Privacy Policy

01. Who we are and what this covers

Plastr (useplastr.com) is operated by Ames Create, an Indiana business operated by Brandon Ames, United States. This policy covers the website, the emails we send, and the records we keep about creators (people who list sponsorship space), sponsors (people and businesses who buy it, with or without an account), and anyone who writes to us. Stripe's own privacy policy covers what you give Stripe directly on its pages.

02. What we collect, and where it comes from

Almost everything we hold, you typed or uploaded. The rest comes from your device, from Stripe, or from what happens on an order.

• Account. Email address (your sign-in), a display name and username (generated from your email until you change them), and anything you add to your profile: photo, bio, headline, location, social links. Previous email addresses are kept after a change so we can recognise old links and messages.
• Listings. Everything on a listing: title, story, photos (camera metadata such as GPS location and the exact time is stripped from every upload before it is stored), sponsor spots, prices, audience numbers you type in (published as owner-reported), the listing history, and a draft while you build it.
• Audience evidence. If you send a screenshot, export or report to back an audience number, we keep the file and any note with it. See section 05: this is private.
• Orders. For sponsors: company or brand name, website, the email used at checkout, the logo and brief you upload, your answers to the creator's questions, a reference image if you add one. For both sides: the frozen record of what was sold, amounts, fees, the payment schedule, and every event on the order.
• Proof of delivery. Photos, screenshots, links and notes the creator submits, and the sponsor's decision on them.
• Messages and updates. Messages between the sponsor and creator on an order, including any attached image, and progress updates the creator posts.
• Offers. Offer amounts, the buyer's email, company, website and message, counteroffers and outcomes.
• Payments and payouts. Stripe's identifiers for the checkout session, payment, charge, transfer, refund and dispute; the platform fee; whether a creator's Stripe payout account can receive money and what Stripe says is still required; and a label like “Chase ending in 1234” so we can tell you when your payout destination changes. We never see or store card numbers, bank account numbers or the identity documents Stripe collects.
• Support and requests. Emails you send to support, contact-form messages, help requests on orders, cancellation requests, listing reports, copyright and trademark notices, appeals and privacy requests, with the details you include.
• Sign-in and security. Sign-in codes and links (single use, deleted within a day). For each sign-in, email change, payout change or deletion request: the date, a coarse device description (“Safari on iPhone”), an approximate city from your connection, and the IP address, which is removed after 90 days.
• Agreements. Each time you accept the Terms, Rules, Refund policy or Privacy Policy, or choose marketing email: which document, which version, when, where in the product, and (for 90 days) the IP address and browser used, so a disputed acceptance can be checked.
• Usage. Page views and product events (a listing was viewed, a share link was copied, a checkout started) tied to a random identifier stored in your browser, not to your name or email; the referring site as a coarse label (“Instagram”, “Search”); and which share channel a visit came from. No IP address, device fingerprint or precise location is stored with these.
• Email delivery. For every email we send: to whom, the subject, the template, whether it was delivered, bounced or marked as spam, and, for 30 days, the rendered message so a failed send can be retried. Sign-in emails are never stored in full.
• Brand enquiries. If you use the brand form: company, email, website, budget, audience, categories and notes.

03. Why we use it

To run the marketplace: publish what you choose to publish, take payment and release it on the schedule the Terms describe, let the sponsor and creator complete the order, check proof, decide refunds and disputes, and pay creators. To keep it honest: review listings and evidence, detect fraud and duplicate accounts, enforce the Rules, handle reports and notices, and defend chargebacks. To keep your account safe: sign you in, tell you about new sign-ins and changes, and prevent abuse of public forms. To meet legal duties: tax and payment records, responding to lawful requests, keeping proof of agreements. To improve Plastr: aggregate usage of pages and features. To send you email you asked for (section 11). We do not build advertising profiles and we do not use automated decision-making that has a legal or similarly significant effect on you.

04. What is public

Listing pages are public by design and may appear in search engines and social previews: the title, photos, story, spots, prices, audience numbers with their owner-reported or reviewed label, updates, and the creator's public profile (display name, username, photo, bio, links, location). Once a placement is live, the sponsor's company name, logo and website appear on the listing and on a Plastr brand page. Share images and story cards are generated from that same public information. Your email address, your orders, your messages, your evidence and your proof are never public.

05. What stays private

Audience evidence (analytics screenshots, exports, attendance reports) is stored with the listing, read only by the people at Plastr who review it, never published, never shown to sponsors, and never given to another creator. The most that appears publicly is a label saying evidence was submitted or reviewed. Send the least you can and blank out follower names, messages, email addresses and revenue lines that are not what you are evidencing. You can ask us to delete a specific file at any time. Proof is shared with the sponsor of that order (it is what they paid for), may be reviewed by a person at Plastr, and is used as evidence if the payment is disputed. Order pages, including the sponsor's brief, logo, reference images, proof and messages, open only for the creator, the sponsor (signed in with the checkout email, or on the browser that paid) and Plastr staff. Uploaded images are stored in our database, not on a public file host; listing photos are served from a URL that is public once the listing is, and nothing private is ever served that way.

06. Who receives it

We share personal information only with the categories below, and only what each needs.

• Payment processing: Stripe. The sponsor's email and the order description for checkout; the creator's email and user id to open a payout account; amounts and identifiers. Creators give Stripe their identity and bank details directly. Stripe is an independent controller for the data it collects.
• Email delivery: Resend. Recipient address, subject and message body of every email we send, and inbound email to support@. Resend tells us delivery status.
• Hosting and network: Vercel. Runs the website. Sees requests, including IP addresses, as any web host does, and provides the coarse location used in security notices.
• Database: Railway. Hosts the database that holds everything in section 02, including uploaded images.
• The other party to your order. A creator sees the sponsor's company, website, email (to be able to contact them), logo, brief and messages. A sponsor sees the creator's public profile, proof, updates and messages. Each side sees only their own orders.
• A copyright or trademark complainant. If you send a counter-notice, it is forwarded, with your name and address, to the person who sent the original notice, as the law requires.
• Professional advisers. Lawyers, accountants and insurers, under confidentiality, when needed for advice, a dispute or a claim.
• Law and safety. When required by law, court order or a lawful request from a government authority; or when reasonably necessary to prevent fraud, protect someone's safety, or enforce the Terms.
• A successor. If Plastr is transferred to a new operating company (a company for Plastr is being formed) or sold, the records go with it under this policy, and we will tell you.

There are no other recipients: no analytics vendor, no advertising network, no session-recording tool, no data broker. The full list, with links to each provider's privacy terms, is kept in our service provider register and available on request.

07. Selling, sharing, and advertising

We do not sell personal information, and we have not in the past twelve months. We do not "share" it for cross-context behavioural advertising in the sense of California law, and we do not use targeted advertising: no advertising pixels, no ad networks, no tracking across other sites. Disclosures to the providers in section 06 are for operating the service and are made under contracts that restrict their use. Because we do neither, there is no "Do Not Sell or Share" setting to offer; we honour a Global Privacy Control signal by not doing anything a signal would turn off, and if that ever changes this section and the site will say so.

08. Cookies, storage and analytics

Plastr sets two cookies of its own and none from anyone else. plastr_session keeps you signed in (90 days, renewed while you visit; it cannot be read by scripts). plastr_in is a one-character hint so the page can show the signed-in header before it loads; it carries no personal data. A sponsor who pays without an account gets a third cookie, plastr_sp, proving that browser checked out with their email, so their order page opens for 30 days; admins get a fourth, plastr_admin, after a second-factor check. Your browser also stores, for Plastr only: a random visitor id for usage counts (plastr:v), the share channel that brought you here for the current tab, a listing draft while you build one, and the nudges you dismissed.

Analytics is first-party: the events in section 02 go to our own database and are used for the counts creators see on their listings and to understand which features are used. There is no third-party analytics, no session replay, no fingerprinting, and no advertising cookie, which is why there is no cookie banner: nothing here needs consent to be set, and everything not strictly necessary is described in this section. Because we do not track you across other sites, a browser "Do Not Track" or Global Privacy Control signal changes nothing: there is no cross-site tracking to turn off. Stripe sets its own cookies on its own checkout page, under its own policy.

09. How long we keep it

• Your account and listings. While your account exists. Delete it from Settings and the profile, sign-in, drafts and listings without sponsorship history are erased at once; listings that had sponsors are archived and unlisted with their photos removed.
• Orders, payments, refunds, disputes, proof, order messages and events. Up to 7 years after the order closes, because tax law, card-network dispute windows and the need to answer a chargeback require it. These survive account deletion; the email used at checkout stays on the order because it is part of the payment record.
• Audience evidence. While the listing is live and for as long as a dispute about it could arise; deleted when you ask, and deleted for every listing when the account is deleted.
• Agreement records. The record that you accepted a version of the Terms is kept for as long as any order or listing under it could be disputed, and survives deletion. The IP address on it is removed after 90 days.
• Sign-in codes. 1 day.
• Security events. Kept with the account; the IP address is removed after 90 days, and the device and location are removed when the account is deleted.
• Email log. Delivery records are kept as an audit trail; the message body is removed after 30 days. Sign-in emails are never stored in full.
• Support, reports, notices, appeals, privacy requests. Kept as records of how each was handled, because they are the evidence that we handled it.
• Usage events. Kept in aggregate; they are not tied to your account.
• Abandoned drafts. Deleted after 180 days without a change.
• Legal hold. Where a claim, investigation or dispute is open, the records it concerns are kept until it closes, even if a deletion would otherwise apply.

The full schedule, with the reason for each period, is in our internal retention schedule and available on request.

10. How we protect it

Traffic is encrypted in transit. The database accepts connections only with credentials held by the application. Access to the admin tools requires an email sign-in and an authenticator-app code, and every admin action is logged with who did it. Private files are never served from public URLs. Public forms are rate-limited. Sign-in emails and codes are single use and expire in minutes. No system is perfectly secure; if we learn of a breach affecting your personal information we will investigate, contain it, and notify you and any authority as the law requires (our written breach plan sets out how).

11. Your choices and rights

Whether or not a privacy law gives you these rights, Plastr honours them for everyone, on the same 45-day target:

• Know and access. Ask what we hold about you and get a copy in a portable format.
• Correct. Change your profile, email and listings yourself in the product; ask us for anything else.
• Delete. Delete your account from Settings, or ask us to. Section 09 explains what must be kept and why; an open order, an open dispute or a legal hold pauses deletion until it clears, and we tell you.
• Opt out. Marketing email is off unless you turn it on, tips about your own listings can be turned off in Settings, and every commercial email has an unsubscribe link. Account, security and order email cannot be turned off while you have an account or an open order, because they are how the service works.
• Appeal. If we deny a request, you can appeal and a different person reviews it.
• No penalty. We will not treat you differently for using any of these rights.

Make a request at /privacy-request or by emailing support@useplastr.comfrom the address on your account. We verify requests: a signed-in request is verified by the session; an emailed or typed one by a link sent to that address. An authorised agent may act for you with written permission we can verify. Every request gets a reference number and is handled by a person.

12. State privacy laws

Several U.S. states (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Nebraska, Maryland, Minnesota, Indiana and others) have comprehensive privacy laws. Most apply only to businesses above a threshold of revenue or number of residents whose data they process; at the time of writing Plastr is below every one of those thresholds that we have assessed, and we say that rather than claim rights that do not yet legally apply. We have built the rights in section 11 so that when a threshold is crossed the process already exists. For the record: we do not sell personal information, do not process it for targeted advertising, do not profile you, and do not collect sensitive personal information (such as precise geolocation, government identifiers, health or biometric data) except that Stripe collects identity information for payouts under its own policy. California residents: the categories of personal information collected are those in section 02, the sources and purposes are in sections 02 and 03, the recipients in section 06, and retention in section 09; we have not sold or shared personal information in the preceding twelve months.

13. Children

Plastr is not intended for anyone under 18, and not directed to children under 13. We do not knowingly collect personal information from a child under 13; if you believe we have, email support@useplastr.com and we will delete it. The Rules also prohibit listing a minor as the sponsored subject.

14. Where Plastr operates

Plastr is operated from Indiana, United States, is built for people and businesses in the United States, and stores its data with the providers in section 06 in the United States. We do not currently represent that Plastr meets the requirements of the EU or UK GDPR or other non-US privacy laws; if you use Plastr from outside the United States, your information is transferred to and processed in the United States under this policy.

15. Changes

We will post changes here with a new version and date. A material change (new categories of data, new purposes, new kinds of recipient, or a change to your rights) is announced by email to account holders before it takes effect.

16. Contact

Privacy: support@useplastr.com. Support: support@useplastr.com. Plastr is operated by Ames Create, Indiana, United States. See also the Terms and the Rules.