Privacy Policy

1. Introduction

This policy explains what personal information PlasmaText collects when you use the app and websites that link to it, how it is used, who it is shared with, and the choices you have. By creating an account or using PlasmaText you agree to the practices described here.

PlasmaText is a workspace for reading, marking up and researching documents. Most of what you put into it is your own content, and you or your organization stay in control of it.

2. Information we collect

Account information. Your name, email address, an optional phone number, and the name of your organization. Passwords are stored only as a salted hash, never in readable form. If you sign in with Google, we receive your name and email from Google.

Content you add. Documents and files you upload or import, and everything you create around them: highlights, notes, comments, bookmarks, tags, canvas cards, tasks and exports. To make documents searchable we also extract text, run OCR on scanned pages, and detect entities such as people and organizations.

Usage and technical data. Counts of what you do (documents processed, exports, OCR pages, AI requests), your reading position in documents, and an audit log of administrative and content actions that can include your IP address and browser details.

Payment information. Payments are handled by our payment provider, Razorpay. We receive your plan, the amount and payment and order identifiers. We do not see or store your card number.

3. How we use your information

• To provide the service: show, search, annotate, compare and export your documents.
• To run accounts, organizations, sign-in, plan limits and billing.
• To keep the service secure, prevent abuse, and keep an audit trail for administrators.
• To measure usage against plan limits and to fix problems and improve the product.
• To respond to your requests, including account removal requests.

4. AI features

AI features (such as asking questions about your documents, summaries and entity extraction) work only when you use them. When you do, the text you ask about, the relevant passages of your documents and your question are sent to the AI provider configured for your organization, for example Anthropic, OpenAI or another provider your administrator has connected. That provider processes the request under its own terms.

Administrators can turn AI off for the whole organization or limit which providers are allowed. AI output can be wrong; please check it against the source document before you rely on it.

5. Sharing your information

We do not sell your personal information. We share it only as follows:

• Within your organization. Members you share a project with can see that project's content. Organization owners and administrators can manage members, projects and settings, and can see the audit log.
• Service providers that run parts of the service for us: hosting and file storage, payment processing (Razorpay), Google sign-in, and the AI and research providers described above.
• Legal and safety. When the law requires it, or to protect the rights, safety and security of our users and the service.

6. Data security

We use technical and organizational measures to protect your information, including hashed passwords, access controls by organization and project role, and audit logging. No system is perfectly secure, so we cannot guarantee absolute security. Please keep your password private and tell us promptly if you think your account has been misused.

7. Data retention

We keep your information while your account is active and as long as needed to provide the service, meet legal obligations and resolve disputes. Organization administrators can set a retention policy for their organization's content.

A legal hold placed by an administrator freezes a project so that nothing in it can be deleted until the hold is released, regardless of any retention setting.

8. Your rights and account removal

Depending on where you live, you may have the right to access, correct or delete your personal information, to object to or restrict how it is used, and to receive a copy of it.

To have your account removed, use the Account Removal Request page and enter the email address of the account. An administrator reviews the request. When it is approved your account is disabled: you are signed out and can no longer sign in. Your documents and history stay with your organization unless they are separately deleted under its retention settings or on your request. An administrator can restore a removed account.

To ask for access to, correction of, or permanent deletion of your data, contact us using the details below or ask your organization's administrator.

9. Cookies and local storage

PlasmaText stores a sign-in token and a few preferences (such as your reading settings) in your browser's local storage so you stay signed in and the app remembers where you were. You can clear this at any time from your browser settings, which will sign you out.

10. International data transfers

Our service providers may process information in countries other than your own. Where we transfer personal information across borders we rely on appropriate safeguards required by applicable law.

11. Children

PlasmaText is not directed at children, and you must be old enough to enter into a contract in your country to create an account. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date above, and for significant changes we will take reasonable steps to let you know. Continuing to use PlasmaText after a change means you accept the updated policy.

13. Contact us

Questions about this policy or your data: [email protected]. To have an account removed, use the Account Removal Request page.