This policy explains what data Plumb collects, why, and how we handle it. Plumb is operated by Paper Birch Labs (“we”, “us”). If anything here is unclear, email hello@plumbplanning.comand we'll explain.
We use the data above to:
We share data only with the infrastructure providers needed to run the Service: our hosting platform and our database host. These vendors process data on our behalf under standard data processing agreements and are not permitted to use it for any other purpose.
We will disclose data if legally required (subpoena, court order) and will attempt to notify you first unless prohibited by law.
We keep your workspace data for as long as your account is active. If you delete your account, we delete your workspace content within 30 days. Backups are overwritten on a rolling 35-day cycle.
You can export your data, delete specific records, or request full deletion at any time by emailing us.
You can disconnect Google Calendar, Xero, or Melio from Plumb at any time. When you do, we delete the stored OAuth tokens for that provider within 24 hours and stop reading from it. Revoking access on the provider's side also works — we'll detect the revocation on the next sync attempt and clear the tokens.
We use industry-standard encryption in transit (TLS) and at rest. Access to production systems is limited to a small number of engineers and logged. If we become aware of a security incident that affects your data, we'll notify you within 72 hours with what we know and what we're doing about it.
Depending on where you live, you may have rights to access, correct, delete, or export your personal data. Email us and we'll help you exercise them. We don't charge a fee for reasonable requests.
Plumb isn't intended for anyone under 18. We don't knowingly collect data from children.
If we make a material change to this policy, we'll email the address on file and update the date above.
Questions, requests, or concerns? Email hello@plumbplanning.com.