Privacy notice

This notice explains what personal data the Pleyner website at pleyner.com collects, why we collect it, how long we keep it, who else handles it and what your rights are under the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”). It covers this website and its waitlist. The Pleyner app is not available yet. It will have its own privacy notice when it launches.

We collect very little. The site has no analytics, no advertising, no social media pixels and no third-party scripts, and its fonts are served from our own site.

Who is responsible for your data

The controller is […], […], with its registered office at […], Romania, registered in the Romanian Trade Register under number […], tax identification code […] (“Pleyner”, “we”, “us”).

For anything about your data, write to pleyner.ai@gmail.com or to our registered office. We have not appointed a data protection officer, because the processing described here does not require one.

What we collect and why

When you join the waitlist, we store:

  • your email address, in lower case;
  • the language of the page you used, as a language code such as en or ro-RO;
  • your country, as a two-letter code such as RO, which our host Cloudflare derives from your IP address;
  • which of the site's “Join the waitlist” buttons you used;
  • the version of the sign-up wording you agreed to, and the date and time (UTC);
  • a random code that makes your personal unsubscribe link.

We do not store your IP address with your email address. We use this information to send you an email when Pleyner launches and, occasionally, an email about a major update; to write to you in your language; to see, as totals by country, where interest in Pleyner comes from; to be able to show that you agreed; and to let you leave the list at any time.

To protect the waitlist from automated sign-ups, our server turns your IP address into a salted SHA-256 hash and stores it, with the time, in a separate table for one hour. Older entries are deleted automatically the next time the site or the waitlist is used. It allows only a few attempts per hour from the same address. The form also has a hidden field that people do not see. Entries that fill it in are not stored.

When you open the home page, our server reads the languages your browser prefers or, if it sends none, the country Cloudflare derives from your IP address, and sends you to the page in your language. Nothing is stored for this.

Like any website host, Cloudflare processes your IP address and the technical details of each request, such as the time, the page requested and your browser type, to deliver the pages and protect the site against attacks. We do not use this information to identify or profile visitors.

If you write to us by email, we use your address and your message to reply to you.

Legal bases

  • Your consent (Article 6(1)(a) GDPR) for the launch email, the occasional major update and writing to you in your language. Sending these emails also needs your prior express consent under Article 12 of Law 506/2004 and Article 6 of Law 365/2002. You give it by entering your email address and pressing “Join the waitlist”, and you can withdraw it at any time.
  • A legal obligation (Article 6(1)(c) together with Article 7(1) GDPR) for the record that shows you agreed: the wording version, the button and the date and time.
  • Our legitimate interests (Article 6(1)(f) GDPR) in planning the launch by region, for the country code; in keeping the site and the waitlist secure, for the abuse protection and Cloudflare's processing of requests; in showing you the site in your language; and in answering messages you send us. You can object to this processing at any time, as explained below.
  • Our legal obligations under the GDPR, for handling requests in which you exercise your rights.

How long we keep your data

  • Waitlist entry: until you unsubscribe, which deletes it at once. Otherwise, we delete it 24 months after you joined if Pleyner has not launched by then, and we delete the whole list no later than 12 months after we send the launch email. We check the list at least every three months and delete the entries that have reached these limits. A deleted entry can remain in the database's automatic restore history for up to 30 days, after which it is gone.
  • Abuse protection hash: one hour.
  • Language cookie: one year from the last time you chose a language, or until you delete it.
  • Request data processed by Cloudflare: for the short periods Cloudflare needs to deliver and secure the service, as described in its privacy policy at https://www.cloudflare.com/privacypolicy/ and in its agreement with us.
  • Emails you send us: as long as we need to deal with your message, and no longer than two years after the matter is closed, unless we need them to establish, exercise or defend a legal claim.

Who else handles your data

We use these providers, which act on our behalf (processors) under a data processing agreement:

  • Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, United States, which hosts the website and the waitlist database. The waitlist database is set up in Cloudflare's European Union jurisdiction, so it is stored and processed in the EU. Pages are delivered from the Cloudflare data centre closest to you, which may be outside the EU.
  • […], which hosts our email inbox, for messages you send us.

To send the launch email we will use an email delivery service, which we have not chosen yet. Before we use one, we will sign a data processing agreement with it, name it in this notice and update the date at the top. Your email address will not be given to it before then.

We do not sell your data and we do not share it for advertising. We disclose it to public authorities only when the law requires us to.

Transfers outside the European Union

Cloudflare, Inc. is based in the United States. Where your data reaches it outside the EU, the transfer relies on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795), under which Cloudflare is certified, and on the Standard Contractual Clauses approved by the Commission (Implementing Decision (EU) 2021/914), which are part of Cloudflare's data processing agreement. If we choose an email delivery service outside the EU, we will name the safeguard that applies. Write to pleyner.ai@gmail.com if you would like a copy of these safeguards.

Cookies and local storage

The site stores only one small piece of information on your device. It is not used for tracking, analytics or advertising, which is why there is no cookie banner.

  • pl_lang: a cookie set by pleyner.com only when you choose a language in the language menu. It remembers your choice, so the site opens in that language next time. It lasts one year and is sent only over secure connections (Secure, SameSite=Lax).

It exists only because you asked for it, by choosing a language, and it is strictly necessary for that. The law allows this without separate consent (Article 4(6)(b) of Law 506/2004, which implements Article 5(3) of Directive 2002/58/EC). You can delete it at any time in your browser settings. The site keeps working, and the home page will again pick a language from your browser settings.

Your rights

Under the GDPR you have the right to:

  • access the data we hold about you and get a copy of it (Article 15);
  • have inaccurate data corrected (Article 16);
  • have your data deleted (Article 17);
  • have its use restricted (Article 18);
  • receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller (Article 20);
  • object at any time to processing based on our legitimate interests (Article 21);
  • withdraw your consent at any time, without affecting what we did before you withdrew it (Article 7(3)).

Every email we send you has an unsubscribe link. It opens a page on our site where one click deletes your entry. Until you receive one, or if you prefer, write to pleyner.ai@gmail.com from the email address concerned. Use the same address for any other request. We reply within one month. For complex requests we may extend this by up to two more months, and we will tell you if we do. We may ask for information to confirm that the request comes from you.

We do not make decisions about you based solely on automated processing, and we do not profile you.

You also have the right to complain to a data protection authority, in particular in the EU country where you live, where you work or where you think the problem happened. In Romania, this is:

Children

The waitlist is for people aged 16 or over. If you are under 16, please do not join. If we learn that someone under 16 has joined, we will delete their entry. A parent or guardian who thinks this has happened can write to pleyner.ai@gmail.com and we will delete it.

Security

We collect as little as we can and protect it with measures suited to the risk. The site is served only over encrypted connections (HTTPS). Only the account owner can read or export the waitlist, using a secret key. Your IP address is never stored with your email address. If a data breach is likely to put you at high risk, we will tell you without undue delay.

Changes to this notice

We will update this notice when what we do changes, for example when we choose an email delivery service, and we will change the date at the top. If a change affects how we use your email address, we will tell you before it takes effect and, where the law requires it, ask for your consent again.

Contact

Questions, requests or concerns about your data: pleyner.ai@gmail.com

Postal address: […], […], Romania.