Plumence

GDPR overview

Implementation is concrete rather than declarative. The privacy policy, dated 30 March 2026, names JSJ Services as controller, gives consent and contract performance as legal bases, and lists each category of data with its purpose. Rights are spelled out with their articles: access, portability under Article 20 through a JSON export button, erasure under Article 17 through account deletion, rectification and objection. Both the export and the deletion are self-service in the account panel rather than an email request. Complaints to the CNIL are explicitly signposted. Transfers outside the European Union are said to rely on standard contractual clauses and the Data Privacy Framework. Cookies are split between two strictly necessary ones and a Google Analytics cookie set only after explicit consent. No DPO and no Article 27 representative are named, which is consistent with a French-established publisher.

Who owns the data?

The terms are unusually clear on ownership. Article 8 states that texts produced with Plumence belong entirely to the user, and that JSJ Services claims no property right over user-created content. The homepage FAQ repeats it: the writer remains the sole author, and the tool acquires no right over the manuscript. The publisher keeps ownership only of the platform itself, its source code, design, features and brand. On the processing side, the privacy policy names JSJ Services as data controller and lists what it holds: email, first name, a bcrypt-hashed password, chapters, audio or text submissions, uploaded images and usage counters. Payment card details are never stored, being handled by Stripe.

Reuse rights

Users may reuse their own material freely and without asking: exporting and publishing the manuscript is the whole point of the product. Finished text can be downloaded as a laid-out PDF, as EPUB on the Pro plan, or as DOCX, Markdown and TXT, then submitted to Amazon KDP or Kobo under the author's own name and ISBN. Every personal record can also be pulled out as JSON under Article 20 of the GDPR. The limits are behavioural rather than proprietary: article 10 of the terms forbids generating illegal, defamatory, hateful or discriminatory content, anything infringing third-party rights, and any spam or fraud. Article 9 adds that JSJ Services guarantees neither literary quality nor factual accuracy, so the author alone answers for the published text.

Data retention & training

Hosting summary

The privacy policy places user data in the European Union, on servers located in Helsinki, Finland. The legal notice adds that the site is hosted by Hetzner Online GmbH, based in Gunzenhausen, Germany, with the data itself held in that provider's Helsinki datacentre. Technical subcontractors are said to be bound by processing agreements, and any transfer outside the European Union is covered by standard contractual clauses or the Data Privacy Framework. No named subprocessor list is published, although Stripe, Claude by Anthropic, Whisper by OpenAI and Google Analytics are each mentioned elsewhere on the site. The publisher is established in France, French law governs the terms, and the CNIL is named as the supervisory authority for complaints. No SOC 2, ISO 27001 or comparable certification is claimed. Note that the domain resolves through Cloudflare on an anycast address geolocated in the United States, which reflects the content network and says nothing about where the manuscripts are stored.