Privacy Policy

Effective: June 20, 2026 · Last updated: October 27, 2026 · Version: 1.1 · Controller: Plugsky Inc. (Newark, DE, USA)

1. Who we are

Plugsky is a deploy-anywhere AI platform operated by Plugsky Inc., a Delaware corporation registered at 131 Continental Dr, Suite 305, Newark, DE 19713, United States. For the purposes of GDPR and equivalent data-protection law, Plugsky is the data controller for personal data you provide when you create an account, and the data processor for content you submit to our inference APIs (prompts, files, RAG documents) on behalf of your organization.

2. What we collect

We collect three categories of data:

a) Account data (what you give us)

• Email address — used to sign in, send service notifications, billing receipts, and security alerts.
• Password — stored as a one-way bcrypt/argon2 hash. We never store plaintext. We never email your password.
• Name, company, locale — optional profile fields.
• OAuth profile (if you sign in with Google): your Google account ID, display name, email, and avatar URL.
• Billing data — last 4 digits of payment card, card brand, billing postal code (processed by Stripe; we never see full PAN).

b) Service data (what you send us)

• Prompts and messages you send to /v1/chat/completions, /v1/embeddings, and other inference endpoints.
• File uploads for RAG (Knowledge) — text, PDFs, code, or any other content you upload.
• Generated completions returned to you.

c) Telemetry (what the system records)

• Request metadata: timestamp, endpoint, model, response status, latency, token counts, request ID.
• Operational logs: errors, rate-limit hits, security events.
• Aggregated usage: tokens per day, per model, per workspace — used for billing and capacity planning.

3. What we do NOT do

This is the part most providers bury. We state it plainly:

• ❌ We do not use your prompts, completions, or RAG documents to train, fine-tune, evaluate, or improve any AI model — ours, our providers', or anyone else's.
• ❌ We do not sell your personal data or your service data to third parties, data brokers, or advertisers.
• ❌ We do not permit upstream model providers to use your prompts or completions to train or improve their models. Paid and Enterprise routes use no-training terms where the provider offers them. Free-tier failover providers may retain short-lived request logs for abuse prevention under their own terms; they are not permitted to train on your data.
• ❌ We do not read or display your prompts to anyone other than the model you selected and our automated abuse-detection systems (which only flag, not store, content).

4. How we use data

5. Legal bases (GDPR)

If you are in the EEA, UK, or a jurisdiction with similar laws, our lawful bases are:

• Contract — to provide the service you signed up for.
• Legitimate interest — to keep the service secure, prevent abuse, and improve it. You can object; we'll stop unless we have a compelling override.
• Legal obligation — to comply with applicable law (tax, sanctions, lawful government requests).
• Consent — for optional features (marketing emails, third-party cookies, optional integrations).

6. Sharing & sub-processors

We share data only with vetted sub-processors who are contractually bound to protect it. Current sub-processors:

How failover works: a request normally goes to NVIDIA first. If that route is unavailable, Plugsky may try one of the failover providers above. Free-tier providers can change their retention terms; where they retain logs, it is for abuse prevention, not model training. Enterprise customers can contract for a restricted provider set or in-region routing.

GPU Share: GPU Share jobs run on independent operators' hardware. Operators receive only the job payload, are bound by the GPU Share operator terms to process it for that job only, and are prohibited from retaining it or training on it. Enterprise customers can exclude GPU Share routing.

We will notify you at least 30 days before adding a new sub-processor that handles Service Data.

7. International transfers

Data may be processed in the UAE, EU, US, or KSA depending on the routing path your request takes. When we transfer personal data out of the EEA/UK, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• UK International Data Transfer Addendum where applicable.
• The EU-US Data Privacy Framework for US transfers (where the recipient is certified).
• For Enterprise customers, a signed DPA that may specify a particular region for in-region routing.

8. Retention

9. Your rights

You can:

• Access — request a copy of all personal data we hold about you.
• Rectify — correct inaccurate data via your dashboard or by emailing us.
• Erase — delete your account and all associated data. Account deletion is permanent and removes your API keys, RAG data, and configuration. Anonymized usage metadata may remain for billing integrity.
• Restrict — pause processing while we resolve a dispute.
• Port — export your RAG documents, agent definitions, and config as JSON / files.
• Object — to processing based on legitimate interest.
• Withdraw consent — at any time, for any consent-based processing.
• Lodge a complaint — with your local data protection authority. We'd appreciate the chance to fix it first; email privacy@plugsky.com.

To exercise any of these rights, sign in and visit Settings → Privacy, or email privacy@plugsky.com. We respond within 30 days.

10. Security

We protect your data with:

• TLS 1.3 encryption in transit (HSTS enforced).
• AES-256 encryption at rest on all storage volumes.
• API keys stored as SHA-256 hashes — we cannot recover them, only you can.
• Passwords hashed with Argon2id (or bcrypt as fallback).
• Two-factor authentication (TOTP) for all admin accounts.
• Role-based access control (RBAC) and per-key scopes.
• Audit logs for every administrative action; immutable for the retention period.
• Annual third-party penetration tests; findings remediated within 30 days of report.
• 24×7 security monitoring with automated abuse detection.

Report a vulnerability to security@plugsky.com. We run a responsible disclosure program.

11. Cookies

We use only strictly necessary cookies (session ID, CSRF token) and analytics cookies (self-hosted, anonymized, no cross-site tracking). We do not use advertising cookies, third-party tracking pixels, or Facebook/Google Analytics. You can disable analytics in Settings → Privacy.

12. Children

Plugsky is not directed at children under 16 (or older where local law requires). We do not knowingly collect data from children. If you believe a child has created an account, email privacy@plugsky.com and we will delete it within 7 days.

13. Changes to this policy

We will notify you by email at least 30 days before any material change takes effect. The full version history is available at /legal/privacy/history. Minor clarifications (typos, contact emails) do not require notice.

14. Contact

Data Protection Officer
Plugsky Inc. · 131 Continental Dr, Suite 305, Newark, DE 19713, United States
Email: privacy@plugsky.com
Postal: 131 Continental Dr, Suite 305, Newark, DE 19713, United States

For users in the EU, our GDPR representative can be reached at eu-rep@plugsky.com.

This policy is provided in English. Translations are available on request; in case of conflict, the English version prevails.