Privacy Policy

Effective 2026-05-04

This page describes what data Pleenx ("we") collects when you use the product or the marketing site, where it's stored, who else has access, and how you can get rid of it. Plain language only.

What we collect

Two buckets, kept separate:

• Account data — your email address, the workspaces you belong to, and your role within them.
• Monitoring data — the hostnames you add, the public-internet probes we run against them (SSL chain, DNS records, HTTP responses, WHOIS expiry), the timestamps of those probes, and any alerts they trigger.

We do not collect: payment-card numbers (Stripe processes those, we only see a customer ID and the last four digits), browsing analytics, behavioural fingerprints, or any data from the servers we monitor — we probe from outside, the same way a browser would.

Where it lives

Account data is stored in Supabase Postgres (eu-central-1). Monitoring results are stored in the same database. The full list of subprocessors:

• Vercel — hosting (functions, edge, static assets) — privacy.
• Supabase — Postgres database + authentication — privacy.
• Resend — transactional and alert email delivery — privacy.
• Stripe — billing and customer portal (when activated) — privacy.
• Google Analytics 4 — aggregate marketing-site traffic only (page views, referrer, country, device type). IP anonymised. Not used inside /app for product analytics — see "Cookies" below for opt-out — privacy.

Authentication

We use magic-link sign-in only. We never store passwords. Sessions are kept in cookies on your device; we use them to recognise you on subsequent visits. You can sign out from any page or revoke your session by clearing cookies.

Cookies

We set:

• Session cookies — required for sign-in, set by Supabase Auth.
• Google Analytics — _ga, _ga_* (1st-party), aggregate page-view tracking on the marketing surface only (landing, blog, pricing, etc.). Not loaded inside the dashboard at /app in production. To opt out: install the Google Analytics opt-out browser add-on, or block googletagmanager.com via uBlock Origin or your DNS resolver.
• Theme/preference cookies — none currently. We will list any future ones here.

We don't set advertising or remarketing cookies. We don't do behavioural retargeting.

Email

Account-related email (magic links, billing receipts, threshold alerts) is sent via Resend. We don't send marketing email by default. If we ever start a newsletter, opt-in will be explicit and unsubscribe will be one click in the footer of every message.

Your rights

If you're an EEA / UK / Swiss resident or a California consumer, you can:

• Ask for a copy of everything we hold about you (export comes back as JSON + CSV).
• Ask us to delete your account and all related data (irreversible after a 7-day grace period).
• Ask us to correct anything that's wrong.
• Object to specific processing — we'll either honour or explain why we can't.

Email hello@pleenx.comwith the subject line "privacy request" and we'll respond within 30 days.

Retention

• Account data — kept until you delete the account; permanently removed after a 7-day grace period.
• Check results — retained per plan limit (30 days on Solo, 90 days on Agency, 1 year on Studio).
• Alerts — retained alongside the linked check.
• Server logs — Vercel and Supabase keep operational logs (request timings, errors) for up to 30 days.

Security

TLS in transit, encryption at rest (Supabase's defaults), service-role keys never bundled to the browser, RLS enforced on all multi-tenant tables, magic-link only for sign-in. If you find a vulnerability, please email security@pleenx.com— we'll respond within 72 hours.

Children

Pleenx is a B2B tool for agencies. We don't target or knowingly accept users under 16.

Changes

We'll update the "Effective" date above and email all account holders if a material change happens. The git history of this page lives in our public repo, so you can always see what changed.

Contact

Pleenx · hello@pleenx.com. Postal address available on request once the LLC paperwork closes.