Privacy Policy
Last updated: October 17, 2026
1. Who we are
Plainline is operated by Nikolai Skorobogatko PR Beograd, a sole proprietor registered in Serbia. We are the controller of the personal data described in this policy.
Nikolai Skorobogatko PR BeogradČika Ljubina 12, stan 3, 11002 Beograd 3, Serbia
Registration number: 68546320 · Tax ID (PIB): 115675005
[email protected]
Questions and privacy requests can be sent to [email protected].
Lemon Squeezy sells Plainline subscriptions and top-ups to you as Merchant of Record. For checkout, payment, tax, and refunds, Lemon Squeezy is a separate controller under its own privacy policy. For your account, presentations, and AI processing, Plainline is the controller.
If a company uses Plainline and enters personal data of other people into it, the company is the controller of that data and Plainline processes it on the company's behalf under the Data Processing Addendum.
2. What we process, why, and for how long
| Data | Purpose | Legal basis (GDPR Art. 6) | Recipients | Retention |
|---|---|---|---|---|
| Account data: email address, name, profile picture, sign-in details, and the date, time, and version of the Terms and Privacy Policy you accepted | Create and run your account, sign you in, send service emails, give support | Contract (6(1)(b)) | Hetzner (hosting), Google (only if you sign in with Google), Resend (service emails) | While your account is active. 30 days after you delete your account, we erase your email address, name, and profile picture. |
| Presentation content: source text, uploaded files, instructions, chat edits, generated slides, images | Generate, edit, store, share, present, and export presentations | Contract (6(1)(b)) | Hetzner, Cloudflare (file storage), the AI providers in section 3 | Until you delete it. Deleted presentations are removed after 30 days. The original file of an import is removed after 7 days. |
| Public links to presentations | Show a presentation to people you share the link with | Contract (6(1)(b)) | Anyone who has the link | Until you turn the link off or delete the presentation |
| AI processing records: generation job data, debug logs, request and response traces | Run generation jobs, find and fix failed generations | Contract (6(1)(b)); legitimate interests in a working service (6(1)(f)) | Hetzner | Job data 90 days; debug logs 30 days; traces 14 days |
| Product telemetry: actions in the product, user and workspace IDs, a hashed IP address, browser type | Security, abuse prevention, understanding how the product is used | Legitimate interests (6(1)(f)) | Hetzner | 540 days |
| Error reports: error type, place in the code, browser, page address without query parameters, internal user and workspace IDs | Find and fix technical errors | Legitimate interests (6(1)(f)) | Our own GlitchTip server at Hetzner | 30 days |
| Billing references: order and subscription IDs, plan, credit balance, country | Grant plan access and credits, accounting, taxes | Legal obligation (6(1)(c)); contract (6(1)(b)) | Lemon Squeezy | For the period required by Serbian accounting and tax law |
| Email subscription: email address and subscription status, for people who subscribed to early Plainline updates or to the blog newsletter | Send Plainline news and blog articles | Consent (6(1)(a)). You can unsubscribe through the link in every email. | Kit | Until you unsubscribe |
| Messages you send to support | Answer your request | Contract (6(1)(b)); legitimate interests (6(1)(f)) | Cloudflare (delivers incoming email) | As long as needed to resolve the request |
Plainline does not receive or store full payment card details. Where we rely on legitimate interests, you can object at any time by writing to [email protected].
3. AI processing
To create and edit presentations, Plainline sends your source text, uploaded files, instructions, and chat edits to one of these AI providers:
- OpenAI (United States) — text generation, chat edits, and image checks.
- Google Cloud — Vertex AI Gemini and Cloud Vision read pages and images of uploaded files. Our gateway to Google runs in Frankfurt, Germany, but the model is called in Google's global location, so Google may process a request outside the EU.
- DeepSeek (People's Republic of China) — text generation, when we route a request to it.
We use these providers through their business API services. Plainline does not use your source text or presentations to train its own models. AI output can be wrong; see the Acceptable Use and AI Disclosure.
Plainline does not make decisions about you based only on automated processing that have legal or similarly significant effects.
Do not submit confidential, sensitive, or regulated data, or another person's personal data, unless you are allowed to and understand the risks.
4. Service providers and international transfers
The full list of providers that process personal data for Plainline is on the Subprocessors page. When a provider is outside the EU, the EEA, or Serbia, we use these safeguards:
| Provider | Country | Safeguard |
|---|---|---|
| OpenAI | United States | OpenAI Data Processing Addendum with Standard Contractual Clauses |
| Google Cloud (Vertex AI Gemini, Cloud Vision) | Global (gateway in Germany) | Google Cloud Data Processing Addendum; EU-US Data Privacy Framework and Standard Contractual Clauses |
| DeepSeek | People's Republic of China | Standard Contractual Clauses. China has no adequacy decision from the European Commission, so data protection there may be weaker than in the EU, and public authorities may get access to the data. |
| Google (sign-in with Google) | United States | EU-US Data Privacy Framework |
| Cloudflare | United States | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Lemon Squeezy | United States | Merchant of Record and separate controller for payments under its own policy |
| Kit | United States | EU-US Data Privacy Framework and Standard Contractual Clauses under the Kit DPA |
| Resend | United States | EU-US Data Privacy Framework and Standard Contractual Clauses under the Resend DPA |
Hetzner Online GmbH hosts our application server, database, analytics, and error tracking in Germany, so no transfer outside the EU takes place there.
5. Cookies and browser storage
Plainline uses only cookies and browser storage that are strictly necessary for the service. Because of this, we do not show a cookie banner.
| Name | Type | Purpose | Duration |
|---|---|---|---|
sessionid | Cookie | Keeps you signed in | 2 weeks |
csrftoken | Cookie | Protects forms against cross-site requests | 1 year |
plainline.presentationListView | Local storage | Remembers how you view the presentation list | Until you clear it |
plainline.generatedDeckPreviewJson, plainline.presentationSourceText, plainline.active-export-job.v1 | Session storage | Keeps your draft and export in the current tab | Until you close the tab |
The plainline.app website counts visits with Umami, which runs on our own server and does not set cookies. The script of Kit, our email provider, loads only when you open a subscription form; Kit's own policy covers any cookies it sets.
Do Not Track. Plainline does not track you across other websites, so our behaviour does not change when your browser sends a Do Not Track signal.
6. Deleting your account
You can delete your account in Plainline. Your presentations are deleted with it and removed after 30 days. 30 days after deletion, we erase your email address, name, and profile picture and keep only a de-identified record. Billing records stay for the period required by law.
7. Your rights
You have the right to access, correct, delete, restrict, or receive a copy of your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time where processing is based on consent. Withdrawing consent does not affect processing before it.
To use a right, write to [email protected]. We answer within one month. To receive a copy of your data, you can export a presentation in Plainline; we send the rest of your data on request.
You can complain to a data protection authority:
- in the EU or EEA — the supervisory authority of the country where you live or work;
- in the United Kingdom — the Information Commissioner's Office (ICO);
- in Serbia — the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik).
8. California residents
This section is provided under the California Online Privacy Protection Act (CalOPPA). Section 2 lists the categories of personally identifiable information we collect. Sections 3 and 4 list the third parties we share it with. You can review and correct your data in your account or by writing to [email protected]. We do not sell personal data and do not share it for advertising. Our response to Do Not Track signals is in section 5. When we change this policy, we update the date at the top; the policy is effective from that date.
9. Children
Plainline is for people aged 18 and over. We do not knowingly collect personal data of children. If you think a child has given us personal data, write to [email protected] and we will delete it.
10. Security
Plainline encrypts source text and presentations before storage and limits who can access production systems. No method of transmission or storage is completely secure.
11. Changes
We may update this Privacy Policy when Plainline, our providers, or legal requirements change. We will update the date above and provide additional notice when required.
12. Contact
Nikolai Skorobogatko PR BeogradČika Ljubina 12, stan 3, 11002 Beograd 3, Serbia
Registration number: 68546320 · Tax ID (PIB): 115675005
[email protected]