Privacy policy

This policy explains how we process personal data when you visit the Plainrival website or use the service, under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller is the operator named in the imprint ("we", "us"). For anything about your data, write to [email protected].

For personal data a business puts into its workspace, that business is the controller and we are its processor, under our data processing agreement.

2. What we process and why

• Website visits: technical data such as IP address, browser, the page requested and the time, to deliver pages and keep the service secure. Legal basis: our legitimate interest in a working, secure website (Art. 6(1)(f) GDPR).
• Usage analytics: which pages and features are used, so we can improve Plainrival. Without your consent, nothing is stored on your device for this. Signed-in usage is linked to an internal account ID, not your email address. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR); for analytics cookies, your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Your account: email address, name if you give it, and sign-in data. If you sign in with Google, we receive your name, email address and profile picture from Google. An account is required for every plan. Legal basis: our contract with you (Art. 6(1)(b) GDPR).
• Your workspace: what you and your team enter, such as your company profile, the competitors you watch, Timeline plans and settings, and the tools you connect. Legal basis: our contract with you (Art. 6(1)(b) GDPR).
• Emails: sign-in and security messages, your weekly brief and account notices (our contract, Art. 6(1)(b) GDPR), and occasional product news (our legitimate interest, Art. 6(1)(f) GDPR, or your consent where required). Every news email has an unsubscribe link.
• Payments: once paid plans open, payments are handled by a payment provider acting as merchant of record, named at checkout, as its own controller. We receive only what we need to run your subscription, never full card details. Legal basis: our contract and our legal duty to keep records (Art. 6(1)(b) and (c) GDPR).
• Preventing misuse: to stop the free trial being reused, we may keep a one-way code derived from an email address that used a trial, also after the account is deleted. Legal basis: our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).
• Messages to us: your message and contact details, to answer. Legal basis: our legitimate interest in answering, or our contract if you are a customer (Art. 6(1)(f) or (b) GDPR).

3. People on public pages and posts

Plainrival watches competitors' public web pages and public posts. These can contain personal data, such as a name on a team page or a public post. We collect only what anyone can see without signing in, and use it to show businesses what changed in their market, not to profile people. Legal basis: our and our customers' legitimate interest in public market information (Art. 6(1)(f) GDPR). You can object at any time (section 7).

4. AI

We use AI services to summarise and rank changes on public pages and posts. Our providers process this data only for us and may not use it to train their models. No decision with legal or similarly significant effect on you is made automatically (Art. 22 GDPR).

5. Who we share data with

We do not sell personal data. Service providers process it for us under a data processing agreement, only as far as they need to: hosting and storage, security, email, analytics and AI. We may also disclose data where the law requires it, and to a new owner if Plainrival is sold or merged.

6. Where data is processed

Your account and workspace data is stored in the EU. Where a provider processes data outside the European Economic Area, we use appropriate safeguards: an adequacy decision (Art. 45 GDPR) or the European Commission's Standard Contractual Clauses (Art. 46 GDPR). You can ask us for a copy.

7. How long we keep data, and your rights

We keep account and workspace data while your account exists and delete it when you delete the account, apart from records the law requires us to keep, for the period it sets. Backups are overwritten on a rolling schedule. Public page content is kept while a workspace watches it.

You have the right to access (Art. 15), correct (Art. 16) and delete (Art. 17) your data, to restrict its use (Art. 18), to receive it in a portable format (Art. 20), to object to processing based on legitimate interests and to direct marketing (Art. 21), and to withdraw consent at any time (Art. 7(3)). Write to [email protected]; we answer within one month. You can also complain to a data protection supervisory authority, in particular where you live or work (Art. 77).

8. Cookies, security and changes

We use the cookies the site needs, and analytics cookies only if you agree; see the cookie policy. We protect data with measures that fit the risk, such as encryption and limited access, and tell you about a breach that affects you as the law requires. Plainrival is for businesses, not for anyone under 16. We update this policy when our processing changes and tell you about changes that matter before they take effect.