Privacy Policy

Ploy ("Ploy", "we", "us") provides AI Reports, an AI tools marketplace, and subscription tools for businesses and consultants. This policy applies to information we handle through the Ploy website and Service.

It does not apply to third-party provider websites. When you click through to a provider, that provider's own privacy policy governs what they collect. See the Terms of Service for how that relationship works.

Information you give us

• Account information — your name, email address, the account type you select, and company name where the account type asks for one. Your password is handled by our authentication provider and is stored hashed; Ploy never sees it.
• AI Report inputs — everything you enter in the report questionnaire: business name, website, industry, description, employee count, revenue range, departments, current software, pain points and goals.
• Generated reports and roadmaps — the scores, bottlenecks, recommendations, estimates and roadmap produced from your inputs.
• Marketplace listing information — if you list an AI tool: the listing name, category, tagline, description, tasks, industries, pricing, agency name, website URL and any logo image you upload.
• Demo and contact requests — your name, email, company and message when you request a demo for a listing.
• Consultant CRM data — if you use Consulting Pro, the client and prospect records you create, including the business name, contact name, email, phone, deal value, stage and notes you enter about them.
• Saved items — listings you favourite.
• Listing reports — if you report a listing: the reason you select and any detail you write.
• Support correspondence — messages you send us by email.

Information created by using the Service

• Subscription and billing records — your subscription type, status, billing period and the customer and subscription identifiers issued by Stripe, plus invoice and charge records. Ploy does not receive or store your full card number.
• Legal acceptance records — which version of our legal documents you accepted and when.
• Security events — a log of security-relevant actions such as listing approvals, rejections, deletions and refused attempts, recording who acted, on what, and the outcome. It deliberately excludes passwords, tokens, session data and payment details.
• Rate-limiting counters — short-lived counts used to stop automated abuse of report generation and listing reports.
• Notifications — in-app messages we generate for you, such as a failed payment notice.

Information we do not collect

To be specific about what is not happening: Ploy does not currently run product analytics, advertising pixels, marketing trackers or third-party tracking cookies, does not build advertising profiles, does not buy personal data from data brokers, and does not sell personal information. Ploy does not offer social or single sign-on login, so we receive no data from such providers.

Ploy's own application code does not record your IP address or browsing history. However, the infrastructure providers listed below necessarily process network information such as IP addresses to deliver, secure and operate the Service.

We use the information described above to:

• Create and authenticate your account, and verify your email address
• Generate your AI Reports, recommendations and implementation roadmaps
• Operate the marketplace, including displaying approved listings and matching them to reports
• Review listings submitted for moderation, and act on reports about listings
• Process subscriptions, billing and access to paid features
• Send service messages such as email verification, password resets and payment notices
• Respond to support requests
• Detect, investigate and prevent fraud, abuse, spam and security incidents
• Keep records of legal document acceptance
• Meet legal, tax and accounting obligations
• Fix problems and improve how the Service works

Ploy does not currently send marketing or promotional email. The preference toggles in Account → Settings are not yet connected to a live email system; if we introduce marketing email, we will honour those preferences and include an unsubscribe link.

Your report inputs and the generated report are stored in Ploy's database so you can return to the report, and so a Ploy Pro roadmap can be rebuilt. A report generated without an account is stored without being linked to any user, and is reachable only by its unique link.

Because reports are generated automatically, no decision with legal or similarly significant effect is made about you by this processing — a report is information you choose what to do with.

Ploy is built on a small number of infrastructure providers, each of which processes some data on our behalf:

• Supabase — database, authentication and file storage. Holds your account, business information, reports, listings, uploaded logos and the other records described above, and sends authentication emails such as verification codes and password resets.
• Stripe — payment processing and subscription billing. Stripe collects and processes your payment details directly; Ploy receives identifiers, subscription status and invoice records, not your full card details.
• Vercel — application hosting and content delivery. Processes network and request information, including IP addresses, in the course of serving the site.
• Cloudflare — the Turnstile anti-bot check on our sign-up and authentication forms. Turnstile processes device and network signals to distinguish people from automated scripts.

These providers act as our processors and are permitted to use the information only to provide their service to us. Each has its own privacy and security documentation.

Ploy does not sell personal information and does not share it for third-party advertising. Information is shared only in these situations:

• With the service providers listed above, to operate the Service.
• Publicly, for content you choose to publish — an approved marketplace listing is public, including its name, description, pricing, agency name, website and logo. Your account identifier is deliberately stripped before listing data is sent to the browser.
• With a provider you contact — if you submit a demo request, the details you enter are made available so the request can be answered.
• With Ploy administrators, who can access account, listing, report and moderation records in order to run and moderate the platform.
• Where required by law — to comply with a legal obligation, court order or valid government request, or to establish, exercise or defend legal claims.
• To protect safety and rights — to investigate fraud, abuse or security incidents, or to protect Ploy, our users or the public.
• In a business transfer — if Ploy is involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction. We would give notice before your information became subject to a different privacy policy.

Listing reports are visible only to the person who filed them and to Ploy administrators. They are not shown to the provider being reported or to other users.

Ploy uses cookies that are necessary for the Service to function. In practice this means authentication and session cookies set by our authentication provider, which keep you signed in as you move between pages, and the cookies Cloudflare Turnstile needs to run its anti-bot check.

Ploy does not currently use analytics cookies, advertising cookies, marketing pixels or cross-site tracking. Because only strictly necessary cookies are in use, the Service does not show a consent banner. If that changes, we will introduce appropriate consent controls before setting non-essential cookies.

Blocking essential cookies in your browser will prevent you from signing in.

We keep information for as long as your account is active and for as long as we need it for the purposes described in this policy.

• Account, business, report, roadmap and listing data is kept while your account exists.
• Deleting a listing removes it and its dependent records — favourites, report references, reviews and demo requests tied to it.
• Billing and transaction records are kept for as long as required for tax, accounting and audit purposes, which is typically several years and is determined by law rather than by us.
• Legal acceptance records are kept as a durable record of what was agreed and are not deleted while the account exists.
• Security event logs are kept so incidents can be investigated and reconstructed.
• Reports generated without an account are retained but are not linked to any person.

We have not yet set fixed retention periods for every category. Where we cannot state a precise period, we keep information only as long as it is needed for the purpose it was collected for.

Measures currently in place include:

• Encryption in transit (HTTPS/TLS) across the Service
• Passwords stored hashed by our authentication provider, with minimum strength rules enforced
• Row-level security in the database, so records are restricted to the account that owns them and to administrators
• Server-side authorisation checks on paid features and administrative actions, rather than relying on the browser
• An anti-bot check on sign-up, and rate limiting on report generation and listing reports
• Logging of security-relevant administrative actions, including refused attempts
• Payment card details handled by Stripe and never stored on Ploy's systems

No service can promise perfect security. We cannot and do not guarantee that information will never be accessed, disclosed, altered or destroyed without authorisation. If we become aware of a breach affecting your information, we will act on it and notify you and any regulator where the law requires.

Depending on where you live, you may have rights over your personal information — commonly including the right to access a copy, correct inaccurate information, request deletion, object to or restrict processing, and receive your data in a portable format. Residents of the European Economic Area, the United Kingdom, California and several other jurisdictions have specific statutory rights; which ones apply to you depends on your location and the law in force there.

You can update your name and account details directly in Account → Profile, and you can edit or delete your marketplace listing at any time from Account → My Listing.

For anything else — a copy of your data, a correction you cannot make yourself, deletion, or an objection — email support@searchploy.com with "Privacy request" in the subject line. We will verify that the request comes from you and respond within the time the applicable law allows. We will not discriminate against you for exercising these rights.

Ploy does not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of in that respect.

When an account is deleted:

• Your profile and the records linked to it — reports, roadmaps, saved items, listing and CRM records — are removed.
• Your marketplace listing is removed from the marketplace.
• Any active subscription should be cancelled first, through Account → Billing, so it does not continue to bill.
• Billing and transaction records are retained where tax, accounting or audit law requires it.
• Some information may persist temporarily in backups until those backups age out.

Ploy is a business tool intended for people aged 18 and over, and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

Ploy and its service providers operate internationally, and your information may be stored and processed in countries other than where you live — including the United States — where data protection law may differ from your own.

Where information is transferred out of the European Economic Area or the United Kingdom, we rely on our providers' transfer mechanisms, such as Standard Contractual Clauses. Our formal transfer documentation is still being finalised; if you need specifics for your own compliance assessment, contact us.

We may update this policy as the Service changes. The version identifier and date at the top of this page always show the current version. For material changes we will give notice in the Service or by email before they take effect.

Privacy questions and requests: support@searchploy.com.

Registered business name, postal address and (where required) EU/UK representative details to be added before publication.