1. Who is responsible
Rainbow Frame LLC, United States, operates Pluvvo and is the data controller for personal information we process to provide the service. Contact us about privacy at support@pluvvo.com.
Independent merchants are responsible for personal information they collect through their own stores. When we host or process store content on a merchant’s behalf, we act as their service provider for that content. This notice does not replace a merchant’s own privacy notice.
2. Information and purposes
- Account information: email address, account identifier, profile information you provide, and authentication information handled by our sign-in service. We use it to create and maintain accounts, authenticate you, and secure access. If you choose Google sign-in, we receive the account information authorized through that sign-in flow.
- Store and team information: store names, published addresses, page content, product descriptions and images, discount settings, collaborator identifiers, and invitation information. We use this to save, display, publish, and manage your stores and authorized team access. Content you publish is publicly accessible.
- AI conversations: prompts, messages, conversation titles, completed replies, and store content you choose to include. We use these to generate responses, retain conversation context, and restore saved threads. Your prompt and relevant conversation history are sent to the Lovable AI Gateway and its underlying model provider to produce responses. Do not include sensitive personal information or information you are not authorized to share.
- Subscription records: Paddle customer and subscription identifiers, plan, status, billing-period dates, and plan-change information. We use these to provide the correct access and manage subscription support. Paddle collects and handles payment details under its own privacy notice; Pluvvo does not store your full card number.
- Support communications: your email address and information you send to support. We use these to respond to questions, investigate problems, and handle privacy or rights-holder requests.
- Technical and usage information: IP address, browser or device information, request/error information, and storefront visit timestamps. We use this for operation, security, fraud prevention, troubleshooting, and understanding service usage. Storefront visit statistics use a hash derived from IP address, browser information, and date to count visits without storing the raw IP address in the visit record. Infrastructure may separately process IP addresses in request logs.
- Browser storage: sign-in state, a selected subscription plan, invitation context, and any legacy locally saved draft. We use these to maintain sessions and complete the actions you request. See our Cookie Notice.
3. Legal bases
Where applicable privacy law requires a legal basis, we rely on contract performance to provide accounts, stores, subscriptions, and requested AI responses; legitimate interests to secure and maintain the service, prevent abuse, provide support, and understand usage; legal obligations for required accounting records and lawful requests; and consent where required for optional tracking or communications. You may withdraw consent at any time without affecting processing that already occurred.
4. When information is shared
- Service providers: hosting, account authentication, data storage, technical diagnostics, support communications, and AI processing providers, including Lovable Cloud and the Lovable AI Gateway and its underlying model provider. They receive information needed to perform their services.
- Paddle: our Merchant of Record, for selling subscriptions, subscription management, payments, tax compliance, invoicing, and refunds. See Paddle’s Privacy Policy.
- People you authorize: collaborators can access store information according to their permissions. Published content is available to visitors.
- Professional advisers: legal and accounting advisers where needed for our business and obligations.
- Authorities and business successors: where legally required, to protect rights or address fraud, or in a merger, acquisition, or transfer of the business subject to applicable privacy protections.
We do not sell personal information or share it for cross-context behavioral advertising.
5. Retention and deletion
We retain account information and saved store content for as long as your account remains active and the information is needed to provide the service. Saved assistant conversations remain until you delete the thread or request account deletion. Deleting a thread removes its saved messages from the application’s active records.
Subscription and transaction records are retained for as long as required for accounting, tax, dispute handling, and other legal obligations. Support, technical, and usage records are kept only as long as reasonably needed for their purposes. Actual periods depend on the record, legal requirements, and service-provider backup and security practices; we do not promise immediate removal from backups or third-party systems.
When information is no longer needed, we will delete or anonymize it, subject to legal retention requirements. Contact us to request account or content deletion; ending a paid subscription does not automatically delete your account.
6. Your choices and rights
Depending on where you live and applicable law, you may have rights to access or obtain a copy of your information, correct it, request deletion, receive portable data, restrict or object to certain processing, and withdraw consent. Where applicable, you may opt out of sale, sharing, or targeted advertising, appeal a denied request, and complain to a privacy regulator. We do not discriminate against you for exercising applicable privacy rights.
Send requests to support@pluvvo.com. We may need to verify your identity and will respond within the period required by applicable law. An authorized agent may submit a request where permitted, with appropriate proof of authorization. You may delete assistant conversations in your account and manage your subscription separately from Billing.
7. Security and international processing
We use appropriate technical and organizational measures, including encrypted connections, account authentication, and access controls that restrict private account data. No system is completely secure; keep your credentials private and report suspected security issues to our support email.
Rainbow Frame LLC is based in the United States. Our service providers may process information in the United States and other countries with different privacy laws. Where legally required, international transfers must use appropriate safeguards, such as adequacy decisions or approved standard contractual clauses.
8. Children and updates
Pluvvo is intended for people of legal age to enter a contract, not children under 13. If you believe a child has provided personal information, contact us so we can investigate and address it.
We may update this notice as our service or obligations change. We will update the effective date and provide notice of material changes through the service or by email where appropriate.