Plotaverse

GDPR overview

No GDPR implementation is documented. Across the seventeen archived pages, including the single legal page (effective 1 January 2025, last updated 23 November 2025), the terms GDPR, General Data Protection Regulation and CCPA never appear. The policy is purely US-facing: governing law is the State of Florida, and users abroad are told, “By using Plotaverse from outside the United States, you consent to transferring your data to the U.S., where it may be processed under U.S. law.” No Article 27 EU representative, no DPO, no DPA and no named subprocessors are published; the only privacy contact is info@plotaverse.com. Members may edit or delete content, delete their account, update their profile and request a copy of their data. Those rights echo access, rectification, erasure and portability, but are never described as such, and no legal basis, retention period or complaint route to a supervisory authority is stated.

Who owns the data?

Under the Terms of Service, users keep ownership of everything they upload: “You retain ownership of all content you upload”. In exchange they grant Plotagraph, Inc. a non-exclusive, worldwide, royalty-free and transferable license to display, host, store, process, reproduce and distribute that content inside the platform, to promote Plotaverse using public content, and to let other members view, share and interact with it. “This license ends when you delete your content, except where copies were made by other users or stored as backups.” Trademarks, logos and design elements remain the property of Plotagraph, Inc. Creators can allow reposts, require credit, restrict them to non-commercial use or forbid them, but only inside Plotaverse.

Reuse rights

Plotaverse collects what members provide: name, username, email, bio, links, preferences, uploaded content, support exchanges, plus payment details for Pro+ purchases handled by third-party providers, with no full card number stored. It also collects device model, OS version, unique identifiers, IP address, timestamps, crash reports, features used, content viewed, interactions, cookies and pixels. Linking Instagram, TikTok, Facebook or X content retrieves public metadata only: “We do not collect passwords or direct access tokens”. Stated purposes are running and improving the service, personalizing the feed and Collections, displaying user content, answering support, analyzing usage, detecting harmful behavior and sending notifications. Data is shared with categories of providers (cloud hosting, analytics, support, payment), with authorities where legally required, and with other members for public content. The publisher states: “We do not sell your personal information to third parties”. Reusing another member's content requires that creator's repost setting to allow it, and nothing published mentions AI model training on user content.

Data retention & training

Hosting summary

The only identifiable hosting jurisdiction is the United States, deduced from the international transfer clause of the privacy policy: “By using Plotaverse from outside the United States, you consent to transferring your data to the U.S., where it may be processed under U.S. law.” No region, no data center and no cloud provider is named. Section 3.1 of the policy lists categories of providers only, namely cloud hosting, analytics, customer support and payment processing, without naming a single company, so no subprocessor list exists. The Google Play data safety block declares encryption in transit and deletion on request; nothing is said about encryption at rest. One distinction matters: the marketing site itself runs on AS2635 Automattic, Inc. infrastructure (WordPress.com / Jetpack), IP 192.0.78.24 announced by anycast and geolocated in San Francisco, which concerns the website and not necessarily the application's user data. In short, US jurisdiction, no EU option offered or mentioned, and no technical detail published on where or how user content is stored.