Privacy notice

1. Controller and processor role

Flying Golem SAS is the controller for processing needed to operate Plumelin, including accounts, security, subscriptions, support and legal obligations. For questions about personal data, write to privacy@plumelin.com or Flying Golem SAS, 1 Keroulard Vras, 29530 Plonévez-du-Faou, France. Flying Golem has not appointed a Data Protection Officer.

Where a professional customer decides why and how personal data is placed in its manuscripts, projects or workspaces, Flying Golem acts as processor only for that data. This role, distinct from Stripe’s payment processing, is governed by the Data Processing Agreement. The customer remains responsible for the purposes, invited people and lawfulness of entrusted content.

2. Data stored locally

The manuscript, its structure, fictional world and working settings are stored in the device’s browser to allow offline writing. Without an account, Flying Golem does not receive this content to operate the local editor. When an account is used, the project is also synchronised with the server.

The user can download an archive of data on the device and erase it from the application. It can also be removed through browser or device settings.

3. Account, synchronisation, collaboration and certification

Data

The email address is also the account identifier. Plumelin also processes connection data, account preferences, project metadata, collaboration roles and invitations, and content the user chooses to synchronise or share.

Session data

A technical identifier, the account email address and an expiry date maintain and secure the connection. Here, a session means a connection to the account. It is neither a scene nor manuscript edits.

Purposes

The reasons for using data are to authenticate the user, provide requested synchronisation and collaboration, enforce permissions, maintain service continuity, prevent abuse and answer support requests.

Legal bases

Performance of the contract for requested functions; legitimate interests for security and abuse prevention; and legal obligations where necessary.

Recipients

Flying Golem personnel who need access for their duties and providers essential to the service, limited to their respective functions.

A synchronised project remains private by default. Collaborators gain access only when its owner invites them and grants permissions.

When an author chooses Plumelin Certification, the service builds a private technical evidence file and, after issuance, a signed public core including certificate and receipt identifiers, fingerprints of the book, snapshot and certified files, the applied policy, aggregate measurements, status and signatures. This core contains no raw manuscript, detailed behavioural telemetry or private account identity. Title, pen name, contributors, publisher, ISBN and other presentation information are optional disclosures controlled separately by the holder.

4. Subscriptions and payment

Stripe handles ordering, payment and invoicing through Stripe Managed Payments. Card details are entered on Stripe interfaces. Flying Golem neither receives nor stores the card number, expiry date or security code.

Stripe sends Flying Golem the information needed to perform the contract and support the user: account email address, country declared at order, plan, billing interval, amount, currency, subscription status and dates, and Stripe identifiers for the customer, order, subscription, invoices, payments and refunds. Where the customer supplies professional details, Stripe may also process and return a company name, billing address and tax or VAT number.

This processing is based on performance of the contract, accounting and tax obligations and, for fraud prevention, legitimate interests. Link acts as merchant of record, and Stripe also determines certain processing necessary for payment, taxation, fraud prevention and regulatory obligations. The list of subprocessors and other recipients distinguishes those roles.

5. Optional technical data

Usage events, crash reports and performance measurements are disabled by default. Each category has an independent setting and requires a voluntary action to enable it.

Usage events include a random identifier, an identifier specific to the usage session, date, page, language, application version, device type, signed-in status, action name and, depending on the event, opaque technical identifiers or bucketed counts. Crash reports may include the error message and stack trace, browser, operating system, page, version and recent technical events. Performance measurements include loading and responsiveness indicators and certain local-database access durations.

This data is pseudonymised but is not presented as anonymous. The receiving server necessarily receives the IP address used for transmission, even though it is not added to the event content. Formats are designed not to attach manuscript text, titles, comments, searches, filenames or the account email address.

Processing is based on consent, which can be withdrawn at any time in Privacy settings. Disabling a category stops new transmissions from it.

6. Artificial-intelligence features

Artificial intelligence is optional. Basic import detects existing structure and titles locally; when a title is absent, Plumelin retains a neutral label such as “Scene 1”. This mode does not transmit the manuscript to an AI provider. When a user chooses assisted analysis, Plumelin sends only the text windows needed to extract characters, places, descriptions and relationships and, depending on the chosen mode, suggest missing scene titles. Plumelin keeps no separate cache of prompts or responses: only accepted suggestions become project data.

From 24 July 2026, when enabled, this analysis uses GPT-5.6 Luna, an OpenAI model provided through Microsoft Azure AI Foundry. Microsoft processes the data in the Azure environment under that service’s confidentiality commitments. Microsoft states that prompts and responses are not used to train foundation models and are not made available to OpenAI.

Azure deployment: the resource is in France Central (francecentral) and uses the Standard data-zone deployment type (DataZoneStandard). Prompts and responses may be routed between regions covered by Microsoft’s European Union Data Boundary, but not to an Azure region outside that zone. The choice therefore limits inference to that European zone without guaranteeing France-only processing.

7. Hosting, recipients and transfers

The public website is hosted on Microsoft Azure Static Web Apps. Its production resource is in Azure West Europe and its static content may be distributed through Azure infrastructure. The application, API and PostgreSQL database are hosted on a Hetzner server in Nuremberg, Germany, in the eu-central network zone. Export files produced on the server remain in application infrastructure until deleted. Encrypted PostgreSQL backups, continuous transaction logs and mirrored project assets are stored independently in private Microsoft Azure Blob Storage. The primary copy is in France Central and the geo-redundant secondary copy is in France South. Production backup, database restore and asset restore tests have passed.

Postmark, an ActiveCampaign service, sends sign-in codes, notifications and contractual messages. Stripe processes orders, payments, invoices and refunds. Microsoft processes requests sent to Azure AI Foundry. Optional technical data is sent to services operated for Plumelin, without advertising software, session replay or cross-site tracking. Entities, purposes, data categories, locations and roles are detailed in the list of subprocessors and other recipients.

It would be inaccurate to claim that no data can leave the European Economic Area. Postmark processes messages in the United States, and Stripe may transfer data to the United States and other countries. Depending on the recipient and processing, transfers outside the European Economic Area rely on the EU–US Data Privacy Framework or European Commission Standard Contractual Clauses. For assisted import analysis, Azure AI Foundry’s DataZoneStandard deployment limits prompt and response processing to Microsoft’s European Union Data Boundary.

8. Retention periods

Account data and synchronised projects are kept while the service is used. Items in Trash are deleted after thirty days. Closing an account erases active data from the server and the active asset mirror. Encrypted database generations rotate after eight weekly full backups and fourteen daily differential backups. Azure deletion and version-recovery protections can retain removed or superseded Blob copies for up to thirty additional days. Residual recovery copies are isolated from ordinary use and expire through that rotation.

Sign-in codes and magic links expire after ten minutes and are deleted after use. A sign-in session expires after twenty-four hours. Security logs are retained for twelve months. Ordinary support requests are retained for three years after the last exchange. Material related to a dispute may be archived for five years or for the duration of the dispute.

Optional technical data is retained for no more than thirteen months. Messages sent through Postmark and their activity log are retained for forty-five days under the provider’s standard configuration. Export files produced on the server are deleted after twenty-four hours.

Paid contracts, acceptance evidence, payments and contractual messages are archived with restricted access for ten years from the end of the relevant service period. After account erasure, Stripe identifiers required to reconcile an incomplete erasure are removed after thirty days. Pseudonymised evidence of the erasure request is deleted five years after successful erasure, not after a failed attempt.

The signed, non-identifying core of a Plumelin certificate, its receipts, fingerprints and validity or revocation history are retained durably so an old verification does not become falsely unknown. Project or account erasure deletes the private manuscript and detailed evidence file, detaches account information, replaces the requester’s operational identifier with a random value having no lookup table and changes the affected verification to “verification unavailable”. Optional identifying disclosures are removed by default when the account is erased. They remain public only after the author’s separate, express and optional choice; that choice may be withdrawn at any time through privacy@plumelin.com without erasing the cryptographic evidence.

9. Your rights

Depending on the processing, you may request access, rectification, erasure, restriction, objection and portability, or withdraw consent. You may also define instructions about your data after death and lodge a complaint with the French data-protection authority, the CNIL. Other competent local supervisory-authority rights remain unaffected where applicable.

The application’s download button creates an archive of data on the device. To obtain server-held account data or exercise another right, write to privacy@plumelin.com. This is the monitored public channel for privacy requests. Proof of identity is requested only where there is reasonable doubt and is limited to what is necessary.

10. Security and changes

Flying Golem applies technical and organisational measures proportionate to risk, including access controls, session protection, protection of access keys and other technical identifiers, verification of payment notifications and erasure procedures. Commitments for processing performed for a professional customer also appear in the Data Processing Agreement.

This notice is updated when processing changes. Data subjects are informed by an appropriate means of any material change before it takes effect.