This notice explains what personal data The Plain Theory collects, why we collect it, who we share it with, how long we keep it and what you can do about it. It covers our website, our dashboard and the data we process for our customers.
Who we are
The Plain Theory (“Plain Theory”, “we”, “us”) provides a consent management platform: a script that websites use to ask visitors for consent and hold back trackers until they choose, and a dashboard where those websites configure the script and keep a record of each decision.
You can reach us about anything in this notice at privacy@theplaintheory.in.
Our two roles
We handle personal data in two different capacities, and different rules apply to each.
- We are the controller (the Data Fiduciary under India's DPDP Act) for data about people who visit our own website, contact us, or hold an account with us. We decide why and how that data is used, and this notice governs it.
- We are a processor (a Data Processor under the DPDP Act, and a service provider under the CCPA) for the consent records we keep on behalf of our customers about visitors to their websites. The website owner is the controller (or Data Fiduciary, or business) and decides how that data is used. Their privacy notice governs it, and our data processing addendum with them sets out what we may and may not do.
If you visited a website that uses Plain Theory and want to ask about your consent record, contact that website first. We'll help them answer you.
What we collect
This section covers the data we control. We collect only what we need for the purposes listed in the next sections.
Account data
- your name and work email address;
- a password hash, never the password itself, or, if your organization signs in with Amazon Cognito, an identity managed there;
- multi-factor authentication settings: an encrypted authenticator secret and hashed recovery codes;
- your organization's name, its websites, the data region it chose, team members and their roles;
- the settings you make in the dashboard, such as banner text, categories and tracker rules.
Billing data
Payments are handled by Stripe. Stripe collects your card or other payment details directly; we never see or store full card numbers. We receive the billing details you give Stripe, such as your billing name, email, address and tax ID, along with the plan and currency you chose and the status of invoices and payments.
Sales enquiries and support
If you fill in the contact sales form, we collect your name, work email, company, how many websites you run, your monthly pageviews, the regions your visitors come from and your message. If you email us, we keep the email and our reply.
Security and usage logs
- for each sign-in session: when it started and was last used, your browser's user agent, whether multi-factor authentication was completed, and a salted hash of your truncated IP address;
- an audit trail of administrative actions in your organization, such as sign-ins, failed sign-ins, password and MFA changes, invitations, role changes and published configurations;
- a salted hash of the truncated IP address of anyone who submits a form on our website, used only to limit abuse.
We truncate IP addresses before hashing them and never store a full IP address. Our hosting provider processes IP addresses briefly to deliver pages and protect the service, as any web host does.
Visitors to our website
Our website does not use advertising cookies. To understand which pages are useful we use Vercel Web Analytics, which counts page views without cookies or any identifier that follows you across sites. It records the page path (we strip query strings first), the referring site, and your country, browser, operating system and device type, and reports them only in aggregate. We also use Vercel Speed Insights, which measures how quickly our pages load and respond on visitors' devices (Core Web Vitals) for the same page paths, also without cookies or identifiers. Your IP address is used to derive the country and is not stored. Our site sets only the cookies and browser storage described in our cookie policy.
Data we process for customers
When a visitor makes a consent choice on a customer's website, our script stores the choice in a first-party cookie and browser storage on that website, and sends a consent receipt to us. Each receipt records:
- the decision for each category (essential, functional, analytics, marketing), the action taken and the time;
- the version of the notice shown, the law it was shown under and the language it was shown in;
- a random visitor ID generated in the browser, not derived from any personal data;
- country, device type and browser family;
- a salted hash of the truncated IP address. The full IP address is never stored;
- whether a Global Privacy Control signal was present and honoured, and whether the browser was automated.
Each receipt is linked to the one before it by a cryptographic hash, so the customer can prove the log hasn't been altered. Receipts are stored in the data region the customer chose: Mumbai or Hyderabad in India, Frankfurt in the EU, or N. Virginia in the US.
We also keep, for the customer, reports of tracker requests seen after a visitor declined (page and tracker address with the query string removed, category and country), and logs of webhook deliveries to the customer's own systems.
We use this data only to provide the service to that customer, on their documented instructions. We don't combine it with data from other customers, and we don't use it for our own purposes.
Purposes and lawful bases
Under the GDPR and UK GDPR we must have a lawful basis under Article 6 for each use of personal data. These are ours.
- Data used
- Account data
- Lawful basis (GDPR Art. 6)
- Contract (6(1)(b))
- Data used
- Billing data
- Lawful basis (GDPR Art. 6)
- Contract (6(1)(b)) and legal obligation (6(1)(c))
- Data used
- Security and usage logs, account data
- Lawful basis (GDPR Art. 6)
- Legitimate interests (6(1)(f)) in a secure service
- Data used
- Page path, referrer, country, browser, operating system and device type
- Lawful basis (GDPR Art. 6)
- Legitimate interests (6(1)(f)) in improving our website
- Data used
- Enquiry and support data
- Lawful basis (GDPR Art. 6)
- Steps before a contract (6(1)(b)) or legitimate interests (6(1)(f))
- Data used
- Name and email
- Lawful basis (GDPR Art. 6)
- Contract (6(1)(b)) and legitimate interests (6(1)(f))
- Data used
- Name and email
- Lawful basis (GDPR Art. 6)
- Consent (6(1)(a)), which you can withdraw at any time
- Data used
- Any of the above, as needed
- Lawful basis (GDPR Art. 6)
- Legal obligation (6(1)(c)) or legitimate interests (6(1)(f))
Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time. We don't sell personal data, use it for advertising or make decisions about you by automated means that have legal or similarly significant effects.
India: DPDP Act notice
If you are in India, this section is our notice under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, for data we hold as a Data Fiduciary.
- Purpose
- Create your account, sign you in and keep it secure
- Purpose
- Provide the dashboard and control who can see what
- Purpose
- Bill you and meet tax and accounting law
- Purpose
- Detect misuse, protect accounts and investigate incidents
- Purpose
- Answer your enquiry or support request
- Basis. We process this data for the purpose you provided it for, to meet legal obligations, or with your consent where we ask for it.
- Withdrawing consent. Where we rely on your consent, you can withdraw it as easily as you gave it, by using the unsubscribe link in the email or by writing to privacy@theplaintheory.in. Withdrawal doesn't affect processing that already happened.
- Your rights. You can ask for a summary of the personal data we hold and how we use it, ask us to correct, complete, update or erase it, nominate another person to exercise your rights if you die or become unable to, and have a grievance addressed. Write to privacy@theplaintheory.in and we'll reply within 30 days.
- Grievances. Contact our Grievance Officer at privacy@theplaintheory.in. We acknowledge grievances promptly and resolve them within 30 days.
- Complaints to the Board. If you aren't satisfied with our response, you can complain to the Data Protection Board of India, through the channels it publishes.
For consent records about visitors to our customers' websites, the customer is the Data Fiduciary and you should contact them. Their notice should tell you how.
California: CCPA/CPRA
If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you these disclosures and rights.
In the last 12 months we have collected these categories of personal information, from you directly and from your use of the service:
- identifiers, such as name, email address and the salted hash of a truncated IP address;
- customer records and commercial information, such as billing details, plan and invoice history;
- internet or other electronic network activity, such as sign-in sessions, browser user agent and audit events;
- professional information, such as your company and role;
- account login credentials, which are sensitive personal information. We use them only to sign you in and keep your account secure, not to infer anything about you.
We use these for the business purposes listed under purposes and lawful bases, and disclose them only to the sub-processors listed below, for those purposes. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the last 12 months, and we have no actual knowledge of selling or sharing data of anyone under 16.
You have the right to know what we collect and how we use it, to delete it, to correct it, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be treated differently for exercising these rights. We honor the Global Privacy Control signal as a valid request to opt out of sale and sharing for the browser that sends it.
To make a request, email privacy@theplaintheory.in. We'll verify your request by matching it to your account email. You can use an authorized agent, who must show us your signed permission. We reply within 45 days, as the law requires, and aim for 30.
Sub-processors
We use a small number of service providers to run Plain Theory. Each is bound by a contract that limits how it may use the data.
- What they do
- Hosting, databases (DynamoDB), file storage (S3), content delivery (CloudFront) and optional sign-in (Cognito)
- Data involved
- All account data, and customers' consent records
- Location
- The region each customer chooses: Mumbai, Hyderabad, Frankfurt or N. Virginia. The script is delivered from CloudFront edge locations worldwide.
- What they do
- Payments, invoices and subscription management
- Data involved
- Billing data
- Location
- United States and other Stripe locations
- What they do
- Website hosting, and cookieless page-view analytics and page-speed measurement for our marketing site
- Data involved
- Website visitors' page paths, referrer, country and device type; IP addresses briefly, to serve pages
- Location
- United States, with edge locations worldwide
- What they do
- Account, security, billing and support emails
- Data involved
- Name and email address
- Location
- Varies by provider
- What they do
- Alerts our team to new sales enquiries
- Data involved
- Sales enquiry details
- Location
- Varies by provider
We tell customers at least 30 days before adding or replacing a sub-processor that handles their visitors' data, so they can object. We may also disclose data where the law requires it, to protect our rights or users' safety, or to a buyer if our business is sold, in which case this notice will continue to apply.
International transfers
Customers' consent records stay in the data region the customer chooses. Account and billing data may be processed in India, the European Union and the United States by us and our sub-processors.
When we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses, with the UK Addendum where UK data is involved, together with additional safeguards such as encryption. Transfers of data from India follow the DPDP Act and any restrictions the Government of India notifies. You can ask for a copy of the relevant safeguards at privacy@theplaintheory.in.
How long we keep it
We keep personal data only as long as we need it, then delete it. A daily job removes data that has passed its period.
- How long we keep it
- While your account is open, then deleted within 30 days of closure
- How long we keep it
- Read-only access for 30 days so you can export your data, then deletion
- How long we keep it
- For the period tax and accounting law requires
- How long we keep it
- 30 days after the session ends
- How long we keep it
- For the life of your organization's account, then deleted with it
- How long we keep it
- As long as we need them to respond and follow up, then deleted
- How long we keep it
- 90 days
- How long we keep it
- 1 year
- How long we keep it
- 2 years
- How long we keep it
- 7 years
- How long we keep it
- 10 years, or as agreed
- How long we keep it
- 90 days
- How long we keep it
- 30 days
- How long we keep it
- Roll off within 35 days
When consent receipts are removed by the retention job, we keep a checkpoint (a hash and a count, with no personal data) so the remaining log can still be verified. We may keep data longer where the law requires it or to deal with a legal claim.
Security
We protect personal data with measures that fit the risk, including:
- encryption in transit (TLS) and at rest;
- IP addresses truncated and salted-hashed before storage, never kept in full;
- a hash-chained consent log that shows if any record was changed or removed;
- multi-factor authentication, sessions that expire after 30 minutes idle and 12 hours in total, and account lockout after repeated failed sign-ins;
- role-based access for customer teams, and a tamper-evident audit trail of administrative actions;
- access to production data limited to staff who need it.
If a personal data breach affects you, we'll tell you and the relevant authorities as the law requires. For customer data, we notify the customer without undue delay so they can meet their own obligations. Read more on our security page.
Children
Plain Theory is a business service. It isn't directed at children and we don't knowingly collect personal data from anyone under 18 for our own purposes. If you believe a child has given us personal data, contact privacy@theplaintheory.in and we'll delete it. Customers whose websites are used by children are responsible for obtaining verifiable parental consent where the law requires it.
Your rights
Depending on where you live, you can ask us to:
- give you access to, or a copy of, the personal data we hold about you;
- correct, complete or update it;
- erase it;
- restrict how we use it, or object to our use of it based on legitimate interests;
- give it to you, or another provider, in a machine-readable format;
- withdraw consent you have given, without affecting earlier processing;
- nominate someone to exercise your rights for you, under the DPDP Act.
To exercise any right, email privacy@theplaintheory.in from the address linked to your account, or tell us how to verify who you are. We reply within 30 days. If a request is complex we may extend that where the law allows, and we'll tell you why. We don't charge for requests unless they are clearly unfounded or excessive.
Many of these you can do yourself: update your details in account settings, export consent logs from the dashboard, and cancel your plan from the Billing page. To have your account deleted, email us.
Changes to this notice
We update this notice when our practices change. The date at the top shows when it last changed. If a change materially affects how we use your data, we'll email account owners at least 30 days before it takes effect.
Contact and complaints
- Privacy questions and requests: privacy@theplaintheory.in
- Grievances under the DPDP Act: our Grievance Officer at privacy@theplaintheory.in
If you're unhappy with our answer, you can complain to a data protection authority: the Data Protection Board of India, the supervisory authority in your EU country, the UK Information Commissioner's Office, or the California Privacy Protection Agency. We'd appreciate the chance to put things right first.