Privacy notice

Last updated 24 September 2026

Who we are

Plume is operated by Novi Labs Ltd, a company registered in England and Wales under company number 17335077. Our registered office is 128 City Road, London, EC1V 2NX, United Kingdom.

For any question about this notice or your personal data, write to [email protected].

Our two roles

For this website, for enquiries and for the accounts of people who sign in to Plume, we are the controller of your personal data.

When an organisation uses Plume, it connects its own business systems, such as its CRM, email, calendar, call recordings, Microsoft Teams or Slack. For that data we are a processor. We act only on the organisation's instructions and under a written data processing agreement. The organisation's own privacy notice applies. If you ask us about that data, we pass your request to the organisation and help it respond.

What we collect on this website

• Email founders: your work email and your message. The form sends them to our server on Cloudflare, which emails them to the founders through Resend. The email goes to our Google Workspace mailbox.
• Book a demo: your name, company size, what you are looking for, your work email and, if you give it, a WhatsApp number. When you submit this brief, we email it to the founders the same way, even if you do not book a time. If you give a WhatsApp number, we may contact you on WhatsApp.
• Booking calendar: the Cal.com calendar loads only after you submit the brief. When it opens, we give Cal.com your name, email, company size, what you are looking for and any WhatsApp number, so its booking form is filled in for you. If you book, Cal.com uses these details to schedule the call.
• Spam checks: each form also sends a hidden field and the time you took to fill it in. We use them only to block automated spam and do not keep them.
• Technical data: Cloudflare hosts this website and processes your IP address and basic request data to deliver the site and block abuse. Fonts load from Google Fonts, which receives your IP address.

We do not use analytics or advertising cookies on this website, and we set no cookies of our own. Cal.com may set cookies it needs for booking when the calendar opens.

We use these details to reply to you and to arrange and follow up a demo. Our lawful basis is our legitimate interest in answering business enquiries, or steps you ask us to take before a contract. We keep enquiry data for up to 24 months after our last contact, unless you become a customer.

If you use Plume

• Account data: your name, work email, organisation and role, used to sign you in and control what you can see. Sign-in is handled by Stytch.
• Microsoft Teams: if your organisation installs the Plume app for Microsoft Teams, we store the Microsoft identifiers needed to recognise you and reply to you. These are your organisation's tenant ID, your user object ID and the conversation ID. We process the messages you send to Plume in Teams to answer them.
• Business data from connected systems: processed for your organisation as described above.

Plume uses large language models to analyse business data and answer questions. Our model providers do not use your data to train their models.

We keep account data while your organisation's agreement is in force. After it ends, we delete it as that agreement sets out.

Who we share data with

We do not sell personal data. We use these service providers, under contracts that protect the data:

• Hosting and infrastructure: Fly.io (London), Supabase on Amazon Web Services (London), Upstash (London), Cloudflare.
• Sign-in: Stytch.
• AI models: Anthropic, OpenAI and, where an organisation chooses it, Google Cloud Vertex AI.
• Email and scheduling: Google Workspace, Resend (sends website form emails) and Cal.com.
• Fonts: Google Fonts.
• Messaging: WhatsApp (Meta), only if you give us a WhatsApp number.

We may also disclose data where the law requires it.

International transfers

We host Plume in the United Kingdom. Some providers process data in the United States. Where data leaves the UK, we rely on appropriate safeguards, such as the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework.

How we protect data

We encrypt data in transit and at rest, keep each organisation's data separate, and limit access to the people who need it.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, or transfer it. Write to [email protected]. We reply within one month. For data we process for your employer, we pass your request to them.

You can also complain to the Information Commissioner's Office at ico.org.uk. We would like the chance to resolve your concern first.

Changes

We will update this page when our practices change and show the date at the top.