Privacy Notice

1. Who we are

Pluma is operated by SA Educação e Tecnologia LTDA, CNPJ 37.956.321/0001-74 (a Brazilian company based in Piauí, Brazil). We control the data in your account.

Privacy contact: [email protected].

2. What we collect and why

Account (name, email, grade-level and subject preferences): to give you access to the library and tools.

Subscription and payment (plan, dates, customer ID): to bill you and keep tax records. We never store your card number; payments are processed by Stripe.

Platform usage (downloads, tools used, usage counters): to run the service, prevent abuse and improve it.

What you create (AI generations, classes, lesson plans, collections and favorites): to save your work.

Ad measurement (Google and Meta cookies): to measure our ads, according to your cookie choices.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising beyond the ad-measurement cookies described above, which you can decline.

3. Student information in the AI tools (COPPA and FERPA)

Pluma is a tool for teachers. It is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.

When you describe a student in the tools (for example, in an IEP draft), you or your school control that information; Pluma processes it only on your behalf to produce the draft you asked for, acting under the school's or teacher's direction (as a "school official" under FERPA, where it applies). We do not use student information for advertising or to build profiles.

Use initials or nicknames and only what is necessary — avoid names, ID numbers and unnecessary health details. The text is sent to Google Vertex AI only to generate the result and is not used to train models. The result stays in your account until you delete it.

4. Who we share it with

Only service providers we need to run Pluma: Google (Firebase and Vertex AI — infrastructure and AI), Stripe (payments), Resend (email) and Google/Meta (ad measurement).

Some of them process data outside the United States (and Pluma itself is based in Brazil), under those providers' data-protection contract terms. We may disclose information if required by law.

5. How long we keep it

Account and content: as long as your account exists or until you delete it.

Payment and tax records: for the period required by applicable law.

Access logs: 6 months.

Backups: up to 8 weeks, then overwritten.

6. Your rights and "Delete my data"

Depending on your state (for example, California under the CCPA/CPRA, where applicable), you may have the right to know, access, correct, delete and port your personal information, and to opt out of targeted advertising. We will not discriminate against you for using these rights.

Self-service deletion: go to My area → Settings → Privacy and data → Delete my data. We immediately delete your AI generations, classes, lesson plans, collections, favorites, download and usage history, and clear your profile. Your account stays so you can still sign in; we keep only your login email, your subscription and payment records required by law, and content-free counters that prevent abuse.

For any other request, email [email protected]. We respond within 45 days (extendable once by another 45 days when reasonably necessary, with notice). If we deny a request, you may appeal by replying to our answer.

7. Security and changes

We use encryption in transit, database access rules, logs without personal data, and backups. If a security incident affects your information, we will notify you as required by law.

This notice may change; the current version is always on this page. See also our Terms of Use.