Privacy Policy.

Plexrio is an AI-powered marketing operating system operated by Plexrio Ltd ("Plexrio", "we", "us", or "our"). We are registered in accordance with applicable law. Our platform provides budget intelligence, GEO visibility monitoring, creative generation, attribution tracking, and campaign automation services. If you have questions about this policy, contact us at privacy@plexrio.com.

We collect data you provide directly, data generated by your use of the platform, and data from third-party integrations you connect. Account data: name, email address, company name, billing information, and any other information you provide when creating an account or contacting us. Usage data: pages visited, features used, campaigns created, actions taken within the platform, timestamps, and session data. Channel data: when you connect advertising accounts (Meta, Google, LinkedIn, etc.), we access performance data — impressions, clicks, spend, conversions — via their official APIs. We do not access your ad account passwords or credentials directly. Attribution data: first-party event data collected via our tracking script, including page views, clicks, form submissions, and purchases on your connected properties. We use anonymized identifiers, not personally identifiable information. GEO scan data: queries we run across AI engines on your behalf, and the responses those engines return. This data is used to compute your GEO score and recommendations.

We use the data we collect to: — Provide, operate, and improve the Plexrio platform — Generate AI-powered recommendations, scores, and campaign strategies — Send transactional emails (account confirmation, invoices, alerts) — Send product updates and marketing communications (you can opt out at any time) — Comply with legal obligations — Detect and prevent fraud, abuse, and security incidents — Aggregate and anonymize data for product research and benchmarking We do not sell your personal data to third parties. We do not use your data to train our AI models without explicit consent.

For users in the European Economic Area, our legal bases for processing personal data are: Contract performance: processing necessary to provide the services you have contracted with us. Legitimate interests: processing for fraud prevention, security, product improvement, and direct marketing to existing customers. Consent: where you have given explicit consent, such as for marketing communications or optional data sharing. Legal obligation: processing required to comply with applicable law. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

We retain your personal data for as long as your account is active or as needed to provide services. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal, regulatory, or legitimate business purposes. Campaign data, GEO scan history, and attribution events are retained for the duration of your subscription plus 90 days. After account deletion, aggregated and anonymized benchmarking data may be retained indefinitely.

We share your data only in the following circumstances: Service providers: we use third-party services to operate the platform, including cloud hosting (Railway), payment processing (Stripe), authentication (Clerk), email delivery (Resend), and error monitoring (Sentry). These providers process data only on our behalf and under our instructions. AI providers: GEO scan prompts are sent to third-party AI APIs (OpenAI, Anthropic, Google, Perplexity). These requests do not include personally identifiable information — only brand names, categories, and keywords you have provided. Legal requirements: we may disclose data if required by law, court order, or governmental authority. Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.

Depending on your location, you may have the following rights regarding your personal data: Access: request a copy of the personal data we hold about you. Rectification: request correction of inaccurate or incomplete data. Erasure: request deletion of your personal data ("right to be forgotten"). Restriction: request that we restrict processing of your data. Portability: receive your data in a structured, machine-readable format. Objection: object to processing based on legitimate interests or for direct marketing. Withdraw consent: where processing is based on consent, withdraw it at any time. To exercise any of these rights, email privacy@plexrio.com. We will respond within 30 days. We may need to verify your identity before processing your request.

We use cookies and similar tracking technologies to operate the platform and understand how users interact with it. Essential cookies: required for the platform to function. Cannot be disabled. Analytics cookies: help us understand usage patterns. Can be disabled in your browser settings. Marketing cookies: used to measure campaign effectiveness. Only set when you interact with our marketing pages. We do not use third-party advertising cookies on the dashboard or within authenticated sessions.

We implement industry-standard security measures to protect your data, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, regular security audits, and incident response procedures. No system is completely secure. If you discover a security vulnerability, please report it responsibly to security@plexrio.com.

Plexrio operates primarily in the European Union and United States. If you are located outside these regions, your data may be transferred to and processed in countries with different data protection laws. For transfers from the EEA to countries without an adequacy decision, we rely on Standard Contractual Clauses approved by the European Commission.

Plexrio is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@plexrio.com and we will delete it.

We may update this privacy policy from time to time. We will notify you of material changes by email or by displaying a prominent notice on the platform at least 14 days before the change takes effect. Your continued use of the platform after the effective date constitutes acceptance of the updated policy.

For privacy-related questions, requests, or complaints: Email: privacy@plexrio.com Response time: within 30 days If you are located in the EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.