Privacy Policy

Last update: March 30, 2026

1. Data controller

Plumence is published by JSJ Services. For any questions about your personal data, contact us at: [email protected]

2. Data collected and purposes

We collect only data necessary for the service to function:

• Email and first name — Identification, login, account-related communications
• Password — Stored in hashed form (bcrypt), never in plain text
• Chapters and texts — Your book content, heart of the service
• Submissions (audio/text) — Transcriptions and texts written by AI
• Uploaded images — Illustrations of your chapters
• Usage data — Number of submissions, audio minutes (for plan management)
• Payment data — Managed by Stripe, we don't store your bank details

3. Legal basis for processing

Processing of your data is based on: theexecution of the service contract (account, writing, payment); your consent for analytics (collected via cookie banner); our legitimate interest (service-related support emails, with unsubscribe available anytime; security); and our legal obligations (invoice accounting retention).

4. Subprocessors and transfers

Your data is hosted in theEuropean Union (servers located in Helsinki, Finland). We use technical subprocessors governed by data processing agreements; any transfers outside the European Union are covered by standard contractual clauses (SCC) and/or the Data Privacy Framework (DPF).

5. Data retention period

Your data is retained as long as your account is active. Accounts created but never activated (no content) are automatically deleted after 30 days. After account deletion, your data is immediately erased from our active database; however, it may remain in our encrypted backups for up to 90 days (their rotation period), before final deletion.

6. Sensitive data and third-party data

Plumence is a writing tool: the content you write (memoirs, testimonies, narratives) may contain sensitive data (health, opinions, religion, orientation, origin) or data concerning third parties (close ones, mentioned people). You remain solely responsible for the content you enter and must ensure you have the right to include this information. This content is processed confidentially, encrypted at rest, and is only transmitted to AI subprocessors (section 4) to carry out the action you request.

7. Minors

Plumence is not intended for persons under 15 years of age. By creating an account, you confirm you are at least 15 years old (digital age of consent in France). If we learn that an account was created by a younger person without parental authorization, we will delete it.

8. Your rights (GDPR)

In accordance with the General Data Protection Regulation, you have the following rights:

• Right of access — View your data in "My account"
• Right to portability (Art. 20) — Export all your data via the "Export my data" button
• Right to deletion (Art. 17) — Delete your account and all your data via "Delete my account"
• Right to rectification — Edit your first name and password in "My account"
• Right to object and withdraw consent — Withdraw your consent to cookies anytime via "Manage my cookies" (bottom of page); for anything else, contact us at [email protected]

9. Security

Your data is protected by: HTTPS encryption, bcrypt password hashing, secure JWT tokens (httpOnly, secure, sameSite), CSRF protection, rate limiting on sensitive endpoints, strict file upload validation, and encrypted backups (AES-256).

10. Cookies

Plumence uses two strictly necessary cookies, exempt from consent: plumence_token (authentication) and csrf_token (protection against CSRF attacks). We also use Google Analytics for audience measurement purposes: this service places a cookie _ga (maximum duration 13 months, anonymized IP address). This measurement cookie is only placedafter your explicit consent, collected via the banner displayed on your first visit; you can refuse it, or withdraw your agreement at any time via the "Manage my cookies" link at the bottom of the page, with no impact on your use of Plumence. No advertising cookies are used.

11. Contact and complaints

To exercise your rights or for any questions: [email protected]
You can also file a complaint with the CNIL.