Privacy Policy

Effective October 16, 2026

Plimie is operated by Zeroteam LLC, Texas, United States (“we,” “us,” or “our”). This policy describes how we handle information when you visit plimie.com, use the private pilot, or contact us. For privacy questions or requests, email contact@plimie.com.

Our role

We handle account, website, security, and support information to operate Plimie. When an organization connects infrastructure or supplies workspace information, we process that information to provide the service to that organization. Your organization manages workspace access and instructions concerning its data. Where applicable law requires a separate data-processing agreement, this policy does not replace that agreement.

Information we handle

• Account and workspace information: email address, display name, invitations, workspace names, membership and roles, preferences, and related timestamps.
• Connected infrastructure: account and resource identifiers, selected assessment scope, encrypted read-only credentials, configuration details, and aggregated usage analytics. Connected services may return additional information temporarily while a scan extracts the fields needed for its checks.
• Subscription evidence: selected-zone subscription identifiers, product and plan labels, status, reported prices and currency, billing periods, and contract-management flags. Recognized account-level add-ons may also be retained without allocating their price to a zone. The assessment does not retain payment-card details, billing addresses, or invoice documents. Authorized workspace members can view this evidence, and it is included in workspace exports.
• Assessment records: normalized evidence, scan history, findings, feedback, corrections, work status, owner confirmations, optional cost inputs, customer-reported outcomes, reports, and notices. Hostnames and path prefixes you supply may appear in these records. Do not put secrets or unnecessary personal information in free-text fields.
• Optional one-time checks: if an owner chooses to save a selected resource check, we retain the selected resource identifier, check time, checking user, normalized protection/cache result and linked cache-rule identifiers/action summaries, route-linked origin-group and origin identifiers with enabled state, probe and balancing settings, selected-route security-policy association status, linked policy identifiers and domain counts, linked policy enabled/mode status and configured bot-rule-set presence, selected distribution origin and failover-group identifiers with configured status codes and behavior-target counts, selected backend group identifiers and balancing settings with linked health-check timing/thresholds and aggregate current health-state counts, selected route-policy map identifiers, generic branch positions and modes, configured frontend proxy and forwarding-rule identifiers, link counts and routing scheme, backend cache mode, configured TTL values and cache-key inclusion switches, verified profile tier and dated cache-pricing context, optional caller-account service-cost observation (account identifier, positive total and currency or unknown, estimated flag and UTC window), partial project-level CDN-labelled SKU cost observation (project identifier, positive total and currency or unknown, and UTC window), and profile-attributed pre-tax actual cost observation (positive total and currency, or unknown) with a UTC window, and any normalized seven-day viewer-request metric, cache-result breakdown or daily cache-hit percentage, policy-level allowed/blocked or preview-rule match count, selected top-level rule action count, or client access-log observation or optional recent grouped WAF rule samples returned for a selected resource. An observation can include the UTC window, count of returned days, aggregated request counts and additional-metrics subscription state; missing data remains labeled unknown. Temporary credentials, cache-key parameter/header/cookie names, route host/path match values, origin hostnames and paths, behavior path patterns, probe paths, health-check host/path values, endpoint IP addresses and instance identifiers and full provider responses and raw billing rows from those checks are not saved. Workspace members can view saved results and owners can export them.
• Website and security information: request and browser metadata, IP addresses processed by the hosting service, operational logs, authentication records, and rate-limit records. Application rate-limit keys use hashes of email addresses or IP addresses rather than storing the raw values as those keys.
• Review requests: name, work email, role, company, the cloud or CDN provider and plan you enter, an approximate zone count, an optional renewal note, and an optional message. We use this to decide whether to invite you to the private pilot. When email delivery is enabled, a notification of that request goes to our contact address. The request does not itself create an account. We have not set a deletion period for these records; contact us to ask for removal.
• Communications: information you send us when requesting support or exercising your rights.

Information comes from you, authorized workspace members or administrators, connected services you authorize, and your interaction with the website. The current scan collectors store selected configuration and aggregated analytics, rather than a full copy of individual visitor requests, visitor cookies, or application response bodies. This does not mean website hosting and security systems never process an IP address.

For an optional owner-initiated selected-resource check, a separate short-lived log credential can read bounded request-log records. Those records may contain visitor IP addresses, URLs, headers, and other request details. Plimie processes them transiently to count matches by linked policy, rule priority, action, outcome, and preview/enforcement state. If the owner saves the check, only those normalized counts, the observed window, configured sampling rate when available, and coverage status are retained and visible to workspace members and in exports. The credential and raw request-log rows are not saved.

An optional sampled-rule check receives bounded recent individual request samples from the connected service. These samples can include visitor IP addresses, URLs and headers; Plimie processes them transiently into rule/action sample counts and discards the request details. Only normalized counts, population and coverage can be saved by owner choice. Samples can cover multiple protected resources and do not represent all requests.

An optional selected-policy WAF diagnostic check instead requests grouped rule-event counts from the log service for verified linked resources. Plimie receives rule name, logged action, mode, day and count, not the underlying visitor request rows. Saved results can include those grouped counts, the resource and policy identifiers, observation window and coverage state. A single visitor request can create more than one rule event.

How we use information

We use information to authenticate users, manage access, perform requested assessments, present evidence and reports, record your feedback, deliver service messages, investigate errors and abuse, provide support, and meet applicable legal obligations. We do not sell personal information, share it for cross-context behavioral advertising, or use advertising trackers in the current product.

Where a law requires a legal basis for our own processing, we rely on performing our agreement with you for account and service delivery; legitimate interests in operating, securing, and supporting a business service where those interests do not override your rights; legal obligations where applicable; and consent where required. For organizational workspace data, the organization is responsible for the lawful basis for its instructions. You can withdraw consent for consent-based processing without affecting earlier lawful processing.

External AI processing is disabled in this pilot. Plimie does not send customer data to an external AI model. Assessments currently use deterministic rules, and missing evidence remains visible.

Who can receive information

Authorized members of your workspace can access information permitted by their roles. We use service providers for hosting, storage, background processing, security, and transactional email. Those services receive information needed for their functions; an email delivery service, for example, processes the recipient address and message. Connected services receive requests and credentials needed to perform authorized reads.

We may disclose information when required by law, to respond to valid legal process, or when reasonably necessary to protect rights, safety, and service security. Information may also be transferred in a merger, acquisition, or business transfer, subject to applicable law and appropriate notice. We do not authorize service providers to use workspace data for their own advertising.

Cookies and browser storage

Plimie uses first-party cookies needed for sign-in and sessions. Sign-in and return-path cookies last up to 10 minutes; the session cookie lasts up to seven days unless cleared earlier. These cookies use secure, HTTP-only settings in production. Server-side authentication records expire separately and are removed through maintenance; expiration is not a promise of immediate physical deletion.

If you choose a light or dark theme, your browser stores that preference until you clear it or change it. You can remove cookies and browser storage using browser settings, although removing authentication cookies signs you out or interrupts sign-in. The fictional sample assessment holds interactive feedback only in the current page; it resets on reload. Downloaded sample exports remain on your device until you remove them.

The public site loads one measurement beacon on each page through its hosting platform. Plimie does not add a second beacon. It is not an advertising tracker. The review form also runs a bot check before a request is stored.

Email choices

Sign-in messages are necessary to access your account. Workspace owners can separately enable scan-completion and weekly-report emails to their own sign-in address; both options start off. You can turn them off in the workspace. These messages contain a generic notice and authenticated link rather than assessment evidence or credentials. Opting out stops pending delivery, but messages already in flight cannot be recalled. These preferences are not marketing consent.

Retention, export, and deletion

Workspace evidence and feedback remain in the active application database until the owner deletes the workspace. Disconnecting a connection removes the stored credential and cancels active scans; it does not erase previously collected evidence. Revoke the credential separately in the account where you created it.

Owners can export workspace data and delete the workspace in its settings. Deletion removes workspace records and credentials from the active database and queues deletion of retained background scan state. That cleanup is asynchronous; instance identifiers and operational retry metadata remain until removal or absence is acknowledged. Workspace deletion does not automatically delete your separate user account, pilot invitation, or session records. Contact us to request account deletion or help with other records.

Backup and operational-log retention periods have not yet been finalized for this pilot. We cannot promise that deleting active records immediately removes recovery copies, delivery records, or messages already held in recipient mailboxes. Retention decisions must account for service needs, security investigations, legal obligations, and deletion requests; where we must retain a record, we will explain the applicable limitation when responding to your request. Contact us before connecting data with a required deletion deadline or residency requirement.

Security and location

Plimie uses encrypted storage for connected credentials, authenticated workspace access, and secure transport. No system can guarantee complete security. Do not send credentials in support email. See Data and access for the implemented controls and current pilot limitations.

Zeroteam LLC is based in the United States. Infrastructure and service providers may process information in the United States or other countries. The pilot does not offer a country-specific storage commitment. If your organization requires particular transfer safeguards or a data-processing agreement, contact us before connecting its data so those requirements can be evaluated; this policy does not itself establish those arrangements.

Your choices and rights

Depending on applicable law, you may have rights to access, correct, delete, or obtain a copy of your personal information; restrict or object to processing; withdraw consent; and complain to a relevant privacy regulator. We will handle requests and any available appeal within the timelines required by applicable law. We do not discriminate against you for exercising applicable privacy rights.

Email contact@plimie.com with your request. We may need to verify your identity and authority, and some requests are subject to legal exceptions or the rights of others. If a request is denied, you can ask us to review that decision at the same address. For data controlled by your organization, contact its workspace owner; we will help route requests where appropriate. Do not include passwords, connection tokens, or unnecessary sensitive information.

Children

Plimie is a business service for adults and is not directed to children under 18. If you believe a child has provided personal information, contact us so we can investigate and address it.

Changes and contact

We may update this policy as the service changes. We will update the effective date and provide additional notice of material changes where required. For privacy questions, contact Zeroteam LLC, Texas, United States, at contact@plimie.com. See also our Terms of Service.