This Privacy Policy explains how Pluma ("we", "us", "our") collects, uses, and protects personal data when you use our service. We are based in the European Union and Pluma is operated under EU and German law (BDSG).
1. Who we are
Controller: The data controller is Rheinsight Inh. Mert Dalbudak, Böckingstr. 52, 51063 Köln, Deutschland. The full legal identification (including, where applicable, the VAT identification number) is in the Legal Notice.
Contact: [email protected] — for any data-protection question or to exercise your rights under GDPR.
2. What we collect
You give us
- Account data: email, first and last name, salutation (optional), encrypted password (when not using OAuth), OAuth provider IDs (Google / Apple), preferred language.
- Workspace data: workspace name + slug, members, roles, API key labels, support ticket content.
- Template data: PDFs you upload, field positions you draw, and the JSON inputs you send to the render API. This is your data — we treat it as confidential and process it only to provide the service.
- Billing data: when you start a paid subscription or top up your render balance, our payment processor Stripe collects your billing address and, optionally, your VAT identification number — we are legally required to capture these to issue tax-compliant invoices (§14 UStG, EU VAT Directive). Card details are entered directly into Stripe and never reach our servers; we hold your Stripe customer ID, billing address, VAT ID and invoice metadata.
Signers — data we process on behalf of our customers
When a Pluma customer sends you a document to sign, that customer is the controller of your data and we process it on their behalf under our Data Processing Agreement. We store the name, email address and language the sender entered, the document itself, your signature (typed or drawn), whether you signed or declined and any reason you gave, and — so the signature can be verified later — the date and time, IP address and browser details when you sign or decline. When you first open the document we record the date and time, your browser details and a truncated IP address (the last part is removed, so it points to your network but not to your device). The certificate of completion attached to the signed document shows IP addresses only partially (for example 203.0.113.xxx). The sign page tells you this before you sign, and a copy of the signed document is emailed to you. The sender's workspace also remembers your name and language so a later request to the same address is pre-filled. Please direct access or erasure requests to the sender; we help them answer.
Online cancellation
When you use the cancellation page (/cancel), we process the first and last name, email address and, if given, customer number you enter, the type of termination, any reason and the requested end date, together with the time of receipt. We use them to identify your contract, to carry out and confirm the cancellation, and to prevent cancellations by others (Art. 6(1)(c) GDPR in conjunction with § 312k BGB; Art. 6(1)(f) GDPR). If the details match an account, the account holder is informed by email — also when the cancellation could not be processed. We keep each declaration as evidence until the end of the third calendar year after its receipt, then delete it.
We collect automatically
- Server logs (IP, user agent, request path) for security and debugging. Retained 30 days.
- Render usage counts (per workspace, per month) for billing and quotas.
- Audit logs for admin actions performed on your workspace.
- Licence check-ins from self-hosted installations (a hash of the licence key and the software version, once a day). We record when each check-in arrived and from which IP address, so a key in use from many places can be spotted.
Children
Pluma is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16 — the age from which consent under Art. 8 GDPR can be given in Germany — and registration requires confirming that you are at least 18 or act for a company. If you believe a child has registered, or that a document was sent to a child for signature without a lawful basis, write to [email protected] and we will delete the data. Senders remain responsible for the legal basis of their signers, including the consent of a parent or guardian where it is required.
3. Why we use it (legal basis)
- Performance of contract (Art. 6(1)(b) GDPR): rendering PDFs, hosting templates, processing payments.
- Legitimate interest (Art. 6(1)(f)): security logging, fraud prevention, and the e-signature audit trail (time, IP address, browser details) that lets a sender prove who signed.
- On behalf of our customers (Art. 28): template inputs and signer data — the customer, as controller, determines the legal basis; we process under their instructions.
- Consent (Art. 6(1)(a)): non-essential cookies, marketing emails.
- Legal obligation (Art. 6(1)(c)): keeping invoices for the tax-mandated retention period.
4. Where data lives
All Pluma application data — Postgres database and S3-compatible object storage — is hosted in the European Union — at Hetzner Online GmbH in Nuremberg, Germany. Connections to plumapdf.com pass through Cloudflare's network (see section 5). We use Stripe for payments; Stripe processes data globally and is bound by Standard Contractual Clauses where applicable.
If you sign in with Google or Apple, that provider processes your login under its own privacy policy; this may involve a transfer to the USA, which these providers cover through the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. We receive only your provider ID, email address (with Apple, possibly the private relay address you chose to share) and name.
5. Sub-processors
We use the following sub-processors. Each is contractually bound to GDPR-compliant processing.
- Stripe Payments Europe, Ltd. (Dublin, Ireland) — payment processing, billing-address and VAT-ID collection, invoicing.
- Hetzner Online GmbH — hosting (server, Postgres, object storage). EU only.
- Cloudflare, Inc. (San Francisco, USA; data centres in the EU as well) — content delivery network, TLS termination and attack protection in front of plumapdf.com. Cloudflare sees connection data and the content of requests in transit; it does not store documents. Transfers are covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Not involved in self-hosted installations.
- Email delivery — transactional emails (verification codes, sign requests, signed copies) are sent from a mail server we operate ourselves; no third-party email provider is involved. Self-hosted installations use the operator's own SMTP server.
- Sentry (Functional Software, Inc., USA; EU data residency available) — error monitoring; captures diagnostic data (stack traces, request context) when an error occurs. Active on this instance.
- Plausible Analytics — privacy-friendly, cookie-free usage statistics. No personal data, no cross-site tracking. Not active on this instance.
The current sub-processor list is available at any time on request.
6. How long we keep data
- Account + workspace data: until you delete the workspace or your account.
- Generated PDFs: when returned as a direct download, streamed and not stored. PDFs and bulk job results stored for download: on paid plans until you delete them or until the retention period you set runs out; on the Free plan for 30 minutes. Signed documents: until you delete them.
- Audit logs: 12 months, then deleted automatically.
- Signature requests and signed documents: until the sender deletes them. A request nobody signs expires on the date shown in the invitation; its uploaded document is then removed.
- Remembered signer details (name, language) in a workspace: until the workspace or account is deleted.
- Database backups: 30 days. Data you delete can remain in a backup for up to 30 days before it is gone for good.
- Inactive Free workspaces: after 11 months without a login or render we email the owners; after 12 months the workspace's stored files, templates and API keys are deleted. Paid plans are not affected.
- Server logs: 30 days.
- Invoices: 10 years (German tax law).
7. Your rights under GDPR
- Access (Art. 15): export everything we hold about you from the in-app Account page.
- Rectification (Art. 16): edit your profile from the same page.
- Erasure (Art. 17): request deletion from the Account page. We initiate a 30-day grace period (so you can cancel) then hard-delete the user and all dependent data.
- Restriction (Art. 18) and Objection (Art. 21): contact [email protected].
- Portability (Art. 20): the export is structured JSON.
- Complaint (Art. 77): you may lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany — www.ldi.nrw.de.
If you signed a document through Pluma, the sender is the controller of your data — please address your requests to them. We assist the sender, and if you cannot reach them, write to [email protected] and we will help.
8. Security
Data in transit is encrypted with TLS 1.2+. Passwords are hashed with bcrypt (12 rounds). API keys are stored as SHA-256 hashes (we cannot recover them; revocation only). Tenant data is partitioned with Postgres row-level security so cross-tenant reads are impossible at the database layer.
9. Cookies
See the dedicated Cookie Policy.
10. Changes
We will notify registered users by email when this policy materially changes. The "Last updated" date at the top reflects the most recent revision.