Privacy Policy

Plinth (“we”, “us”, “our”) is committed to protecting the privacy of individuals who interact with our platform. This Privacy Policy explains how we collect, use, disclose, and manage personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained therein.

This policy applies to all personal information collected through our website at plinth.au, our customer portal, our admin portal, our API, and any related services we provide (collectively, the “Platform”).

By using the Platform, you acknowledge that you have read and understood this policy. If you do not agree with our practices, please discontinue use of the Platform and contact us to request deletion of your data.

Plinth is an Australian company providing an AI-powered managed web development platform for Australian small businesses. We design, generate, and host websites on behalf of our customers.

If you have any questions or concerns about how we handle your personal information, please contact our privacy team:

We collect personal information in the following categories:

We use the personal information we collect for the following purposes:

• Service delivery: To create, host, and maintain your website; to process revisions; to manage your account and subscription.
• Communication: To send you transactional emails (account creation, password reset, build completion, billing notifications). We will only send marketing communications with your explicit consent and will always provide an unsubscribe mechanism in compliance with the Spam Act 2003 (Cth).
• Analytics: To provide you with aggregated, anonymised statistics about your website’s performance.
• Platform improvement: To understand how our platform is used so we can improve our AI generation quality and user experience. We do not use your personal information to train AI models without your explicit consent.
• Legal compliance: To comply with applicable Australian laws and to respond to lawful requests from government authorities.
• Security: To detect and prevent fraud, abuse, and other harmful activity on the Platform.

We will not use your personal information for any purpose that is incompatible with the primary purpose for which it was collected, except with your consent or as otherwise permitted by the APPs.

We engage the following third-party service providers who may receive or process personal information on our behalf. Each provider has been assessed against our privacy requirements and operates under contractual obligations consistent with the APPs.

We do not sell your personal information to third parties. We do not share your personal information with third parties for their own marketing purposes.

Plinth uses cookies sparingly and only for functional purposes. We do not use advertising cookies, tracking pixels, or cross-site tracking of any kind.

We retain personal information for as long as necessary to provide the Platform and comply with our legal obligations:

• Account and business data: Retained for the duration of your active account, plus 30 days following account closure to allow for recovery. After 30 days, personal data is permanently deleted from our systems.
• Generated website content: Retained for the duration of your active subscription and for 30 days following cancellation. You may export your website source code at any time during this period.
• Form submissions: Retained until you delete them or close your account, subject to the 30-day grace period above.
• Raw analytics data: Retained for 90 days. Aggregated, anonymised analytics summaries may be retained indefinitely.
• Billing records: Retained for 7 years in accordance with Australian taxation law requirements.

Following the expiry of applicable retention periods, personal information is securely deleted or de-identified.

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights in relation to your personal information:

In accordance with Australian Privacy Principle 8 (APP 8), we disclose that some of your personal information may be transferred to, stored in, or processed in countries outside Australia.

Specifically:

• Supabase: Your data may be stored in the United States in addition to Australian data centres.
• Cloudflare: Your website’s static assets are distributed globally via Cloudflare’s edge network. Cloudflare processes request data in data centres worldwide.
• Stripe: Payment processing occurs on Stripe’s global infrastructure, which includes data centres in the United States and other countries.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the APPs in relation to that information, consistent with APP 8.1. Where applicable, we rely on contractual protections, the overseas recipient’s certification under recognised frameworks, or your consent.

By using the Platform, you acknowledge and consent to the international transfer of your personal information as described in this section.

The Plinth Platform is not directed at persons under the age of 18. We do not knowingly collect personal information from children under 18. If you are under 18, please do not use the Platform or provide any personal information to us.

If we become aware that we have inadvertently collected personal information from a person under 18 without appropriate parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 18, please contact us at privacy@plinth.au.

Plinth complies with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). In the event of an eligible data breach — being an unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm to one or more individuals — we will:

• Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable, and in any case within 30 days of becoming aware of the eligible data breach.
• Notify affected individuals as soon as practicable, either directly (where contact details are available) or by publishing a statement on our website.
• Take immediate steps to contain the breach and prevent further unauthorised access.

We maintain an incident response plan and conduct regular security reviews to minimise the risk of data breaches.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will notify you by:

• Sending an email notification to your registered email address at least 30 days before the changes take effect; and
• Posting the updated policy on this page with a revised “Last updated” date.

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree to the updated policy, you should discontinue use of the Platform and contact us to close your account.

If you have any questions, concerns, or requests relating to this Privacy Policy or our handling of your personal information, please contact our privacy team:

We take all privacy enquiries seriously and will work with you to resolve any concerns promptly and fairly.