Get started

Privacy policy

Updated

This policy covers the Pufflo website (pufflo.app) and the Pufflo app (my.pufflo.app). Pufflo is run by Plain Sight AS, org. no. 935 659 167, Kleiverveien 28, 3440 Røyken, Norway (“we”, “us”).

Who is responsible for your data

  • Your account (name, email, sign-in): we are the data controller.
  • Your business’s data in Pufflo (connected accounts, website content, results): we process it on behalf of the business that uses Pufflo, as a data processor. Our terms of service include the data processing agreement.

What we collect

On the website: nothing that identifies you. The website has no forms, no cookies and no tracking. Cloudflare, which delivers the site, processes technical data such as IP addresses to deliver it and protect it against abuse.

In the app:

  • Account: name, email address and profile picture from Google sign-in, or the email address and password you sign up with (we store only a one-way hash of the password). If you turn them on, also your passkeys (public keys only) and the settings for two-step sign-in.
  • Business details: business name, website address, market, language, goals and settings you enter.
  • Connected accounts (only the ones you choose to connect, with the access you approve):
    • Google Search Console: search performance and indexing for your website.
    • Google Analytics: visitor numbers and conversions (read-only).
    • Google Tag Manager: tags and containers for your website.
    • Google Ads: campaigns, spend and results.
    • Google Business Profile: your business listing and reviews.
    • Meta (Facebook and Instagram): ad accounts and results, the pages you manage, and the Instagram business account linked to them.
    • GitHub: the repository for your website, if you choose to connect one.
  • Your website: public pages we read to find technical problems, and pages and content we create for you.
  • Activity: suggestions, what you approved and what our agents did, so it can be shown in “What we did for you” and undone.
  • Conversations with the AI assistant (“Ask Pufflo”): the questions you ask, the answers and what you confirmed on the answer cards. They are stored with your business’s data and are only visible to you.
  • Essential cookie: one session cookie to keep you signed in. No advertising or analytics cookies.

How we use data from Google

Pufflo uses data from your Google account only to provide the features you see in the app: showing your results in one place, finding improvements, and – only when you approve or have turned on autopilot for that area – making changes on your behalf. Access is read-only by default.

Pufflo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use Google user data only to provide and improve the features of Pufflo that you use.
  • We do not sell Google user data, use it for advertising, or use it to build profiles for anyone else.
  • We do not use Google user data to develop, improve or train generalised AI or machine learning models.
  • People at Pufflo do not read your Google data, except when you ask us for help with a specific problem, when it is needed for security or to comply with the law, or when it is aggregated and anonymised for internal operations.

The same principles apply to data from Meta and GitHub.

How we use AI

Pufflo’s agents and the AI assistant in the app (“Ask Pufflo”) use AI models (Anthropic Claude, through Cloudflare AI Gateway) to analyse your results, answer your questions and write suggestions and content. When you ask the assistant something, your question, the earlier messages in that conversation and the business data it looks up to answer are sent the same way. The assistant tells you it is an AI and cannot change anything unless you confirm it. The data is sent only to produce your answer. Under Anthropic’s commercial terms, data sent through its API is not used to train its models, and Anthropic normally deletes it within 30 days. Cloudflare AI Gateway passes the requests on without storing their content: it keeps only technical details about each request (time, model, number of tokens, cost and errors) for a few days, so we can follow costs and fix errors.

To check how AI assistants describe your business, we send questions about your market (for example “best plumber in Bergen”) to ChatGPT (OpenAI), Gemini (Google) and Perplexity. These questions do not contain personal data.

Where data is stored and who processes it

Your data is stored in the EU/EEA. Connection tokens for Google, Meta and GitHub are encrypted and stored separately from login data.

Sub-processor Purpose Location
Cloudflare Hosting of the website, app and customer websites; storage; AI gateway File storage in the EU; global network (EU–US Data Privacy Framework, EU Standard Contractual Clauses)
Neon Database EU (Frankfurt) (EU Standard Contractual Clauses)
Anthropic AI models for analysis, content and the AI assistant USA (EU Standard Contractual Clauses)
OpenAI, Google (Gemini), Perplexity Market questions for AI visibility checks (no personal data) USA
DataForSEO Search volumes, rankings and competitor data for your website and keywords EU company (Estonia)
Resend Account emails (confirming your address, resetting your password, invitations) and notifications Sent from the EU (Ireland); account data in the USA (EU Standard Contractual Clauses)

We never sell personal data.

How long we keep data

  • While you are a customer, we keep your data so Pufflo can work.
  • When you disconnect an account, we revoke our access with Google, Meta or GitHub straight away and delete our copy of the access keys at once. The data we fetched from it is deleted within 30 days.
  • Conversations with the AI assistant are deleted at once when you delete them in the app. Otherwise they are kept while you are a customer.
  • When you close your Pufflo account, we delete your data within 30 days, except what we must keep by law (for example invoices, which Norwegian accounting law requires us to keep for 5 years after the end of the financial year).
  • Backup copies of the database are deleted after at most 30 days, so deleted data also disappears from backups within that time.
  • Technical logs (errors and requests) are kept only for troubleshooting and are deleted after at most 30 days.

You can also remove Pufflo’s access at any time in your Google account or in your Meta business settings.

Your rights

You have the right to access, correct, delete and export your personal data, and to object to or restrict processing. Email hello@pufflo.app. If your data is in Pufflo through a business you work for, we will help that business answer your request.

If you think we handle your data incorrectly, you can complain to the Norwegian Data Protection Authority (Datatilsynet) or the data protection authority where you live.

Changes

If we make important changes to this policy, we will tell you in the app or by email before they take effect.

Contact

Plain Sight AS
Org. no. 935 659 167 MVA
Kleiverveien 28, 3440 Røyken, Norway
hello@pufflo.app