--- title: Plainrouter Privacy Policy description: How Wudaku Oy processes personal data for Plainrouter's marketing site, accounts, Google sign-in, product analytics, billing, and security. canonical: https://plainrouter.com/privacy last_updated: 2026-09-30 --- # Plainrouter Privacy Policy **Effective date: 30 September 2026** ## 1. Controller and contact Wudaku Oy, the company operating Plainrouter, is the controller for the processing described in this notice. The privacy contact is **Robin He**. [Contact Robin He](/contact#plainrouter-contact) to ask a privacy question or exercise your rights. ## 2. Scope and customer measurement data This notice covers only Plainrouter's own processing as controller in the contexts described below. For measurement data collected through a customer's installation, the customer determines the purposes and instructions. Wudaku Oy acts as a processor under Article 28 of the GDPR, processes that data on the customer's instructions, and is governed by the Data Processing Agreement. This notice does not describe that processor-side handling beyond this role boundary. For installations configured for a global market, advertising attribution and conversion measurement use legitimate interests by default. You can opt out through Global Privacy Control (GPC), by choosing Reject or denying Marketing in the Plainrouter banner, or by denying advertising through a detected consent manager. From that point, your later activity and purchases are no longer joined for advertising or sent to advertising platforms. Visitors in the EU/EEA, the United Kingdom and Switzerland remain opt-in on every installation. Installations configured for strict EU treatment also remain opt-in. ## 3. Marketing site visitors Our public pages load Plainrouter's own Signals snippet, the browser snippet our customers install. Each page load sends one arrival to our collector. The stored arrival contains no visitor identifier, page URL, referrer, IP address, or user agent. The snippet also shows our consent banner, where you can allow **Analytics**, **Marketing**, both, or neither. Nothing described below starts until you allow the category it names. A `pr_consent` cookie stores your choice for 180 days. You can change it at any time with **Privacy choices** in the site footer. If you allow Analytics, the marketing-site layout uses PostHog browser analytics to measure page navigation and Web Vitals. The Web Vitals are Largest Contentful Paint (LCP), Cumulative Layout Shift (CLS), First Contentful Paint (FCP), and Interaction to Next Paint (INP). These analytics components are used only in the marketing layout, not in authenticated product or onboarding layouts. With Analytics consent, we record a broad landing-page category, referring channel and, when available, your PostHog browsing-session identifier in your session, with a cookie recording whether this attribution is permitted. If you register within 30 minutes, these accompany the signup event so we can connect registration to that browsing session and measure which channels lead to product use. Pending attribution is removed at signup, on a successful consent-withdrawal request, or when the session expires. This attribution excludes raw URLs and campaign values; withdrawing Analytics consent prevents further use of pending attribution. The browser sends these events to the configured PostHog API host. The default endpoint is `https://t.plainrouter.com`, and the analytics service is PostHog Cloud EU. Analytics consent covers analytics measurement only. If you allow Marketing, the Signals snippet sets first-party advertising identifiers, including visitor and Meta browser identifiers, and sends a page-view event with any advertising click identifiers from the landing URL to our collector. Your consent choice, whether you allow or decline Marketing, is also passed to the consent controls of advertising tags on the site. Choosing Analytics only does not set advertising identifiers. Declining Marketing, or withdrawing Marketing consent, stops these events and clears the identifiers. If you allow Marketing, our public pages also load the Google Ads tag to measure advertising effectiveness. Your browser shares the page URL and IP address with Google, which may set or read advertising cookies with Marketing consent. Depending on your consent and Google settings, Google may also use this information to personalize ads. See [how Google uses this information](https://policies.google.com/technologies/partner-sites) for its processing, retention, and privacy controls. You can decline in our consent banner or later under **Privacy choices**. ## 4. Account data When you register, authenticate, or administer an account, we process account and contact details such as name and email address; authentication and security data such as a password hash, email-verification state, two-factor authentication data, session identifier, IP address, and user agent; and team and workspace administration data. We use this data to create and administer the account, authenticate the user, provide account access, and protect Plainrouter against security threats and abuse. If you choose Google sign-in, we receive your Google account identifier, name, email address, profile image, and authorization tokens. We store these with your account to sign you in, maintain the connection, and display your profile. We protect them with access controls and transmit them over HTTPS. Our hosting providers listed below process this stored data to operate Plainrouter. We do not sell this data, use it to train generalized AI models, or use it to target advertising. We keep the Google connection record while your account is linked. You can remove it in your profile's Connected accounts settings after setting a password, or delete your Plainrouter account. Removing the connection deletes its stored tokens and profile record; your Plainrouter account details remain until account deletion, subject to the retention rules below. You can also revoke Plainrouter's access from your [Google Account connections](https://myaccount.google.com/connections), and [contact Robin He](/contact#plainrouter-contact) to request deletion of retained data. Our use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including applicable Limited Use requirements. If Meta sends us a data-deletion request or tells us that a person has removed Plainrouter's access, we erase that person's Meta access and identity wherever we store a copy. This includes access and refresh tokens, Meta user IDs, the person's name and email, selected Pages and Page names, and ad account display names. We mark a data-deletion request complete when that erasure is done, including when an earlier removal of access has already erased the data. The customer's own advertising records remain until the customer deletes the workspace, team, or account. These records include launch intents, plans, receipts, ad object and ad account IDs, provider reads, and the audit chain. Advertising connections a user made on a team stay connected after that user deletes their Plainrouter account, until a team member disconnects them. The user can also revoke Plainrouter's access at any time in their Meta or Google account settings. ## 5. Product analytics for authenticated use For logged-in product pages, account milestones, installation views, verification milestones, a production token's first valid connection, and authenticated MCP requests and tool usage, Plainrouter sends server-side product analytics to PostHog. The capture uses an internal user identifier and is limited to event-specific route, registration method, consented signup landing-page category, referring channel and PostHog browsing-session identifier, permission level, deterministic milestone event identifier, MCP client and server metadata, credential identifier, MCP method, and server-assigned request identifier, listed tool names, tool name, duration, and error classification. Customer end-visitor measurement data is never sent to PostHog for this purpose. Verification events include only a deterministic workspace milestone event identifier in addition to the internal user identifier. The complete event allowlist is: - `$pageview` - `account_registered` - `install_viewed` - `verification_green` - `first_arrival_observed` - `production_token_created` - `agent_connected` - `mcp_initialize` - `mcp_tools_list` - `mcp_tool_call` The event-name allowlist and payload guard structurally limit capture. The guard rejects request details and customer or visitor identifiers such as email, phone number, IP address, user agent, URL, query string, and measurement identifiers. Product analytics event data is retained by PostHog (EU) for up to 1 year under the free-plan retention policy. ## 6. Billing Payment processing through Stripe will apply when billing is activated. Account and payment processing will be based on contract performance, and this notice will be updated with the applicable details before the first charge. ## 7. Processors and international transfers For Plainrouter's own controller processing, we use these processors: - **PostHog (Cloud EU)** for marketing-site and product analytics; - **Stripe** for payment processing when billing is activated; - **Hetzner Online GmbH (Germany)** for hosting and infrastructure; - **Cloudflare, Inc. (EU and United States)** for network and infrastructure services; and - **Laravel Holdings Inc. / Laravel Cloud services** for hosting and infrastructure services. PostHog Cloud EU is hosted in the European Union, and Hetzner Online GmbH is established in Germany. Where processing by Cloudflare or Laravel services involves a transfer to the United States, we rely on the EU-U.S. Data Privacy Framework while the recipient's certification remains valid. Cloudflare's Standard Contractual Clauses provide a fallback, and Standard Contractual Clauses are used where otherwise applicable. ## 8. Retention Account data is kept for the duration of the customer relationship and longer where legal obligations require it. Marketing-site analytics are kept according to the retention settings of the PostHog Cloud EU project. ## 9. Legal bases We rely on: - **contract performance** for account administration and, when activated, billing; - **consent** for marketing-site analytics, Web Vitals, consented Signals events, and Google Ads cookies and measurement; and - **legitimate interests** in understanding authenticated product use, in counting page loads with identity-free Signals arrivals, and in protecting Plainrouter against security threats and abuse. You may withdraw consent at any time without affecting processing that occurred before withdrawal. You may object to processing based on legitimate interests. ## 10. Your rights Subject to the conditions in data-protection law, you may request access to, rectification of, or erasure of your personal data; restriction of processing; data portability; or object to processing. You may also withdraw consent. Exercise these rights through **Robin He**, the privacy contact. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Office of the Data Protection Ombudsman, Tietosuojavaltuutetun toimisto).