Privacy Policy

Last updated 31 May 2026

Draft — pending legal review. This is a working template for a UK SaaS handling business and personal data. Have it reviewed by a solicitor and complete the bracketed details before launch.

1. Who we are

Plinth (“Plinth”, “we”, “us”) provides practice-management software for architecture and design studios. For the purposes of UK GDPR and the Data Protection Act 2018, the data controller is [Company legal name], [registered address], company number [number]. Questions about this policy or your data: hello@plinth-studio.com.

2. What we collect

Account data — name, work email, password (hashed), role, and your studio/practice details.
Content you create — projects, enquiries, contacts, tasks, notes, timesheets and fee data you enter into Plinth.
Connected services — if you connect Google or Microsoft, calendar availability and the ability to draft email, accessed under OAuth tokens stored encrypted at rest. We do not read your mailbox.
Usage & technical data — log data, device/browser information, and (with consent) analytics about how the site and app are used.

3. How we use it

To provide, secure and support the Plinth service (contract).
To send service and reminder emails you have asked for.
To understand and improve the product, and to keep it secure (legitimate interests).
To meet legal, accounting and tax obligations.

4. Lawful bases

We rely on performance of a contract (running your account), legitimate interests (improving and securing the product), consent (non-essential cookies/analytics and marketing email, which you can withdraw at any time), and legal obligation (records we must keep).

5. Sharing & processors

We share data only with processors who help us run Plinth, under contract: hosting and database (Supabase / Vercel), transactional email (Resend), payments (Stripe), and analytics providers where you have consented. We do not sell personal data.

6. International transfers

Some processors are outside the UK/EEA. Where they are, transfers are covered by adequacy decisions or appropriate safeguards such as Standard Contractual Clauses / the UK Addendum.

7. Retention

We keep account and content data for as long as your studio has an active account, and for a limited period afterwards to allow recovery and to meet legal obligations, then delete or anonymise it. You can export or request deletion of your data at any time.

8. Your rights

You have the right to access, correct, delete, restrict and port your personal data, and to object to certain processing. To exercise these, email hello@plinth-studio.com. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

9. Cookies

Plinth uses essential cookies needed to sign you in and keep the service secure. Non-essential analytics cookies are only set with your consent — see our cookie policy for the full list and to change your choice.

10. Changes

We’ll update this policy as Plinth evolves and note the date above. Material changes will be communicated to account holders.