Privacy Policy

We collect only what is necessary to deliver the Plenza service:

• Account information (name, email) for authentication and billing.
• Scripts and scene lines you upload to generate AI reader tracks.
• Audio/video recordings you create using our off-camera reader.
• Usage data (e.g., shot-type preferences, pacing settings) to improve performance.

Your material is used solely to operate Plenza for you:

• Generating adaptive AI reads with action and cut cues.
• Exporting audition-ready audio balanced for self-tape.
• Storing your personal vault of past scenes and settings.

We do not sell, rent, or share your scripts or recordings with third parties for marketing or advertising.

Everything you upload is encrypted at rest using industry-standard AES-256 encryption. Data in transit is protected with TLS 1.3. Access to production systems is restricted to authorized engineers and monitored with audit logging.

You control retention for your own material: scripts, audio, and video stay in your personal vault until you delete them or close your account. We do not run a background timer that auto-deletes your creative content while your account is active. When you delete an item, or your account, the data is purged from active storage immediately and from backups within 30 days.

Your material is yours alone. Plenza does not use your uploaded lines, audio, or video to train third-party models. We use licensed neural voice providers under strict data-processing agreements that prohibit retention or training on customer content.

We do not make automated decisions that produce legal or similarly significant effects on you (UK GDPR / GDPR Art. 22). The AI reader is a creative tool: it generates audio from your scripts. It does not score, rank, profile, or gate access to anything based on your material.

We distinguish two types of cookies and similar storage:

• Essential (cannot be disabled): authentication session (browser localStorage, not a cookie), CSRF protection, and Cloudflare's __cf_bm bot-management cookie. Without these the app can't keep you signed in or block abuse.
• Analytics (optional, off by default in the EU/UK/California): first-party event tracking via PostHog to help us improve the product. No third-party ad pixels, no cross-site tracking. You can change your choice anytime from the cookie banner or from /preferences.

EU / UK (GDPR & UK GDPR): you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing, to withdraw consent, and to lodge a complaint with your supervisory authority. The legal bases we rely on (GDPR Art. 6) are contract performance (running your account and billing), legitimate interest (security, opt-out product analytics), and consent (marketing emails, optional cookies).

UK supervisory authority: if you are in the UK and believe we have mishandled your personal data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by phone on 0303 123 1113. EU users can complain to their national data protection authority.

California (CCPA / CPRA): you have the right to know, delete, and correct your personal information, to opt out of any sale or sharing (we don't sell or share), to limit use of sensitive personal information, and to be free from discrimination for exercising these rights.

How to exercise: submit access, portability, or deletion requests at /privacy/data-requests, manage email preferences at /preferences, or email privacy@plenza.io. We respond within 30 days (GDPR) or 45 days (CCPA).

We use the following vetted providers to deliver Plenza. Each is bound by a data-processing agreement (and Standard Contractual Clauses for international transfers where applicable):

• Supabase — database, authentication, file storage (US / EU regions)
• Stripe — payments and subscription billing (global)
• GetResponse — marketing email (opt-in only) (Poland / EU)
• Lovable AI Gateway — AI text generation (US)
• Cloudflare — CDN, DDoS protection, bot management (global edge)
• PostHog — product analytics (US; only when you opt in)

We give 30 days' notice before adding a material new sub-processor.

Plenza is an 18+ product. The minimum age to create an account is 18, regardless of jurisdiction. We require explicit age attestation at signup and on every protected request; accounts that don't meet this requirement are not created.

For reference, the digital-consent age under each privacy regime is: 13 in the UK (UK GDPR / DPA 2018 s.9) and the US (COPPA); 13–16 across EU member states (GDPR Art. 8). Our 18+ floor sits above all of these.

• If we learn that someone under 18 has created an account, we delete the account and all associated data within 7 days.
• Parents or guardians who believe their child created an account can email privacy@plenza.io and we'll delete it on receipt, with confirmation.

To exercise any right, email privacy@plenza.io from your account email, or use the controls at /preferences and the "Delete my data" button above.

If we make material changes, we will notify you by email or via an in-app alert at least 30 days before they take effect. Continued use of Plenza after the effective date constitutes acceptance of the updated policy.

Questions about this policy? Reach out at privacy@plenza.io or by mail at Plenza Privacy, 1200 Casting Blvd, Suite 400, Los Angeles, CA 90028.