Privacy Policy

This Privacy Policy describes how Halfcute Internet Private Limited ("Company", "we", "us", or "our"), operating as Plact at getplact.com, collects, uses, and protects your personal information when you use our website and services.

1. Information We Collect

Information you provide

• Name and email address when you sign up or contact us
• Phone number if you use WhatsApp-based verification
• Business name, project description, and requirements shared during the discovery chat
• Payment information processed securely by Razorpay or another payment partner we route you to (we do not store card details)

Information collected automatically

• IP address and approximate geographic location (country-level, used for pricing localisation)
• Browser type, device type, and operating system
• Pages visited, time spent, and referral source
• Session identifiers stored in cookies

Connected account information

When an authorized user connects a third-party business account to Plact, we may receive:

• account, organization, Page, location, and administrator identifiers;
• OAuth access and refresh tokens;
• the permissions granted by the user;
• LinkedIn Page-authored posts, media, company updates, product launches, certifications, events, and related metadata made available through the Pages Data Portability API;
• Google Business Profile information made available through authorized APIs, such as business locations, profile attributes, business hours, categories, products or services, posts, media, reviews, questions and answers, and performance information;
• connection, synchronization, authorization, disconnection, and audit records.

We request only the information and permissions reasonably necessary to provide the connected feature selected by the user.

2. How We Use Your Information

• To deliver and manage your project
• To send transactional emails (sign-in links, project updates, payment confirmations)
• To display localised pricing based on your country
• To process payments via Razorpay or another payment partner we route you to
• To respond to support enquiries
• To import, organize, review, and republish your connected-platform content on your Plact-managed or connected website, subject to your authorization and the terms of the relevant platform
• To improve our services and website
• To comply with legal obligations

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We do not use connected-platform data for unrelated profiling, cross-customer comparisons, lead generation, or training shared AI models.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area, we process your data under the following legal bases: performance of a contract (delivering your project), legitimate interests (improving our services), and your consent where explicitly provided.

4. Third-Party Services

We use the following third-party services that may process your data:

• Razorpay — payment processing for supported checkout flows. Subject to Razorpay's Privacy Policy.
• Resend — transactional email delivery.
• Meta (WhatsApp Business API) — Used to deliver one-time passwords (OTPs) to your phone number for account verification. Your phone number is shared with Meta for this purpose. Subject to the WhatsApp Privacy Policy and Meta Privacy Policy.
• Google — OAuth sign-in and Google Business Profile integrations when authorized. Subject to Google's Privacy Policy.
• LinkedIn — When a Page administrator connects a LinkedIn Page, LinkedIn provides authorized Pages Portability Data and OAuth credentials required for the selected import feature. Subject to the LinkedIn Privacy Policy.
• Google Business Profile — When an authorized business owner or manager connects a Business Profile, Google provides profile information and management permissions required for the selected feature.
• AI processing providers — Where enabled, limited business content may be processed by contracted AI service providers solely to provide requested functions such as classification, drafting, extraction, or organization. Plact does not use Connected Platform Data to train shared Plact models or to benefit unrelated customers.
• Anthropic — discovery chat. Conversation content may be processed by Anthropic's systems.
• Vercel — website hosting.
• Neon — database hosting (your project data is stored here).

5. Data Retention

We retain service and project data only for as long as reasonably necessary to provide the Services, satisfy the customer's instructions, resolve disputes, enforce agreements, and comply with applicable law. Certain transaction, tax, security, and audit records may be retained for legally required periods.

Data received through connected third-party platforms is subject to the shorter retention and deletion limits described in the Connected Platform Data section below. Where a customer requests deletion, we delete eligible data without undue delay unless retention is required by law.

6. Connected Platform Data

6.1 LinkedIn Pages Data Portability

With explicit OAuth authorization from an administrator of a LinkedIn Page, Plact may access the organization's Pages Portability Data made available by LinkedIn.

Plact uses this information solely on behalf of the authorizing organization to import, organize, review, and, at the organization's direction, republish its Page-authored business content on its Plact-managed or connected website. This may include creating or updating company-news sections, product updates, case studies, event pages, and certification or business-evidence pages.

Plact does not sell, rent, license, or redistribute Pages Portability Data to other customers or third parties. We do not use it for advertising, unrelated profiling, cross-customer comparisons, lead generation, or training shared AI models.

Plact does not intentionally import or republish LinkedIn member profiles, reactions, comments, or other member-interaction information as part of this feature. If personal information is incidentally included in Page-authored content returned by LinkedIn, we process it only as necessary to provide the authorized feature and honor applicable data-subject rights.

The Page administrator may disconnect LinkedIn or request deletion at any time. We delete eligible Pages Portability Data and associated copies when requested by the organization, when the organization closes its Plact account, or when we no longer have a valid right or purpose to retain it. LinkedIn standardized data, if received, is retained for no more than one year. Microsoft Bing Maps location data returned through the Pages Data Portability API is not stored.

6.2 Google Business Profile

With explicit OAuth authorization from a user who owns or is authorized to manage a Google Business Profile, Plact may access the profile information and permissions necessary to provide the selected Business Profile management functionality.

Plact uses this information only to display and help the user manage authorized business locations, maintain accurate business information, prepare user-requested content, manage media and posts, view profile performance, and assist with reviews or questions and answers.

Plact will not create or modify a listing, publish a post, respond to a review or question, initiate verification, or perform another profile-changing action without the user's prior specific and express authorization.

We do not use Google Business Profile data for unrelated lead generation, advertising, third-party profiling, cross-customer comparisons, or training shared AI models.

Business Profile content returned through Google's APIs is not treated as permanent Plact Business Brain data. Where temporary caching is required to operate the integration, it is retained securely for no more than 30 calendar days and is not manipulated or aggregated in a manner prohibited by Google's policies.

Users may disconnect Google Business Profile at any time. When requested, Plact will remove its management permissions, revoke or delete applicable credentials, and provide the customer with the ability to disassociate its Business Profile account from Plact within the period required by Google (ordinarily seven business days).

7. Cookies

We use session cookies for authentication and functional cookies for localisation (market/country detection). We do not use third-party advertising cookies. You can disable cookies in your browser settings, but this may affect your ability to sign in.

8. Your Rights

You may request:

• access to personal information held by Plact;
• correction of inaccurate or incomplete information;
• deletion of eligible information;
• restriction of or objection to certain processing;
• a portable copy where applicable and technically feasible;
• withdrawal of consent;
• disconnection of a LinkedIn, Google, or other connected account.

Requests may be submitted to privacy@plact.work. We may ask for information reasonably necessary to verify identity, authority, the relevant organization, Page, Business Profile, or connected account.

When a request concerns information obtained through LinkedIn or Google, Plact can correct or delete the copy held by Plact. Changes to the authoritative source data may also need to be made directly through LinkedIn, Google, or through an authorized profile-management action.

We respond without undue delay and ordinarily within 30 days. Shorter platform-specific periods apply where required. LinkedIn Pages Portability Data subject to a valid deletion request will be removed promptly, and Google Business Profile disconnection requests will be completed within the applicable platform deadline.

9. Data Security

We implement industry-standard security measures including encrypted connections (HTTPS/TLS), hashed authentication credentials, and access controls. Payment data is handled by our payment processors and never stored on our servers.

10. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors.

11. Cross-Border Data Transfers

Your data may be processed in countries outside India, including the United States, where our third-party service providers operate. We ensure appropriate safeguards are in place for such transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our website. Continued use of our Services after changes take effect constitutes acceptance.

13. Privacy & Compliance Contact

Privacy and data-protection contact

Privacy & Compliance Lead
Halfcute Internet Private Limited, operating as Plact
Email: privacy@plact.work
General support: hello@plact.work
Halfcute Internet Private Limited (India) · Plact LLC (State of Wyoming, USA) (pending US banking)

The Privacy & Compliance Lead is responsible for privacy enquiries, connected-account deletion requests, data-subject rights, and coordination of security or privacy incidents.