Privacy Policy

Effective September 25, 2026

Plum is in development and isn't available to the public yet. This policy explains how we handle personal information today, through our website, waitlist, and pre-orders, and how the Plum app and device will handle it when they launch. We'll update this policy, and tell you, before anything changes.

Our core commitments:

• We never use your recordings, transcripts, or notes to train AI models, ours or anyone else's.
• Zero data retention with our AI providers. They process your data to return results to us, then don't keep it.
• You decide how long Plum keeps your content, or your organization does if you use Plum through a workspace.
• We don't sell or share your personal information for advertising.

This Privacy Policy applies to Hero Not Found, Inc. ("Hero Not Found," "we," "us"), which makes Plum, and to our website at helloplum.ai, the Plum apps and devices, and related services (together, "Plum"). If you use Plum through an organization, see Using Plum through an organization.

Contents

1. Information we collect
2. How we use information
3. Voice data and speaker identification
4. People who are recorded but don't use Plum
5. AI processing and training
6. How we share information
7. How long we keep information
8. Your choices and rights
9. Using Plum through an organization
10. Security
11. Children
12. Where we process information
13. Changes to this policy
14. Contact us

Information we collect

Today: website, waitlist, and pre-orders

• Waitlist and survey responses. When you join the waitlist, you fill out a Google Form, which collects your email address and any survey answers you choose to give. Google hosts the form and processes these responses for us.
• Pre-orders and payments. If you pre-order or subscribe, our payment processor, Stripe, collects your payment details, billing name, billing address, and email. We don't receive or store your full card number. We receive a record of the purchase, such as the plan, amount, and date, and the last four digits and brand of your card.
• Messages to us. If you email or call us, we keep your contact details and what you tell us so we can respond.
• Website technical data. Our hosting provider, Cloudflare, processes basic request information such as IP address, browser type, and pages requested, to deliver and protect the site. Our website doesn't use analytics, advertising, or tracking cookies. Stripe may set cookies on its checkout pages to prevent fraud.

When Plum launches: the app and device

• Account information. Your email address, used to sign in with one-time codes, and basic account records such as when you signed up and last signed in.
• Audio. When your Plum device or app is recording, it captures the audio of conversations around you, including the voices of other people.
• Transcripts and notes. Text transcribed from your audio, including timing and which speaker said what, and the notes Plum generates, such as the promises, commitments, and directions it identifies.
• People. Speaker labels and any names you give to the people in your conversations.
• Voice identifiers. Plum creates a voice identifier for each speaker so it can recognize them in future conversations. See Voice data and speaker identification.
• Device information. For Plum devices: device and hardware identifiers, firmware version, connectivity status, and the account the device is linked to. Wi-Fi network names and passwords you enter during setup are sent directly to your device and aren't stored on our servers.
• Usage and diagnostics. Information about how you use the app, such as screens viewed, sign-in events, and errors, together with your account ID and device details like model, operating system, and app version. We don't record your screen, and we don't use your IP address to determine your location.
• Connector information. If you connect an AI agent or other service to Plum, a record of that connection and what it's allowed to access.

We collect this information from you, from your Plum device and app, from services you connect, and from our service providers.

How we use information

We use personal information to:

• provide Plum: capturing, transcribing, and organizing your conversations, recognizing speakers, and generating your notes;
• create and secure your account, and authenticate you;
• process pre-orders, subscriptions, and payments, and send receipts and service messages;
• respond to your requests and provide support;
• understand how Plum is used and fix problems, using usage and diagnostic data (not the content of your conversations);
• protect Plum and our users against fraud, abuse, and security threats; and
• comply with the law and enforce our Terms of Service.

If you joined the waitlist, we'll use your email to tell you about Plum's availability. You can ask us to stop at any time.

We use your recordings, transcripts, notes, and voice identifiers only to provide Plum to you. We don't use them for advertising, and we don't use them to train AI models.

Voice data and speaker identification

This section is our notice and written policy for voice identifiers, which some laws treat as biometric information or "voiceprints."

• What we create. When Plum transcribes your audio, our speech provider analyzes the characteristics of each speaker's voice and produces a voice identifier. This is a data representation Plum uses to recognize that the same person is speaking again. Plum stores these identifiers with your account and links them to the people in your conversations, including any names you give them. Voice identifiers are created for everyone who speaks in your recordings, including people who don't use Plum.
• Why. Only to label who said what in your transcripts and notes, and to recognize recurring speakers across your conversations.
• Who receives them. Our speech provider, Speechmatics, processes voice identifiers on our behalf to perform speaker recognition, under a contract that prohibits other uses. We don't disclose voice identifiers to anyone else, except as required by law.
• What we never do. We never sell, lease, trade, or otherwise profit from voice identifiers, and we never use them to train AI models.
• How long we keep them. We permanently delete a voice identifier at the earliest of:
  • when you delete that person, or delete or merge the related speakers;
  • when you delete your account;
  • when we receive a verified request from the person it identifies; or
  • one year after that voice was last detected in your recordings.
• Consent. Plum will ask for your consent before creating voice identifiers from your account. Before you record anyone else, you're responsible for obtaining any consent the law requires from them, as described in our Terms of Service.
• Protection. We store voice identifiers using the same safeguards we use for your other most sensitive content.

People who are recorded but don't use Plum

If someone recorded a conversation with you using Plum, that recording, its transcript, notes about what you said, and a voice identifier for your voice may be stored in their Plum account. The Plum user, or their organization, decides what to record and how long to keep it, and is responsible for telling you and getting any consent the law requires.

You can:

• ask the person who recorded you to delete the recording, or to stop recording;
• email privacy@helloplum.ai to ask us to delete the voice identifier for your voice. We'll verify the request and delete it from every account where we can match it. You may need to give us a short voice sample for this; we'll use it only to find the match, and delete it afterward; or
• email us about any other concern. Where the account belongs to an organization, we'll pass your request to that organization and help it respond.

AI processing and training

Plum uses AI to transcribe audio, recognize speakers, and generate notes. Your content is processed by these AI providers on our behalf:

Zero data retention. Our AI providers process your data only to return results to us. They don't keep your audio, transcripts, or voice identifiers after processing, except for limited records a provider may be required to keep by law or to prevent misuse of its services.

No training. We don't use your recordings, transcripts, notes, or voice identifiers to train or improve AI models, whether ours or anyone else's. We contractually require our AI providers not to use them for training either. If we ever want to change this, we'll ask for your affirmative consent first, and any change will apply only going forward.

Your permission comes first. The Plum app will ask for your permission before sending your content to these AI providers.

Agents and services you connect. If you connect an AI agent or other service to Plum, for example Claude or Codex through a Model Context Protocol (MCP) connection, Plum sends that service the transcripts and other content it's allowed to access, at your direction. That service's handling of your data, including whether it retains it or trains on it, is governed by your agreement with its provider, not by this policy. You can review and revoke connections at any time.

How we share information

We don't sell your personal information, and we don't "share" it for cross-context behavioral advertising, as those terms are defined under California law. We disclose personal information only:

• to service providers that process it on our behalf, under contracts that limit their use of it to providing services to us:

• at your direction, for example to agents and services you connect, or to other people when you choose to share content;
• within your organization, if you use Plum through an organization's workspace;
• for legal reasons, when we believe in good faith it's required by law or legal process, or needed to protect the rights, property, or safety of our users, the public, or us; and
• in a business transfer, such as a merger or acquisition, in which case this policy will continue to apply to your information.

Stripe. Stripe processes payments on our behalf, and it also uses some payment and device information for its own purposes, such as fraud prevention, as described in the Stripe Privacy Policy.

Our staff. Our staff don't access your recordings, transcripts, or notes except when you ask us to for support, when needed to investigate security or abuse, or when required by law. Access is limited to authorized personnel.

How long we keep information

When you delete content or your account, we remove it from our active systems promptly and from backups within 30 days, unless we're legally required to keep it.

Your choices and rights

In Plum, you'll be able to:

• review, edit, export, and delete your recordings, transcripts, notes, and the people and voice identifiers in your account;
• set how long Plum keeps your content;
• pause recording;
• review and revoke connected agents and services; and
• delete your account from the app's settings, which deletes your content and voice identifiers.

Your privacy rights. Depending on where you live, including California and other U.S. states with privacy laws, you may have the right to:

• know and access the personal information we have about you, and receive a portable copy;
• correct inaccurate information;
• delete your personal information;
• opt out of the sale or sharing of personal information, or of targeted advertising and certain profiling. We don't do any of these;
• limit the use of sensitive personal information, such as voice identifiers. We use it only to provide Plum, as the law permits; and
• not be discriminated against for exercising these rights.

To make a request, email privacy@helloplum.ai or call us at (415) 483-5175. We'll verify your identity, usually by confirming control of your email address, and respond within the time the law requires, typically 45 days. You can use an authorized agent, and we may ask for proof of their authority. If we deny your request, you can appeal by replying to our decision; if you're still unsatisfied, you can contact your state attorney general.

Global Privacy Control. We honor browser opt-out preference signals such as Global Privacy Control. Because we don't sell or share personal information, no further action is needed.

Information we collected in the past 12 months. For California residents, using the categories in California law:

Plum isn't available to the public yet, so today we only collect the website, waitlist, and pre-order information described above.

Using Plum through an organization

If you use Plum through an employer's or other organization's workspace, that organization controls the workspace. It decides how Plum is used, sets retention and consent policies, and may be able to access and delete content in the workspace. We process workspace content on the organization's behalf and according to its instructions and our agreement with it. Please direct privacy requests about workspace content to your organization; if you contact us, we'll refer you to it and help it respond.

Security

We use reasonable technical and organizational safeguards designed to protect personal information. These include encryption in transit and at rest, restricted access to production systems, and authentication for Plum devices. No system is perfectly secure. If a data breach affects your personal information, we'll notify you as the law requires.

Children

Plum is for adults 18 and older and isn't directed to children. We don't knowingly collect personal information from children under 13, or from anyone under 18 as an account holder. Plum may incidentally capture children's voices if they're present during a recording. A parent or guardian can ask us to delete that information by emailing privacy@helloplum.ai.

Where we process information

Plum is offered in the United States. We and our service providers process information in the United States and may process it in other countries where they operate, with safeguards required by law.

Changes to this policy

We'll post any changes here and update the effective date. For material changes, we'll notify you by email or in Plum before they take effect. We'll never expand how we use your content, including for AI training, without your affirmative consent, and any such change will apply only going forward.

Contact us

Questions or requests about privacy:

Hero Not Found, Inc. Attn: Privacy 2261 Market Street STE 36449 San Francisco, CA 94114

Email: privacy@helloplum.ai Phone: (415) 483-5175