Privacy Policy

PlebMoe is the data controller responsible for your personal data. If you have any questions about this policy or how we handle your data, or if you wish to exercise any of your rights, contact us at nick@plebmoe.com.

We collect the following categories of personal data:

• Account & contact data — your email address, and (optionally) your first name, last name, and ZIP/postal code that you choose to provide.
• Preferences — your event-notification distance preference and related notification settings.
• Authentication data — secure magic-link tokens and session tokens used to sign you in. We do not require a password for magic-link sign-in.
• Newsletter records— if you chose a pace (Drift, Wander or Explore), a record of each issue we sent you and which piece it carried, so that nothing is sent to you twice; and whether you opened it or followed a link in it, as reported by our email provider. Opens are used for one thing only: after two issues in a row go unopened, we move you one pace slower (never faster, and never below Drift). If you mark an issue as spam, or your address stops accepting mail, we stop sending. Open reporting undercounts — some mail apps block it — and you can always set your pace again yourself.
• Usage & activity data — records of how you interact with the portal, such as portal entries, perspective/topic views, stage transitions, and session duration.
• Anonymous portal usage data— for every visit, signed in or not: a random visit identifier held in your browser’s session storage and discarded when the tab closes; which stages you visited and for how long; which cards you opened; whether a form was accepted; your device class (phone, tablet or desktop) and screen-size band; the country your connection appears to come from; and the website that referred you. We do not store your IP address or browser identification string with this data, and there is no identifier that follows you from one visit to the next. If you later create an account from the same tab, that one visit is linked to your account so we can see how members found their way in.
• Technical data — your IP address, browser user-agent string, and referring URL, captured for security and abuse prevention and stored only alongside signed-in activity records.
• Attribution data — referral codes, QR-code identifiers, and the initiative, perspective or topic that referred you, used to understand how you found us and to credit referrals.
• Matching an enquiry to an introduction — when an enquiry reaches us from an ecosystem site with no referral code attached, we compare the email address on it (or, from sites that do not send us contact details, a keyed one-way hash of it) with our own membership and earlier enquiries. If you were introduced to PlebMoe by a member, the enquiry is credited to that member. Nothing is sent back to the site that relayed it, and the match is used for nothing else.
• Lead & interest data — where you express interest in a business initiative (e.g. request a consultation), the details you submit in that form and your preferred contact method.

Under the GDPR we must have a lawful basis for each use of your data:

• To create and operate your account and sign you in — legal basis: performance of a contract (Art. 6(1)(b)).
• To send event notifications, updates and newsletter issues at the pace you chose — legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time: choose None, or use the unsubscribe link in any issue.
• To respond to consultation/lead requests you submit — legal basis: steps taken at your request prior to entering a contract (Art. 6(1)(b)).
• To measure usage, attribution and referrals, and improve the Service — legal basis: our legitimate interests in understanding and improving our Service (Art. 6(1)(f)), balanced against your rights.
• To keep the Service secure and prevent abuse — legal basis: legitimate interests and compliance with legal obligations (Art. 6(1)(f) and (c)).

We use the following, all set by us and readable only by this site:

• plebmoe_session (cookie) — keeps you signed in for up to 7 days. Strictly necessary for the authenticated experience.
• pl_attribution (cookie, 90 days) — remembers the referral or campaign code you first arrived with, so that a sign-up or enquiry you make on a later visit is still credited to the person who introduced you. First-touch only: it is never overwritten.
• user_data (local storage) — a cache of your basic profile information for rendering while you are signed in.
• pl_visit (session storage) — the random anonymous visit identifier described in section 2. It lives only in the current tab and is discarded when the tab closes.

We do not use third-party advertising or cross-site tracking cookies, retargeting technology, or analytics scripts from other companies. You can clear all of the above at any time by signing out or clearing your browser storage.

We do not sell your personal data. We share it only with service providers (processors) who help us run the Service, and only as needed:

• Hosting & database providers — our application and database are hosted by infrastructure providers (e.g. our hosting platform and our managed PostgreSQL database provider) who process data on our behalf under contract.
• Email delivery — providers used to send magic-link sign-in emails, event notifications and newsletter issues, and which report back whether an issue was delivered, opened or clicked.
• Legal & safety — authorities or advisors where required by law or to protect our rights and users.

All processors are required to safeguard your data and may only use it to provide services to us.

Some of our service providers may process data outside the European Economic Area (EEA) or the UK. Where this happens, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision to ensure your data receives an equivalent level of protection.

We keep your personal data only as long as necessary for the purposes described above:

• Account data — for as long as your account is active.
• Magic-link tokens — these expire 24 hours after creation and are invalidated once used.
• Activity and attribution data — retained for a limited period to support analytics and security, then deleted or anonymised.
• Anonymous portal usage data — event detail is deleted automatically after 6 months and visit summaries after 13 months.
• Newsletter records — whether an issue was opened or clicked is cleared automatically after 12 months. The record of which pieces were sent to you is kept while your account exists, so that none is repeated, and is erased with your account.
• Lead/consultation data — retained for as long as needed to handle your request and any resulting relationship. Lead and referral-attribution records that do not result in a purchase or account are automatically deleted after 12 months; you can also request earlier deletion by contacting us, even if you never created an account.

When you ask us to delete your account, we will erase or anonymise your personal data unless we are legally required to retain it.

You have the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure— ask us to delete your data (“right to be forgotten”).
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Objection — object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent — where we rely on consent, withdraw it at any time without affecting prior processing.
• Complaint— lodge a complaint with your local data protection authority (in the EEA) or the Information Commissioner’s Office (in the UK).

To exercise any of these rights, email us at nick@plebmoe.com. We will respond within one month as required by the GDPR.

The Service is not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We use technical and organisational measures to protect your data, including encrypted connections (HTTPS), hashed credentials where passwords are used, signed and expiring authentication tokens, and access controls on our database. No system is perfectly secure, but we work to protect your data and to notify you and the relevant authority of any breach where required by law.

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, where changes are significant, take reasonable steps to notify you.

For any privacy questions or to exercise your rights, contact us at nick@plebmoe.com.