Privacy Policy

1. Who we are

Plotline is a browser-based event planning app. It is operated by Mathew Smith, a sole trader (ABN 14 455 136 938), based in Perth, Western Australia.

• Email: hello@plotlineapp.online

For the GDPR and UK GDPR, we are the “controller” of your account and website data. For the data you put into your own event plans (for example, guest lists), see section 6.

2. What we collect

Things you give us

• Email address, when you sign in. We sign you in with a one-time link sent to your email (no password).
• Event content you create: event name, type, date, venue, city, guest numbers, budgets, run sheets, supplier lists, seating plans, safety documents and notes.
• Guest and crew details you enter or import (for example from a CSV file): names, contact details, RSVP status, dietary needs, plus-ones, table assignments and crew roster details. See section 6.
• Venue plans and drawings you upload (images, PDFs and DWG/DXF files), plus details such as venue name, city and scale. If you choose to publish a plan to the shared venue library, it becomes visible to other users.
• Item requests and photos you send us when asking us to add furniture or equipment to the app.
• Feedback you send through the app, including your message, an optional email address, and basic context (such as which screen you were on and the event type).
• Form responses submitted by crew or others through a share link or QR code you create (they don’t need an account).

Payment information

If you upgrade to Pro, payment is handled by Stripe. We do not see or store your full card number. We receive limited details from Stripe such as your subscription status, billing email, country and payment history.

Collected automatically

• Usage counts. The app sends our own server a short note when certain features are used (for example “event created”, “3D view opened” or “share link created”), with a random identifier stored in your browser. On our server we keep only a daily count of each feature and a scrambled version of that identifier combined with the date, so we can count how many browsers used Plotline each day without following anyone from one day to the next. Nothing from inside your events is sent, and the counts are not linked to your account. If your browser has “Do Not Track” turned on, nothing is sent. We do not use third-party analytics or advertising trackers in the app.
• Technical and log data. Our hosting provider (Cloudflare) processes IP addresses, browser type, request times and similar data to deliver and protect the site.
• Map searches. When you search for a venue address, the search text is sent to OpenStreetMap’s Nominatim service. When you view satellite maps, map tiles are loaded from Esri (ArcGIS). These providers receive your IP address and the area being viewed.

For outreach emails (business contacts)

If you work in the events industry, we may hold your business name, your name and role where publicly listed, your business email address as published on your website, your location, and notes from your public website. See section 10.

3. How we use it

• To provide the Service: sign you in, save and sync your events across devices, generate plans and documents, and run share links and crew forms.
• To process payments and manage your Pro subscription.
• To display venue drawings. Images, PDFs and DXF files are read in your browser. We do not currently send your drawings to an outside conversion service. If we start converting DWG files with one, we will name it in section 5 first.
• To respond to feedback, support requests and item requests.
• To understand and improve the product (usage counts).
• To keep the Service secure and prevent abuse.
• To send service emails (for example, sign-in links and billing notices).
• To send business-to-business marketing and outreach emails (section 10).
• To meet legal, tax and accounting obligations.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

4. Legal bases (EU/UK users)

• Contract: providing the Service, your account and your subscription.
• Legitimate interests: security, product improvement, usage counts, answering feedback, and B2B outreach to publicly listed business contacts. We balance these against your rights, and you can object at any time.
• Consent: where required by law (for example, for some marketing emails). You can withdraw consent at any time.
• Legal obligation: keeping tax and financial records.

5. Who we share it with

We use these service providers (processors) to run Plotline:

We may also share information when the law requires it, to protect rights and safety, or as part of a sale or restructure of the business (in which case this policy will continue to apply).

When you share an event using a share link or QR code, anyone with the link can see the shared content. Only share links with people you trust, and turn sharing off when you no longer need it.

6. Information about other people (guests and crew)

When you add guests, crew, suppliers or other people to your event, you decide what to enter and why. For that data you are responsible for having the right to share it with us, and for telling those people where needed. Take extra care with sensitive details such as dietary or health information. We process this data only to provide the Service to you (as your “processor” under the GDPR). If one of your guests or crew asks us about their data, we may refer them to you.

7. Overseas transfers

We are based in Australia, but our providers store and process data in other countries, including the United States and others where Cloudflare operates. Under Australian Privacy Principle 8 we take reasonable steps to make sure overseas recipients handle your information in line with the Australian Privacy Principles. For EU/UK data we rely on adequacy decisions, Standard Contractual Clauses (and the UK Addendum) or equivalent safeguards. Contact us for a copy of the relevant safeguards.

8. How long we keep it

• Account and event data: while your account is active. If you delete an event it is removed from our servers. If you ask us to delete your account, we delete your data within 30 days, except where we need to keep it.
• Billing records: as long as tax law requires (generally 5–7 years).
• Usage counts and logs: up to 12 months.
• Feedback and support emails: up to 24 months.
• Outreach contacts: until you ask us to stop, or 24 months after our last contact. We keep a minimal “do not contact” record so we don’t email you again.

9. Cookies and local storage

Plotline does not use advertising or third-party analytics cookies.

• Sign-in: we use one strictly necessary cookie, plotline_session, to keep you signed in. It lasts 30 days and is removed when you sign out. It can’t be read by scripts on the page.
• Local storage and IndexedDB: the app saves your work in your browser so you can plan without an account. It also stores your preferences (such as the last tab you used), recent items, and the random identifier used for our usage counts. This data stays on your device unless you sign in and sync. You can clear it in your browser settings, but this will delete unsynced events.

10. Marketing and outreach emails

We may send occasional business emails to people working in the events industry, using business email addresses they publish themselves. We send these through SMTP2GO, which may use open and click tracking to tell us whether an email was opened or a link was clicked. Every email identifies us, includes our contact details, and has an unsubscribe link. To stop, click unsubscribe or email hello@plotlineapp.online, and we will stop within 5 business days (and in any case within legal limits). We don’t buy email lists.

11. Security

We use HTTPS encryption, access controls and reputable providers to protect your information. No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify you and the regulator as required by law.

12. Children

Plotline is not directed at children under 16, and we don’t knowingly collect their personal information. If you think a child has given us information, contact us and we’ll delete it.

13. Your rights

Depending on where you live, you can:

• access the personal information we hold about you, and get a copy (portability);
• correct it;
• delete it;
• object to or restrict certain processing, including marketing;
• withdraw consent;
• not be discriminated against for using your rights (California).

Australia: you can request access to and correction of your information under APPs 12 and 13. We will respond within 30 days.

EU/UK: we respond within one month.

California (CCPA/CPRA): in the last 12 months we have collected identifiers (email, device ID, IP address), commercial information (subscription records), internet activity (usage counts), approximate location (from IP and venue searches), and the user content described above. We use them for the purposes in section 3. We don’t sell or “share” personal information as those terms are defined, and we don’t use sensitive personal information to infer characteristics. You may use an authorised agent.

To use any of these rights, email hello@plotlineapp.online. We may need to verify your identity. Usually there is no charge.

14. Complaints

Please contact us first at hello@plotlineapp.online and we’ll try to fix it within 30 days. If you’re not satisfied:

• Australia: Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au, 1300 363 992.
• EU: your local data protection authority.
• UK: Information Commissioner’s Office (ICO), ico.org.uk.
• California: California Privacy Protection Agency, cppa.ca.gov.

15. Changes to this policy

We may update this policy. If the changes are significant, we’ll tell you in the app or by email before they take effect. The effective date at the top shows the latest version.

16. Contact