changes

If this policy changes in a way that matters, we will update the date at the top of this page and tell account owners by email before it takes effect.

Contact

Plyxl, team@plyxl.net. Our team reads that inbox.