Plugpass Privacy Policy

Your privacy matters to us. This privacy policy explains how Favonian, Inc., a Delaware corporation ("Plugpass," "we," "us," or "our"), collects, uses, shares, and protects your information when you visit plugpass.ai, create a Plugpass account as a publisher's team member or an affiliate, use the publisher dashboard and tooling, or otherwise interact with us (collectively, the "Services"). It also explains the choices you have about your information. If you do not agree with this privacy policy, do not use the Services.

If you are an end user of a publisher's plugin, see "End users of publishers' plugins" below. Plugpass provides the platform independent plugin creators ("Publishers") use to offer, sell, and distribute their plugins. Your account for a plugin, your purchases, and the plugin's pages are the Publisher's; Plugpass operates them on the Publisher's behalf and under its instructions, as its service provider (processor), and the Publisher's own privacy policy — presented on the plugin's pages — governs that information. This policy describes Plugpass's own practices as a controller of the information it holds about publishers, affiliates, and visitors, and the purposes for which it is also a controller of information about publishers' end users.

Information we collect

We collect information you provide to us, information we collect automatically when you use the Services, and information we receive from other sources.

Information you provide.

• Account information. When you create a Plugpass account, we collect your name and email address, and any optional profile details you add (such as a display name or profile photo). You may create your account directly or by signing in with Google (see "Information from other sources").
• Publisher and affiliate information. When you register a publisher account or join the affiliate program, we collect the information needed to operate that relationship — your publisher's name and support contact, your plugins' configuration, and the identity, payout, and tax information our payment provider (Stripe) collects to onboard your connected account or affiliate account. If you add a billing method to your publisher account, we hold it with our payment provider (Stripe) on our own account, along with the cardholder name and billing address you provide, and charge it for the affiliate commission settlements you authorize. Plugpass does not collect or store full payment card or bank account numbers.
• Support information. When you contact us for support or otherwise communicate with us, we collect the information you choose to provide, such as your contact details and the contents of your message.

Information we collect automatically.

• Usage information. We collect information about how you use the Services, including the dashboard pages and features you use and the actions you take.
• Device and connection information. We collect your IP address, browser type and settings, device identifiers, operating system, and similar technical information.
• Cookies and similar technologies. We use first-party cookies to operate the Services — for example, to keep you signed in, to secure your session, to remember your preferences, and to measure how the Services are used — and to credit an affiliate who referred you. Where consent is required, we set non-essential cookies only with your consent. We do not use cookies for third-party tracking or cross-context behavioral advertising.
• Security and authentication logs. We collect information to verify and authenticate your access and to detect and prevent fraud, abuse, and security incidents.

Information from other sources.

• Google SSO. If you sign in using your Google account, Google provides us with your name and email address as permitted by your Google settings, to authenticate you. Google's handling of your information is governed by Google's own privacy policy.
• Publishers. A Publisher may provide us with information relating to you in connection with our agreements with it (for example, when it adds you to its team or approves you as an affiliate).
• Payment processor. Stripe provides us with information about your connected or affiliate account (such as its onboarding status and payouts), and about the billing method you add to your publisher account (such as its card brand, last four digits, and expiration), so we can operate the Services.

How we use information

We use the information we collect for the purposes below.

We do not use your information to train artificial-intelligence or machine-learning models. Plugins run within your own Claude (Anthropic) environment; your interactions with Claude are governed by your own agreement with Anthropic, and Anthropic is not our service provider for that activity.

End users of publishers' plugins

If you sign up for, purchase, or use a Publisher's plugin, the Publisher is the controller of your information for that plugin, and its privacy policy (linked from the plugin's pages) governs. Plugpass has no account or customer relationship with you as an end user: we operate the plugin's accounts, sign-in, purchases, subscriptions, entitlements, and pages on the Publisher's behalf and under its instructions, as its service provider (processor), under a data processing addendum in our Publisher Terms.

• What we process for the Publisher. Your account and sign-in details (email address, credentials, verification codes, sessions), your acceptance of the plugin's terms, your purchases, subscriptions, and entitlements and your usage of the plugin's gated features, billing details other than full payment-card numbers (which Stripe holds on the Publisher's account), and the transactional email we send you for the Publisher (sign-in codes, billing notices) under the plugin's name.
• Requests. Because the Publisher is the controller, direct requests about your account or your information — access, correction, deletion, and any other right — to the Publisher, using the contact on the plugin's pages; you can also delete your account for a plugin from its account page. If you contact us directly, we route your request to the Publisher and assist it as its processor.
• Our own purposes. Plugpass is also an independent controller of information about your use of a Publisher's plugin, which it processes to operate, secure, analyze, and improve the platform, to prevent fraud and abuse, and to comply with law.
• Providers. In processing your information for the Publisher we use the service providers listed under "How we disclose information" below (Cloudflare, Neon, Brevo, Sentry, and Mixpanel), as the Publisher's subprocessors; the current list is on our subprocessor page. Payments for a Publisher's plugin are processed by the Publisher's own payment processor (Stripe) under the Publisher's agreement with it; we transmit the payment and billing information needed to process your purchases to it on the Publisher's instructions.

How we disclose information

We disclose information as described below. We do not sell your personal information, we do not "share" it for cross-context behavioral advertising, and we do not engage in targeted advertising.

• To Publishers, as their processor. Information about a Publisher's end users is the Publisher's; we make it available to the Publisher through its dashboard and tooling and otherwise process it on its instructions (see "End users of publishers' plugins"). Under our Publisher Terms, Publishers may not sell or syndicate that information and must honor opt-out and deletion requests.
• Service providers we use to run the Services. We share information with third-party service providers that process it on our behalf, under written data-processing terms, to help us operate and deliver the Services, for the purposes described above: Stripe (payment processing), Cloudflare (hosting, edge delivery, storage, and caching), Neon (database hosting), Brevo (transactional email), Sentry (error monitoring), and Mixpanel (product improvement, fraud and abuse detection, and customer support). The current list of the providers that process information on our behalf is on our subprocessor page.
• The Claude runtime. Plugins operate within your own Claude environment provided by Anthropic. Anthropic is not our service provider for that activity; your use of Claude is governed by your agreement with Anthropic.
• For legal and safety reasons. We may disclose information to government authorities, law enforcement, or others where we believe it is reasonably necessary to comply with applicable law or legal process, to enforce our terms and policies, to protect the security and integrity of the Services, to protect Plugpass, our users, or the public from harm or illegal activity, or to respond to an emergency.
• In a business transfer. We may disclose or transfer information in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets. We will notify you of any such transaction that materially affects your information.
• With your consent. We disclose information to other parties when you direct us to or otherwise consent.

How we store and secure information

We use industry-standard technical and organizational measures designed to protect the information we hold. No security system is impenetrable, however, and we cannot guarantee the absolute security of information transmitted to or stored with us.

How long we keep information

We retain information for as long as your account is active and for a reasonable period afterward, and as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. When we no longer need information, we delete or de-identify it, or, where that is not feasible (for example, because it is held in backups), we securely store and isolate it from further use until deletion is possible.

Your rights and choices

Depending on where you live, you may have rights regarding your personal information, including to request access to or a copy of it, to correct it, to delete it, and to opt out of certain disclosures. You can access and update much of your account information, and delete your account, in your account settings. To make any other request, email us at support@plugpass.ai.

• Opt out of marketing. You can opt out of promotional emails using the unsubscribe link in any such message or by contacting us. You will still receive transactional messages about your account and the Services.
• Your account with a Publisher. For your account and information for a Publisher's plugin, exercise your rights with that Publisher (see "End users of publishers' plugins"); each Publisher is responsible for its own compliance, and we assist it as its processor.

To protect your information, we verify your identity before fulfilling a request, typically by confirming control of the email address associated with your account. If we cannot verify your identity, we may be unable to complete your request.

Our policy toward children

The Services are not directed to, and may not be used by, anyone under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us personal information, contact us at support@plugpass.ai and we will take steps to delete it.

Regional disclosures

United States

These disclosures supplement this policy for U.S. residents where required by state privacy laws (such as the California Consumer Privacy Act, as amended). The following chart describes the categories of personal information we collected in the past 12 months, the purposes for collecting and disclosing it, and the categories of recipients to which we disclosed it for business purposes. We did not "sell" or "share" personal information (as those terms are defined under U.S. state privacy laws) in the past 12 months.

Information about publishers' end users is processed on the respective Publisher's behalf as described in "End users of publishers' plugins"; the Publisher's own privacy policy provides its disclosures.

We do not use or disclose sensitive personal information for purposes other than those permitted under applicable law. U.S. residents have the rights to know, access, correct, and delete personal information, to opt out of any sale, sharing, or targeted advertising (which we do not engage in), to non-discrimination for exercising these rights, and to appeal a denied request. To exercise these rights, email us at support@plugpass.ai. You may also use an authorized agent to submit a request on your behalf; we may verify your identity directly and require proof of the agent's authority to act for you. There is no accepted standard for responding to "Do Not Track" browser signals, and we do not respond to them.

European Economic Area and the United Kingdom

These disclosures supplement this policy for individuals in the European Economic Area (EEA) and the United Kingdom (UK). For the purposes of the EU and UK General Data Protection Regulation (GDPR), Plugpass is the controller of the personal information it processes about you as described in this policy.

Legal bases. We process your personal information on the legal bases identified in the "How we use information" table above: to perform our contract with you (to provide the Services and your account and to facilitate payments); for our legitimate interests (to develop, improve, secure, and troubleshoot our products and the Services, to prevent fraud and abuse, and to communicate with you about the Services), where those interests are not overridden by your rights; to comply with our legal obligations; and, where we ask for it, with your consent. For a Publisher's end users, Plugpass acts as the Publisher's processor except for the limited own purposes described in "End users of publishers' plugins", for which it relies on its legitimate interests and legal obligations.

Your rights. Subject to the GDPR, you have the rights to access your personal information, to correct it, to erase it, to restrict or object to our processing of it (including processing based on our legitimate interests, and processing for direct marketing, which you may object to at any time), to data portability, and — where processing is based on your consent — to withdraw that consent at any time. You also have the right to lodge a complaint with your local data-protection supervisory authority. To exercise your rights, use the controls described in "Your rights and choices" above or email us at support@plugpass.ai.

International transfers. We are based in, and process personal information in, the United States, and our service providers may process it in the United States and other countries. Where we transfer personal information from the EEA or the UK to a country that has not been recognized as providing an adequate level of protection, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum — as implemented in our agreements with the service providers that process personal information on our behalf.

Changes to this privacy policy

We may update this privacy policy from time to time. We will post the updated policy here and, if the changes are significant, provide a more prominent notice (such as a notice on the Services or an email). Your continued use of the Services after the effective date constitutes acceptance of the updated policy.

How to contact us

If you have questions or concerns about this privacy policy or our handling of your information, or to exercise your rights, contact us at support@plugpass.ai or Favonian, Inc., 251 Little Falls Drive, Wilmington, DE 19808.