1. Who we are
PlugBox (plugbox.haus, and public pages on allone.bio) is operated by Terra Verde 2025 Ltd., a company registered in Bulgaria (EU). For the personal data described here we are the controller. Contact: hello@plugbox.haus — please write “Privacy” in the subject.
Page owners who use PlugBox (“customers”) decide what they publish and what they collect through forms, bookings and calls on their pages. For that data the customer is the controller and we process it on their behalf as a processor.
2. What we process and why
Account: email address, password (stored only as a secure hash), name, interface language, sign-in sessions. Purpose: to provide your account (contract).
Pages and content you publish: texts, links, images, contact details. Purpose: to publish your page (contract).
Visitor statistics: page views and link taps counted anonymously — no cookies, no IP address and no visitor ID are stored. Purpose: statistics for page owners (legitimate interest).
Forms, contacts and bookings: what visitors enter (for example name, email, message, chosen time, answers) together with a record of their consent where needed. Processed for the page owner (processor).
Video calls (Meet): audio and video travel between the participants through our video provider; calls are not recorded.
Live subtitles and AI Notes (only when switched on, and only for people who agree): speech is converted to text and translated into each reader's language; AI Notes writes a summary after the call. Transcripts are deleted after 90 days; the summary stays until the host deletes it.
AI Voice (only for account owners who set it up, with explicit consent): your voice recording is used to create an AI copy of your voice, and during calls the translated text of your sentences is turned into speech in your voice. PlugBox does not keep the recording; the voice copy is stored by our voice provider until you delete it in Settings → AI Voice.
Billing: plan, invoices and billing details. Card data is handled by Stripe and never reaches our servers. Purpose: contract and legal accounting duties.
Support and email: messages you send us and the emails we send you (verification, notices, reminders). Purpose: contract and legitimate interest.
Notifications (optional): if you turn on notifications, your browser gives us a push address so we can send reminders; you can turn it off any time.
Security: rate limits use a one-way hash of the IP address and are deleted after 2 days; sessions are deleted 30 days after they end.
3. Service providers (sub-processors)
We use the following providers to run PlugBox. Each processes data only on our instructions under a data processing agreement.
| Provider | What for | Data | Location |
|---|---|---|---|
| Hostinger | Servers, database, backups, email sending | All data stored by PlugBox; emails | Germany (EU) |
| Stripe | Payments and invoices | Billing name, address, email, payment details | EU / USA |
| LiveKit | Video and audio of calls | Call audio and video, participant names | EU (LiveKit Cloud, EU region) |
| Soniox | Speech-to-text for subtitles, AI Notes and AI Voice | Call audio of participants who agreed | EU |
| Anthropic | Translation and AI Notes summaries | Text of spoken sentences and transcripts | USA |
| ElevenLabs | AI Voice: creating your voice copy and speaking translated sentences | Your voice recording; translated text of your sentences | USA |
| Browser push services (Google, Apple, Mozilla, Microsoft) | Delivering notifications you turned on | An encrypted notification message | USA / global |
4. Transfers outside the EU
Our main servers are in Germany. Some providers above process data in the USA or other countries. For these transfers we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
Users in Türkiye: your data is stored in Germany. This cross-border transfer is carried out with the safeguards required under Article 9 of the Turkish Personal Data Protection Law (KVKK).
5. How long we keep data
Account and page data: until you delete your account (Settings → Data & privacy).
Call transcripts: 90 days. AI Notes summaries: until the host deletes them. AI Voice copy: until you delete it.
Visitor statistics: raw anonymous events about 30 days, then only daily totals.
Billing records: as long as accounting law requires.
Emails waiting to be sent: deleted 14 days after sending.
6. Your rights
You can ask to access, correct, delete or export your data, restrict or object to processing, and withdraw consent at any time. Many of these you can do yourself: edit your account and pages, download your data or delete your account under Settings → Data & privacy.
Write to hello@plugbox.haus for anything else; we answer within 30 days. Visitors of a customer's page should first contact that customer, who controls their data; we forward requests we receive.
You may also complain to a data protection authority — in Bulgaria the Commission for Personal Data Protection (cpdp.bg), in Türkiye the Personal Data Protection Authority (kvkk.gov.tr), or the authority where you live.
8. Changes
We update this policy when we add or change providers or how we process data. The date at the top shows the latest version; important changes are announced to account owners by email.
Questions about privacy: hello@plugbox.haus