Privacy Policy

Information we collect

Account and organization information

When you create a Plumb account, we collect your name, email address, and organization name, and the role you're assigned within your organization (admin, reviewer, or viewer).

Agent activity data

When you connect a source (HubSpot, Intercom, or our API), we receive information about your AI agents' decisions and actions from that source: summaries of what happened, when it happened, and how it was categorized. What's included is determined by that source's own API, not by us requesting your customers' full raw conversations. If you use our API connector directly, you control exactly what's submitted.

Google Workspace discovery data

If a Workspace admin connects Google Workspace for shadow AI discovery, Plumb uses Google's Admin SDK to read two things: the list of users in your Workspace domain, and which third-party applications each user has authorized access to their account, including the application's name and which permissions were granted. Plumb does not access your email, files, calendar, or any other content through this connector, and never sees anything beyond that authorization metadata. We store only an aggregate count of how many people authorized a given application, not a list of which specific employees did.

Payment information

Billing is handled directly by our payment processor, Stripe. We never receive or store your full card number.

Usage and log data

Like most web services, we automatically collect standard technical logs (IP address, browser type, pages visited) and error reports when something goes wrong, so we can keep the product running and fix bugs.

How we use information

We use the information above to operate the service: classifying and flagging agent decisions, generating compliance reports, surfacing AI tools your team is using that aren't yet monitored, responding to support requests, and improving the product. We do not use your data to train AI models, and we do not sell personal information, ever.

How we share information

We share information with a small number of service providers who help us run Plumb, each under confidentiality obligations: Supabase (database and authentication), Vercel (hosting), Sentry (error monitoring), and Stripe (payment processing). We may also disclose information if required by law, or in connection with a merger or acquisition, with notice to you. We never share your data with third parties for their own advertising purposes.

Google API Services User Data Policy

Plumb's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: information accessed through your Google Workspace connection is used only to provide the discovery feature described above, is never used for advertising, and is never transferred to anyone except as necessary to provide that feature, for security purposes, to comply with the law, or as part of a business transfer as described in this policy.

Data retention

We retain information for as long as your account is active and as needed to provide the service, and for a reasonable period afterward in case you want to reactivate or export it, unless you ask us to delete it sooner or a shorter period is required by law.

Data security

Credentials for connected accounts (like HubSpot, Intercom, or Google Workspace) are encrypted at rest. Data in transit is encrypted. Access within your organization is controlled by the role your admin assigns you, and our own internal access to customer data is restricted to what's needed to operate and support the service.

Your choices

You can disconnect any connected source, including Google Workspace, at any time from the Connectors page in your Plumb account, or by revoking Plumb's access directly from your Google Account's third-party access settings. To access, correct, export, or delete your information, contact us using the details below.

Children's privacy

Plumb is a business product, not directed at children, and we don't knowingly collect information from anyone under 16.

International users

Our service providers may process information in countries other than your own, including in the countries where our hosting and database providers operate.

Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page and, where appropriate, notify you directly.

Contact us

Questions about this policy or your data? Reach us at dany@iplumb.io.