Plum Privacy Policy

Effective Date: September 16, 2026
Last Updated: September 16, 2026

1. Scope, Responsible Entity, and Contact Information

This Privacy Policy explains how Within Tech Limited ("Within Tech," "we," "us," or "our") collects, uses, discloses, stores, and protects your personal information when you use Plum, as well as the rights that may be available to you. "Personal information" in this Policy also includes "personal data" as that term is defined under applicable law.

This Policy applies to the websites, mobile applications, product features, and related services that we operate and that expressly link to or reference this Policy, including the current plum.top website and the Plum product (collectively, the "Service"). It does not apply to third-party websites, applications, or services that maintain their own privacy policies.

Within Tech Limited is the controller or other legally responsible entity for the personal information processing described in this Policy.

Responsible Entity: Within Tech Limited
Registered Address: Unit B, 8/F, 235 Wing Lok Street Trade Centre, 235 Wing Lok Street, Sheung Wan, Hong Kong
Privacy and Data Rights Email: support@plum.top

When contacting us about privacy or data rights, we recommend using "Privacy Request" in the subject line and providing the information reasonably necessary to process your request. Do not send passwords, complete payment card information, or other unnecessary sensitive information by ordinary email.

2. Account, Identity, and Age Information

Depending on the features you use, we may collect:

your email address, username, display name, profile image, account identifiers, and account status;
security records associated with verification codes, session credentials, and other authentication information;
if you choose third-party sign-in, account identifiers, name, email address, or profile image provided by that provider within the scope of your authorization;
your declaration that you are at least 18 years old, together with the time it was completed, the applicable age-gate version, unusual attempts, and related support records; and
language, country or region, content preferences, and other account settings that you choose to provide.

We use your age eligibility declaration to determine whether you meet the Service's age requirement. If we later adopt other age-assurance measures because of applicable law, a particular region, or a specific risk, we will provide the disclosures required by law and obtain consent where required.

3. Characters, Chats, Images, and Memory

To provide Plum's core features, we may process characters you create or use, story settings, character relationships, tags, opening content, and character images; chats and prompts you submit, AI-generated responses, conversation history, and story progress; and memories, summaries, and preferences that you create, edit, or that the Service derives from your interactions.

Text, images, and chats you submit may contain personal or sensitive information that you choose to provide. Do not submit passwords, payment credentials, government identification documents, precise location information, third-party secrets, or other information that you do not want processed. If your content includes another person's personal information, likeness, or other protected material, you must have the necessary rights or authorization.

4. Crystals, Orders, and Payment Information

When you purchase, receive, or use Crystals, or complete another paid transaction, we may process:

the source, batch, balance, expiration, use, return, reward, and adjustment history of Crystals;
order number, purchased item, amount, currency, taxes, purchase time, payment status, refund, and chargeback records;
transaction identifiers, risk signals, and reconciliation information provided by payment service providers; and
materials relating to transaction disputes, fraud investigations, and support requests.

Payment credentials such as full card numbers and card security codes are handled by third-party payment service providers. Plum receives only the information needed to complete transactions, manage accounts, control risk, and provide customer support.

5. Support, Reports, Moderation, and Appeals

When you contact support or submit a complaint, report, appeal, rights request, or transaction dispute, we may process:

contact information, communications, screenshots, explanations, and other supporting materials you submit;
relevant account, character, content, conversation, order, or transaction information;
records relating to content moderation, reports, appeals, and actions taken by the platform;
activity records needed to investigate account security, abuse, infringement, fraud, or payment disputes; and
information reasonably necessary to confirm your relationship to the relevant account, together with records of how the request was handled.

We use this information only as necessary to address the matter, maintain the security of the Service, enforce platform rules, or comply with legal obligations, and we restrict access by personnel who do not need it.

When you access or use Plum, we may automatically collect:

IP address, browser, operating system, device type, language, and approximate region;
cookies, session identifiers, device or visitor identifiers, and sign-in security information;
page visits, searches, browsing, clicks, feature use, content impressions, and interaction records; and
request, error, crash, performance, abuse-prevention, and security logs.

We use necessary cookies and similar technologies to maintain sign-in status, protect session security, and provide core features. We may also use analytics technologies to understand use of the Service and feature performance. For non-essential cookies or similar technologies that require consent under applicable law, we will provide appropriate notice and choices.

7. Information From Third Parties or Other Users

When the relevant features are enabled, we may receive personal information from:

third-party sign-in providers that you choose to use;
app stores, mobile operating systems, and related providers involved when you download, purchase, or use a mobile application;
payment, anti-fraud, or order-processing providers;
inviters or invitees in referral programs, but only as needed for attribution and abuse prevention;
reporters, rights holders, or other users who submit complaints; and
security, fraud-prevention, or rights-verification sources permitted by law.

We process only information relevant to a specified purpose. If you choose to sign in to or connect Plum using a third-party account, we may receive information used to identify and connect your account within the scope of your authorization, such as a third-party account identifier, name, email address, or profile image. You may revoke authorization or disconnect the account through the third party's settings. Revocation generally stops future provision of information, but it does not automatically delete information that we previously collected lawfully; we process that information under the retention and deletion rules in this Policy.

8. Providing and Personalizing the Service

We may use the information described above to:

create, authenticate, protect, and maintain accounts;
provide character browsing, creation, publication, favorites, ratings, and sharing features;
generate AI responses based on your input and synchronize conversation history;
maintain story progress, interaction continuity, and memory;
translate or localize characters and related content;
display or recommend characters based on content, language, preferences, and use;
record and administer Crystals, orders, promotions, and reward rules; and
respond to support, troubleshooting, and data rights requests.

In regions where applicable law requires us to identify a legal basis, these activities may be based on performance of our contract with you, your consent, our legitimate interests, or compliance with legal obligations, depending on the purpose and applicable law.

9. Content Safety, Account Security, and Abuse Prevention

To protect users and the Service, we may process user content, chats, account, device, usage, and transaction information to:

enforce age requirements, the Terms of Service, and the Community Guidelines;
identify, investigate, and address content or conduct that may be unlawful, infringing, unsafe, or contrary to platform rules;
handle reports, complaints, appeals, security incidents, and related disputes;
prevent account compromise, fraud, mass registration, malicious automation, reward manipulation, refund abuse, and other platform abuse; and
preserve records necessary to comply with legal obligations or handle significant safety incidents.

These activities may involve automated systems and, where necessary, review by authorized personnel or service providers. Such persons may access relevant information only as necessary to perform safety, support, compliance, or legal responsibilities.

10. Analytics, Research, and Service Improvement

We may use device, usage, performance, and error information, and relevant content information to the extent necessary, to:

understand how the Service and its features are used;
evaluate recommendation, memory, AI generation, and safety performance;
diagnose problems, fix errors, improve stability, and develop new features; and
produce statistical analyses, business reports, and research findings.

Where reasonably practicable, we use aggregated or de-identified information and limit access to Private Chat content. The analytics and service-improvement activities described in this Section do not by themselves authorize Plum to use Private Chats to train general-purpose models; model training is addressed in the next Section.

11. Model Training and Service Improvement Choices

To provide AI features, we and relevant model service providers need to process your input, related context, and generated results to produce the response you request.

We may use interactions, feedback, and related technical information from the Service to develop, test, evaluate, and improve Plum's AI models, recommendation, memory, and safety systems. This may include data analysis, annotation, model evaluation, fine-tuning, or training. Where reasonably practicable, we use measures such as sampling, data minimization, access restrictions, aggregation, or de-identification.

When processing goes beyond what is necessary to provide the current Service, we will explain the purpose and legal basis as required by applicable law and provide consent, opt-out, or other choices where legally required. Withdrawing consent or opting out generally affects future processing only and does not affect processing lawfully completed before the withdrawal or opt-out.

How third-party model service providers retain or use relevant information is governed by our service configurations, our agreements with them, and the disclosures in this Policy.

12. Service Communications and Marketing

We may send necessary communications relating to account verification, security, purchases, Service changes, complaints, data rights, and policy updates. You may continue to receive these service communications even if you opt out of marketing.

Where permitted by applicable law or with any required consent, we may send product news, promotions, and marketing through email, mobile push notifications, or other channels. You may stop receiving them through the unsubscribe method in the communication, relevant Plum settings, or your mobile device settings.

Unless we explain otherwise and provide choices required by law, we do not directly use the content of your Private Chats or Private Memory for marketing targeting.

13. Service Providers and Other Processors

To operate and provide Plum, we may disclose information as necessary to the following categories of service providers or partners:

cloud computing, database, storage, content delivery, and network security providers;
AI model, inference, and content moderation providers;
identity authentication, email delivery, mobile push notification, and account security providers;
product analytics, error monitoring, and technical operations providers;
payment, app store, refund, anti-fraud, tax, and accounting providers; and
customer support, legal, audit, and other professional service providers.

Service providers that process information on Plum's behalf must process necessary information for agreed purposes, according to our instructions, and subject to applicable law. Some app stores, payment institutions, or other partners may independently process information under their own legal obligations and privacy policies.

14. Legal Requirements, Protection of Rights, and Corporate Transactions

We may disclose or transfer necessary information to:

comply with applicable law, court orders, regulatory requirements, or valid law-enforcement requests;
investigate and enforce the Terms of Service and Community Guidelines;
detect, prevent, or address fraud, account compromise, security incidents, or real-world harm;
protect the rights, property, and safety of Plum, users, third parties, or the public;
obtain services from lawyers, auditors, insurers, and other professional advisers; or
conduct a financing, restructuring, merger, acquisition, bankruptcy, or transfer of a business or assets.

We assess the validity and scope of requests in light of the circumstances and take reasonable steps to limit unnecessary disclosure. Where permitted by law, we may notify users affected by a request.

Characters, character images, names, descriptions, tags, opening content, comments, display names, and profile images that you choose to publish publicly will be displayed to other users or internet visitors and may be searched, recommended, favorited, rated, or shared.

To make content available to users in different languages, we may use automated technologies to translate or localize Public Characters and related content. Automatically generated translations may differ from the original and may be displayed together with, or separately from, the original content.

Private Characters, Private Memory, and Private Chats are not public by default. If you choose to make content public, participate in a shared feature, generate a public link, export it, capture a screenshot, or send it to another person, the content will be shared as you direct. Copies saved or redistributed by recipients may no longer be under our control.

Do not include your own or another person's non-public personal information in Public Content. We may limit display of content to protect safety, privacy, or legal rights.

16. Processing of Private Chats

Private Chats are not publicly displayed to other users. To provide relevant features, Private Chats and related context may be processed as necessary by Plum's systems, necessary service providers, or authorized personnel to:

generate AI responses;
create, retrieve, and update conversation memory;
protect content and account security and prevent abuse;
handle support requests, technical issues, reports, appeals, or safety incidents; and
comply with applicable legal obligations.

We use reasonable technical and administrative measures to limit access to Private Chats, but you should not submit passwords, payment credentials, or other unnecessary highly sensitive information in chats.

17. Cookies and Your Choices

We use cookies, local storage, and similar technologies to maintain sign-in status, protect account and session security, remember basic settings, and provide core features. Some of these technologies are necessary for the Service to function, and disabling them may affect certain features.

We may also use analytics technologies to understand product use and Service performance. For non-essential cookies or similar technologies that require consent under applicable law, we will provide appropriate notice and choices and allow you to withdraw or adjust your choices.

You may also manage relevant technologies through your browser, mobile device, or settings offered by Plum, but restricting necessary technologies may prevent the Service from functioning properly.

18. Data Retention

We retain personal information only for as long as necessary for the purposes described in this Policy, including providing the Service, maintaining security, complying with legal and financial obligations, resolving disputes, and enforcing agreements. The specific period depends on the nature and sensitivity of the information, the purpose of processing, relevant risks, and applicable legal, accounting, tax, and payment requirements.

When information is no longer needed, we delete, de-identify, or otherwise handle it appropriately. Certain information may be retained for longer where necessary for legal obligations, transaction records, fraud prevention, security investigations, dispute resolution, or protection of rights. Residual copies in backups will be handled through normal backup rotation cycles.

After you delete an account or Public Content, copies already saved or shared by other users may continue to exist. Public Content, translated versions, and related usage records are also subject to the content license and account termination provisions of the Terms of Service.

19. Access, Correction, and Account Deletion

You may use account features made available by Plum or contact support@plum.top to request access to, correction of, or deletion of your account and personal information. To protect account security, we may ask for information reasonably necessary to confirm your control of the relevant account.

Deleting an account is different from signing out. After account deletion, you may lose access to related characters, chats, memories, favorites, Crystal balances, and other account information. Certain transaction, security, report, dispute, legal, backup, and de-identified records may be retained under this Policy.

Public Content and translated versions that you publish may already have been saved or shared by other users. How that content is handled after account deletion is also subject to the Public Content license and account termination provisions of the Terms of Service.

20. Information Security

We use technical, administrative, and organizational measures appropriate to the nature of the information and relevant risks. These measures may include protections for data in transit, account and session security, access controls, logging, backups, and security incident response.

However, no method of network transmission, storage, or information system can guarantee absolute security. You should protect your account, sign-in methods, and devices and promptly contact us if you identify unusual activity.

If a personal information security incident requires notification by law, we will notify affected users and relevant authorities in accordance with applicable law.

21. International Data Transfers

Plum provides the Service globally. Your personal information may be processed outside your country or region by Within Tech and providers of cloud, AI model, content moderation, payment, analytics, and other services. Data protection laws in those locations may differ from those where you live.

Where required by applicable law, we take measures to protect information transferred across borders. These measures may include recognized contractual clauses, adequacy decisions, or other legally recognized transfer mechanisms and supplementary safeguards.

22. Your Data Protection Rights

Depending on where you live and applicable law, you may have the right to:

understand how we collect, use, and disclose personal information;
access, obtain a copy of, or correct your personal information;
request deletion, restriction of processing, or objection to certain processing;
obtain relevant information in a structured, commonly used, and machine-readable format;
withdraw consent without affecting the lawfulness of processing completed before withdrawal;
opt out of direct marketing and, where applicable, the sale or sharing of personal information, targeted advertising, or certain profiling that produces significant effects;
appeal our response or complain to a competent data protection authority; and
submit a request through a legally authorized agent and be free from discrimination for exercising privacy rights to the extent provided by applicable law.

You may submit a request through support@plum.top. To protect your information, we may verify your identity, control of the account, or an agent's authority. We will handle requests within the period required by applicable law. Where permitted by law, we may deny requests that are manifestly unfounded or excessive, would harm the rights of others, or would interfere with legal obligations, and we will explain the relevant reason.

23. Information for Users in the EEA and United Kingdom

If European Economic Area or United Kingdom data protection law applies to our processing of your personal information, we may rely on the following legal bases:

Performance of a Contract: creating and maintaining accounts, generating AI responses, storing conversations, providing memory, and completing purchases;
Legitimate Interests: maintaining Service security, preventing fraud, providing support, analyzing and improving the Service, and protecting legal rights, provided those interests are not overridden by your rights and freedoms;
Consent: using non-essential cookies, sending certain marketing communications, and carrying out other activities for which applicable law requires consent;
Legal Obligations: complying with tax, accounting, regulatory, court, and other legal requirements; and
Vital Interests: only where permitted by law and necessary to protect a person's life or safety.

You may lodge a complaint with the competent data protection authority where you habitually reside or work or where an alleged infringement occurred.

24. Information for California and Other U.S. States

If California or another U.S. state privacy law applies to Plum, relevant users may have rights to know, access, correct, delete, and obtain a copy of personal information and to opt out of the sale or sharing of personal information, targeted advertising, or certain profiling that produces significant effects. Where applicable, users may also have the right to limit certain uses of sensitive personal information, submit a request through an authorized agent, appeal a decision, and be free from discrimination for exercising privacy rights.

Plum does not currently sell personal information or share personal information for cross-context behavioral advertising. If our processing practices change, we will provide legally required notice and opt-out methods and, where required by applicable law, recognize and process valid opt-out preference signals such as Global Privacy Control.

25. Privacy of Minors

Plum is intended only for users who are at least 18 years old. We do not knowingly offer the Service to or collect personal information from anyone under 18.

If we learn that a person under 18 has used Plum or provided personal information to us, we may restrict or close the relevant account and delete the information in accordance with applicable law. We may retain the minimum records permitted by law where necessary to prevent repeated registration, maintain security, handle disputes, or comply with legal obligations.

If you are a parent or guardian and believe a minor has provided personal information to Plum, contact support@plum.top and provide enough information to locate the relevant account or content.

26. Automated Systems and Review

We may use automated systems to help identify content that violates platform rules, fraud, account security risks, and other abuse. These systems may block generation, refuse publication, limit content display, or refer a matter for further review.

If you wish to challenge an action taken against content or an account, you may contact support@plum.top. We will handle the matter in accordance with applicable law and the relevant appeal process, but submitting a challenge does not guarantee that the original decision will be withdrawn or changed.

Where applicable law grants you the relevant right, you may challenge a decision based solely on automated processing that produces legal or similarly significant effects and request human review.

27. Changes to This Policy

We may update this Privacy Policy because of changes to product features, service providers, data processing practices, or applicable law. When we update the Policy, we will revise the "Last Updated" date at the top.

For changes that may materially affect your rights or how your personal information is processed, we will provide additional notice through Plum, by email, or through another reasonable method. If applicable law requires new consent, we will obtain your consent before the relevant processing begins; continued use of Plum does not replace consent that is expressly required by law.

Contact Us

If you have questions about this Policy, personal information, or a data rights request, contact us using the details below:

Responsible Entity: Within Tech Limited
Product: Plum
Email: support@plum.top
Registered Address: Unit B, 8/F, 235 Wing Lok Street Trade Centre, 235 Wing Lok Street, Sheung Wan, Hong Kong