Privacy Policy

1. Who this policy covers

1.1 This policy covers the people Plot deals with directly: visitors to our website, people who create a Plot account, their colleagues who are added as users, people who contact support, and people who receive our marketing.

1.2 It does not cover the fans, ticket buyers and other members of the public whose details an organiser collects through a website built on Plot. For that information the organiser is the controller and Plot is the processor, acting on the organiser's instructions under our Data Processing Agreement. If you have given your details to a venue, festival or promoter through their website, read their privacy notice and contact them first.

2. Information we handle

2.1 Account and contact information: your name, email address, organisation, role, password (stored in hashed form) and the details of any colleagues you add as users.

2.2 Website content and setup information: your site name, event details, branding, uploaded files and images, the ticketing, CRM and marketing services you connect, and the answers you give when setting up a site.

2.3 Subscription and billing information: your plan, billing dates, billing contact details, invoices and payment history. Card details are entered with Stripe; Plot receives payment-method information and transaction identifiers needed to manage subscriptions and payments, rather than storing your full card number or card security code.

2.4 Bookings for design calls: when you book a design kick-off, review or handover call, the time, your name and email, and the notes you add.

2.5 Support and correspondence: messages you send through the dashboard or the help centre, including conversations handled by our automated support assistant, and any feedback you give us.

2.6 Technical and usage information: IP address, browser and device details, login times, security logs, and how you use the dashboard and editor.

2.7 Most of this comes from you or your team. Services you connect, such as a ticketing platform, may send us event, venue or account information when you authorise the integration.

3. Why we use it and on what basis

3.1 To provide the service: creating and securing your account, generating and hosting your website, running the editor and integrations, taking payments, sending service emails, and answering support requests. Basis: performance of our contract with you, or our legitimate interest in serving your organisation where it is the customer.

3.2 To send service communications: verification, account and security notices, site and domain notices, trial and billing notices, bandwidth alerts and relevant design-call notifications. Some are sent by our service providers. These communications are needed to operate your service and are separate from optional marketing. Basis: performance of our contract, or our legitimate interest in serving your organisation where it is the customer.

3.3 To run the service safely: diagnosing faults, preventing fraud and abuse, protecting accounts, and improving reliability and performance. Basis: our legitimate interests in running a secure service.

3.4 To keep business records: accounting, tax and other legal obligations, and dealing with disputes. Basis: legal obligation, and our legitimate interests in protecting our rights.

3.5 To improve the product: analysing how the dashboard and editor are used, in aggregated or pseudonymised form. Basis: our legitimate interests in developing the service.

3.6 Marketing: sending you news about Plot where you have consented or where we may lawfully do so as an existing customer. You can unsubscribe from marketing emails at any time using the link in the email; this does not stop service emails. Basis: consent, or our legitimate interests in marketing to existing business customers.

3.7 Some information is necessary to provide your account or website. Without it we may be unable to supply the service you have asked for.

4. Who we share it with

4.1 We share personal information with service providers. They process it on our behalf where acting as processors; some also act as independent controllers for their own purposes, such as payment fraud prevention and legal compliance. The categories, and the providers we use at the date of this policy, are:

Hosting and infrastructure: Amazon Web Services, including hosting in US East (Northern Virginia), storage, backups, CloudFront content delivery and AWS security services. Bunny CDN also delivers media for selected customer sites. Content delivery may use a global edge network.

Payments, invoicing and accounting records: Stripe.

Customer support and help centre, including our automated support assistant: Intercom. Our workspace is hosted in the United States.

Email delivery for service emails: Postmark.

Call scheduling, where used: Cal.com and connected Google Calendar/Google Meet services.

AI-assisted site and content generation: OpenAI. Inputs needed for generation may include your site brief and supplied content. Avoid including unnecessary personal or sensitive information.

Help centre demos and product walkthroughs: Supademo.

Website measurement: the beta website offers optional Google analytics and advertising measurement through the choices described in the Cookie Policy. This does not mean Google Analytics is enabled on customer websites. Customer-installed analytics and tags depend on the services the customer enables. See our Cookie Policy for browser storage and choices.

Business administration: Google Workspace for company email, documents and connected calendars. Stripe provides the billing and accounting records described above.

4.2 Services you connect to your Plot site, such as ticketing, CRM or mailing-list platforms, process information under their own terms and your instructions. Their own processing is governed by their terms and privacy notices. Plot remains responsible for its own handling and transmission of information under the applicable agreement.

4.3 We may disclose information where required by law, to a regulator or court, or where necessary to establish, exercise or defend legal rights, including in a payment dispute.

4.4 If Plot is sold or merges with another business, your information may be transferred to the new owner, who will be bound by this policy.

4.5 We do not sell personal information.

5. International transfers

5.1 Our infrastructure and service providers may process information outside the UK, including in the United States and the EEA. For a restricted transfer, Plot must use an applicable UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses, with any required supplementary protections. The mechanism depends on the recipient and transfer route; a supplier’s location alone does not establish it. You can contact support@builtwithplot.com for information about the safeguards applicable to your information and a copy, subject to necessary redactions to protect confidential information.

6. How long we keep it

6.1 Account and website records: for as long as your account is open, then as set out below.

6.2 Unfinished site setups: deleted 30 days after they were started if not completed. We email you before this happens. (Terms clause 13.4.)

6.3 Cancelled or expired sites: the standard site archive period is 90 days after the paid period ends. During that period you can request a copy of content or discuss reactivation. Site deletion and recovery-copy retention are separate; see clause 6.10 and the applicable service terms.

6.4 Dormant accounts: inactivity alone does not currently trigger an automatic 12-month account-deletion process. Account closure and deletion requests are handled through support, subject to active subscriptions, archive periods and required business records.

6.5 Sites terminated for breach or non-payment: the service terms provide a 30-day period to request a copy after termination. This is distinct from the standard cancellation archive and does not promise that all backup or supplier-held copies are deleted on day 30.

6.6 Billing and tax records: normally six years from the end of the last company financial year they relate to, and longer where a legal requirement applies, such as an ongoing HMRC compliance check. This does not set the retention period for unrelated website or audience data.

6.7 Support conversations: retained for support continuity, resolving disputes and meeting legal obligations. The retention criteria are whether the enquiry is still open, whether the history is needed to support an active account or resolve a recurring issue, and whether a dispute or legal obligation requires us to keep it. A closed enquiry is not, by itself, a reason to retain its personal information indefinitely. You can request deletion through support; any retained information must have an identified continuing purpose.

6.8 Security and access logs: most production application and access logs in CloudWatch have 30-day retention, while some operational logs have 14-day retention. Some database and monitoring log groups currently have no automatic expiry configured and require a separate retention review. Incident evidence may be retained separately where justified.

6.9 Marketing contacts: until you unsubscribe or we learn the address is no longer in use. We keep a suppression record so we do not email you again.

6.10 Backups and recovery copies: Automated database backups use a 35-day retention window. Previous media-file versions have 180-day expiry rules. Tenant backup packages have separate 90-day lifecycle rules for current and previous versions; these are not a single maximum period after deletion. Manual database snapshots are retained separately for recovery and require explicit review and deletion. These periods do not mean every copy is erased within 35 days. Retained recovery copies are access-restricted; any recovery must respect previously received deletion instructions.

6.11 Fan and audience data held on behalf of organisers is retained on the organiser's instructions under the Data Processing Agreement. Routine activity cleanup does not delete fan profiles, contact details, stored consent or custom fields merely because a profile has not been updated; the organiser decides and instructs when those records should be deleted.

7. Security

7.1 Access controls, password hashing, administrator multi-factor authentication, infrastructure monitoring and backups help protect information. The production database and primary file-storage bucket use encryption at rest, and public website connections use HTTPS. These descriptions do not imply identical settings for every connected service. No internet service can guarantee absolute security; contact us promptly if you suspect unauthorised access.

8. Your rights

Your right to object: you can object to processing based on legitimate interests. You can object to direct marketing at any time, and we will stop using your information for that purpose.

8.1 You can ask us for a copy of the personal information we hold about you, ask us to correct or delete it, ask us to restrict how we use it, object to processing based on our legitimate interests, and ask for a portable copy of information you gave us. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

8.2 To exercise any of these rights, contact us from your dashboard or at support@builtwithplot.com. We will respond within one month. We may ask you to confirm your identity first.

8.3 You can also complain to the Information Commissioner's Office at ico.org.uk. For information collected by an event organiser through their website, contact the organiser first.

9. Cookies

9.1 Our Cookie Policy explains cookies, browser storage and choices on beta.builtwithplot.com. The separate marketing website is outside the scope of this release.

10. Changes to this policy

10.1 We will update this policy as our services and providers change, and show the revision date at the top. Where a change materially affects how we use your information, we will tell account holders by email or in the dashboard.

11. Contact

11.1 Built With Plot Limited, 12 Hilton Street, Manchester, England, M1 1JF. Registered in England and Wales, company number 14313779. Privacy requests and incident reports are handled by Michael Watson. Email: support@builtwithplot.com.

Contact Plot

For questions about this page, contact support@builtwithplot.com.

Built With Plot Limited
12 Hilton Street, Manchester, England, M1 1JF
Registered in England and Wales. Company number 14313779.