Pluno AI

GDPR overview

GDPR implementation is concrete and documented rather than merely declarative. Pluno publishes an Article 28 data processing agreement online, in English and German, with a signed copy available from privacy@pluno.ai. Customer personal data is processed in principle within the European Union or European Economic Area, and transfers to third countries require Articles 44 to 49 safeguards; standard contractual clauses are named in the privacy policy. Article 32 measures are itemised area by area, from physical access to supplier control, and unauthorised access is notified within 48 hours. Subprocessors are published in a hosted trust centre with a two-week objection window. The vendor also claims SOC 2 Type II certification and states plainly that it is fully GDPR compliant. No Article 27 representative or data protection officer is named, which is expected for a German-established controller.

Who owns the data?

Under the terms of service, the customer retains all rights in its Customer Data. Unbrained GmbH, the company behind Pluno, receives only the licence it needs to provide, secure, maintain, analyse and improve the service, and acts as a processor under Article 28 GDPR on the customer's documented instructions. Aggregated and anonymised data that identifies neither the customer nor any individual may be exploited freely by the vendor. Customers can request an export of their data within five business days. Unbrained may also use a customer's name and logo in marketing material unless the customer objects in writing.

Reuse rights

Customers keep control of what they put into Pluno and can reuse it freely: nothing in the terms restricts a customer's own use of its tickets, conversations or generated outputs, and an export can be requested within five business days. The vendor's own reuse is narrower. Customer Data serves only to provide, maintain, secure and improve the service; Unbrained states that it never trains, retrains or fine-tunes AI models on it, and that model providers never access it. Product-improvement analytics run on aggregated or anonymised data only, and customers may object by emailing support or from inside the software, accepting reduced functionality in return. Personal data is never sold and never used for personalised advertising.

Data retention & training

Hosting summary

Pluno states on its homepage that it processes all data in Europe and hosts its language models through Microsoft Azure, with model providers never accessing customer data. The data processing agreement is more precise on jurisdiction: customer personal data is processed in principle within the European Union or the European Economic Area, and processing in a third country is permitted only where Articles 44 to 49 GDPR are satisfied. The privacy policy adds that data may be stored or processed outside the user's own country or the EEA, with appropriate safeguards such as standard contractual clauses. No specific country, region or data centre is named anywhere, so the commitment stops at region level. Security measures listed include automatic backups, zone-redundant or otherwise resilient storage where appropriate, and physical data-centre security handled by the hosting provider. The public site itself is served from an anycast CDN node, which says nothing about where processing occurs.