Privacy.
Plumb is operated by Clap Digital, Co. Plumb keeps the information needed to run an evidence-based website audit. It does not sell personal information, place advertising trackers, or use customer scan data to train a shared model.
What we hold
- Account details: name, email, organisation, role, password hash where one is set, sessions, notification preference and, for federated sign-in, the provider and its stable account identifier.
- Customer instructions: properties, schedules, declared reference facts, connected public-profile identifiers, finding decisions and audit events.
- Scan records: pages checked, detected facts, evidence, findings, suppression reasons, status and timing. Public trial scans store a reduced report and strip raw page-context excerpts.
- Operational data: session IP address and user agent for account security; public-scan addresses are salted and hashed. Marketing analytics use a salted address hash that changes daily, keep no raw address, and write nothing to the visitor’s device.
- Billing records from Stripe when billing is configured. Plumb does not receive card numbers.
Why we use it
We use this data to authenticate users, run requested and scheduled scans, compare results over time, deliver configured notifications and webhooks, meter usage, prevent abuse, provide support, and keep an auditable service record.
Who processes it
Infrastructure may include Fly.io for hosting, Resend for email, Stripe for billing, and Google Identity Services when a user chooses Google sign-in. A scan may contact the public website supplied by the customer and, only where configured or connected, Google Places or Meta’s public Ad Library. These providers process data under their own terms.
Retention and deletion
Account and tenant records remain while the account exists. Public scan records are pruned after seven days, finished jobs after fourteen days, and first-party marketing visits after ninety days. Operational backups may retain deleted data until their normal snapshot cycle expires. An account owner can request export or deletion at any time.
Your choices
You can change profile data and notification preferences in Settings, disconnect external surfaces, delete properties, and delete an eligible account. For access, correction, portability, objection, or deletion requests, write to payments@clapdigital.co.
International use and changes
Plumb may process data where its service providers operate. Enterprise customers may request a signed data-processing agreement before supplying personal data. Material changes to this notice will be dated here.
Controller and contact
For account, billing, security and first-party service analytics, the controller is Clap Digital, Co., 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States. Contact payments@clapdigital.co.