Privacy Policy

Effective: October 30, 2026 Version: 2026.10.30

1. Who we are

AccountMade is operated by The Plain Works Co., Ltd. We are the controller of account, website, billing-support, and service-administration data. The Privacy team handles privacy matters and can be reached at hello@accountmade.com.

For Customer Content processed on a business customer's instructions, the customer is the controller or business and we are its processor or service provider under the DPA.

2. Scope and market

This Policy covers AccountMade websites, applications, support, shared content hosted by us, and related communications. AccountMade is a business-to-business service offered only in the United States and Canada, excluding Quebec. It is not currently offered or targeted in the EU, EEA, or UK.

3. Data we collect

We collect:

• Account Data: name, business email, organization, role, authentication identifiers, settings, invitations, and consent records;
• Customer Content: sources, claims, prompts, questionnaire or RFP material, generated output, shared decks, and data selected through connected systems;
• Usage and Device Data: pages and features used, timestamps, browser and device information, IP address, approximate region, referrer, and diagnostic events;
• Integration Data: OAuth grants, scopes, object identifiers, sync status, and encrypted credentials or tokens needed for a connection;
• Billing Data: Paddle customer, subscription, invoice, tax, entitlement, credit grant, credit reservation, trial, refund, and transaction references, but not complete card or bank credentials;
• Support and Communications: messages, attachments, call or chat context, survey responses, and notification preferences; and
• Security Data: sign-in, audit, access, abuse, rate-limit, and incident records.

We obtain data from you, workspace administrators, connected systems you authorize, service providers, and normal interaction with the Service.

4. Restricted data

The Service is not designed for restricted data: protected or regulated health data; full payment-card data or bank credentials; government identifiers or identity documents; passwords, private keys, access tokens, or session secrets; biometric identifiers; precise geolocation; FCRA or GLBA regulated data; children's data; classified or export-controlled data; or highly sensitive genetic, health, or employment data. Do not submit such data unless a separate written agreement expressly approves the category and controls.

5. How we use data

We use data to provide and personalize the Service; authenticate users; sync selected systems; generate requested output; operate sharing; bill and administer subscriptions; provide support; secure, debug, and monitor the Service; prevent fraud and abuse; analyze aggregate product performance; communicate service and product information; enforce agreements; and comply with law.

Personal data is not sold. We do not share it for cross-context behavioral advertising or targeted advertising. We do not make solely automated decisions producing legal or similarly significant effects.

6. AI processing

For enabled AI features, we send the minimum necessary prompt and Customer Content to the commercial API provider identified on the Subprocessors page. Active AccountMade providers are Anthropic (Claude Haiku), which generates, extracts, and evaluates content, and OpenAI, which provides embeddings for semantic search, image tagging of uploaded workspace assets, and backup generation when Anthropic is unavailable. Both are U.S. providers. Neither Plain Works nor those providers may use Customer Content to train general-purpose models under our approved commercial configuration. We disable provider storage where supported and limit ordinary provider-side abuse-monitoring retention to no more than 30 days unless a verified zero-retention setting applies. Do not send restricted data through AI features.

7. Analytics, cookies, and similar technologies

We use strictly necessary cookies or local storage for authentication, security, preferences, routing, and session continuity. PostHog provides optional usage analytics and error diagnostics on public and product pages. Browser analytics uses memory-only persistence, does not capture IP addresses, and has automatic interaction capture and session recording disabled. Identity metadata excludes names, email addresses, and avatars; diagnostic reports omit error messages, source content, and request URL secrets.

We honor Global Privacy Control and Do Not Track signals for optional telemetry where technically detected. Blocking optional analytics does not prevent core account functions. The former Cookie Policy is incorporated into this section.

8. How we disclose data

We disclose data only as needed, and only to:

• infrastructure, communications, analytics, support, and AI providers listed on the Subprocessors page: Vercel (application hosting, serverless functions, scheduled jobs and content delivery), Cloudflare (DNS for accountmade.com only), Supabase (database, authentication and file storage), Upstash (cache, queues, rate limits and temporary job state), Resend (transactional email), PostHog (usage analytics and error diagnostics), Anthropic (AI generation, extraction and evaluation) and OpenAI (embeddings, image tagging and backup AI generation);
• Paddle, which independently controls payment-transaction data as merchant of record;
• customer-selected integrations and destinations under your instructions;
• professional advisers, auditors, insurers, and transaction counterparties under confidentiality duties;
• authorities or other parties when reasonably necessary to comply with law, protect rights or safety, or investigate abuse; and
• a successor in a merger, financing, reorganization, or asset transfer, subject to this Policy or notice of changed practices.

Public or bearer-link content is disclosed according to the sharing configuration selected by the customer.

9. International processing

We operate from the Republic of Korea and use providers in the United States and global infrastructure locations; our application, database, and storage are hosted in the United States. Data may therefore be processed outside your state, province, or country. We use contracts, access controls, encryption, provider due diligence, and other safeguards appropriate to the processing. Our DPA describes transfers of Customer Personal Data.

10. Retention

We retain data for the shortest period reasonably needed for the purposes above:

Data	Normal period
Active account and workspace data	Life of the account or workspace
Authenticated account-deletion request	14-day cancellation window, then scheduled deletion
Deleted workspace content and trash	Up to 30 days
Isolated backups after live deletion	Overwritten within up to 35 days
Security, authentication, and ordinary audit logs	90 days, unless a contracted enterprise audit feature requires longer retention
Plan-dependent version history	7 days, 90 days, 1 year, or a contracted custom period shown in the plan
Trial workspace recovery	Up to 30 days after trial expiry, unless converted or deleted sooner
Support records	24 months after closure or last activity
DSAR export download object	7 days
Billing, tax, refund, and accounting records	5 years, or longer if mandatory law requires
Marketing leads with no active relationship	24 months after last meaningful activity
Opt-out suppression	Minimal record while needed to honor the opt-out

Legal holds, fraud prevention, disputes, security investigations, and mandatory recordkeeping may extend a period only for affected records. Backup copies are isolated from ordinary use and are not restored merely to recover deleted content.

11. Rights and choices

Depending on applicable U.S., Canadian, or Korean law, you may request access, correction, deletion, portability, restriction, or information about disclosures; withdraw consent where processing relies on consent; opt out of marketing; or appeal a denied request. We do not discriminate for exercising a privacy right. Authorized agents must provide authority, and we may verify identity and jurisdiction.

If the request concerns Customer Content controlled by a customer, contact that customer first; we will assist it under the DPA. Submit requests or appeals to hello@accountmade.com. You may also complain to the competent privacy regulator, including Korea's Personal Information Protection Commission or the Office of the Privacy Commissioner of Canada where applicable.

12. Security

We use access controls, encryption in transit, provider-managed encryption at rest, secret management, logging, backups, vulnerability management, and incident procedures described in the Security Overview. No system is perfectly secure. Do not send credentials or restricted data through support channels.

13. Children

AccountMade is for business users at least 18 years old. We do not knowingly collect personal data from children and do not permit customers to submit children's data.

14. Changes

We may update this Policy to reflect product, vendor, legal, or operational changes. We will post the new date and provide reasonable notice of material adverse changes where appropriate.

15. Contact

The Plain Works Co., Ltd. Privacy, rights and support requests: hello@accountmade.com