PlutoSign in

Privacy Policy

Effective Date: November 8, 2026

Service: Pluto, a product operated by Formed Skin LLC, a Washington limited liability company

Privacy contact: hello@madewithpluto.com

1. Who We Are, and What This Policy Covers

Pluto is a product of Formed Skin LLC, a Washington limited liability company ("Formed Skin," "we," "us," or "our"). This Privacy Policy explains how we collect, use, share, keep, and protect information in connection with the Pluto website and software service (together, the "Service").

"Pluto" is the software. Formed Skin LLC is the company behind it, and the legal person responsible under this Policy.

It covers two different relationships, and the difference decides who you should contact:

  • Account Data — information about you as a person who signs up for or uses the Service, or who contacts us: your name, email address, avatar, sign-in method, billing contact details, and login and usage activity. Formed Skin LLC is the controller of Account Data, and this Policy describes our own practices.
  • Customer Data — the operational information a business enters into its Workspace: materials, formulas, suppliers, costs, batches, orders, quotes, documents, and, where applicable, personal information about that business's own customers and contacts. For personal information within Customer Data, Formed Skin LLC acts only as a processor (or "service provider") on the Workspace's instructions, under our Data Processing Agreement. If you are a customer of a business that uses Pluto and you have a question about the information it holds about you, please contact that business directly.

2. What We Collect

2.1 Account and Workspace Administration Information

What: your name, email address, avatar image, the sign-in method on your account, workspace names, workspace membership and roles, and any invitation that brought you in. Source: you, and the person who invited you. Purpose: to create and secure your account, to place you in the right workspace, and to contact you about the Service. Shared with: our hosting, database and backup providers, and our email provider when we send you an invitation (Section 4). Retained: while your account exists — see Section 6.

2.2 Customer Data Entered Into a Workspace

What: materials, suppliers, formulas and formula versions, products, manufacturing batches and their records, inventory, locations, costs, purchase orders, quotes, expenses, tasks, notes, and standard operating procedures. Source: you and your workspace members, and any integration you connect. Purpose: to provide the Service to that workspace. Shared with: our hosting, database and backup providers; an AI provider when a workspace member uses an AI Feature on it; our email provider when a workspace member emails a quote. Retained: while the workspace exists — see Section 6.

2.3 Your Own Customers' Contact and Order Information

What: names, email addresses, phone numbers, company and business addresses, order history and order values, quotes, and anything else a workspace member records in a free-text field about a contact. Source: entered by workspace members, or synced from a connected sales channel. Purpose: to provide the Service to that workspace. We are a processor for this category. Shared with: the same providers as Section 2.2. Retained: while the workspace exists, or until the workspace deletes the record.

2.4 Uploaded Documents and Images

What: files a workspace member uploads — certificates of analysis, invoices, formula sheets, product and batch photographs, logos, screenshots attached to a support request. Source: you. Purpose: to store them against the record you attached them to, and — when you ask for it — to read them with an AI Feature. Shared with: our storage and backup providers; an AI provider when you use a reading or transcription feature on the file. Retained: until deleted — see Section 6.

2.5 AI Prompts, Attachments, Context and Output

What: the question you ask, the records you attach to it, the workspace data the Service retrieves to answer it, and the model's response. We also record, per request, the workspace, the person who made it, the feature, the model, and the token counts. Source: you, and your workspace's own records. Purpose: to produce the answer, to keep your conversation history, to detect abuse, and to understand what the Service costs to run. Shared with: the AI provider serving the request (Section 4.2). Retained: a conversation stays in your workspace until you delete it, and goes when the workspace goes; the per-request usage counts are kept as operating records.

2.6 Integration Data

What: whatever the service you connect returns under the permissions you grant — for example orders, products and customers from a sales channel; calendar events; advertising performance figures, public comments on advertisements, and aggregate audience distributions; email campaign names and send dates; product reviews including the reviewer's name and email address where the review platform supplies them. Source: the third-party service, at your direction. Purpose: to display and use that information within your workspace. Shared with: our hosting, database and backup providers. Retained: while the workspace exists, or until you disconnect the integration and ask us to remove what it brought in.

2.6.1 Google User Data

If you sign in with Google or connect Google Calendar, Pluto receives the following from Google, and only after you grant it on Google's consent screen:

  • Google sign-in: your email address and whether Google has verified it. We use it to create and secure your account.
  • Google Calendar (the calendar.events permission, on your primary calendar only): we read events so they can appear on your workspace's calendar alongside your production schedule, we create, update and delete the events Pluto itself puts there — production runs, purchase orders and events you create in Pluto — so your Google Calendar stays current; we update or delete a Google Calendar event you organize only when you edit or delete it in Pluto; and we receive Google's change notifications so edits reach Pluto promptly.

We use Google user data only to provide and improve these user-facing features. We do not sell it, use it for advertising, or use it to build user profiles, and we do not use it to train generalized artificial-intelligence or machine-learning models. We transfer it only to the providers in Section 4 that we need to run the features you use (our hosting, database and backup providers), as required by law, or as part of a merger or acquisition with notice to you. People at Formed Skin LLC do not read it unless you ask us to (for example in a support request), it is necessary for security or to investigate abuse, or the law requires it.

You can disconnect Google Calendar at any time in Settings › Integrations, and revoke Pluto's access in your Google Account at myaccount.google.com/permissions. Events already copied into your workspace stay until you delete them or ask us to remove them.

Pluto's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2.7 Technical, Security and Server-Log Information

What: IP address, browser and device information, requested URLs, timestamps and response status, collected by our hosting provider as ordinary server logs; and error reports from our error-monitoring provider, which record the page, the browser, and the fault. Source: collected automatically. Purpose: to operate and secure the Service, to detect and diagnose faults, and to detect abuse. Shared with: our hosting provider and our error-monitoring provider. Our error monitoring is configured not to send request bodies, cookies, signed-in user identities, IP addresses, or session recordings. Retained: by those providers on their own schedules — see Section 6.

2.8 Support, Feedback and Suggestions

What: messages you send us, support requests, bug reports, feature requests, ingredient suggestions, and anything you attach to them. Source: you. Purpose: to answer you and to improve the Service. Shared with: our email provider, which delivers support requests and ingredient suggestions to us. Note: feature requests and ingredient suggestions are posted to a shared board that every workspace can see and vote on. Do not put confidential information in one. Bug reports are not shared — they are visible only to their author and to us, because that is where people paste their own data. Retained: as operating records.

2.9 Cookies, Authentication and Browser Storage

Covered in Section 10.

2.10 Billing Information

What: the billing contact's name and email address, the plan and its payment history, and payment card details. Card details are entered on Stripe's own pages and go directly to Stripe; we never receive or store card numbers. We keep only the reference Stripe gives the workspace's customer record. Source: you, when you subscribe or manage your subscription. Purpose: to bill for the Service and let you manage your plan, payment method and invoices. Shared with: Stripe, our payment processor (Section 4.1). Retained: while the workspace exists, and longer where tax or accounting law requires it — see Section 6.

2.11 Beta-Access Requests From Our Website

What: the name, email address, business name, description of what you make, and website you enter in the request form on our website, plus a one-way scrambled (hashed) form of your IP address. We do not store the IP address itself. Source: you. Purpose: to reply to your request, and to limit repeated or automated submissions. Shared with: our database provider, and our email provider, which delivers the request to us. Retained: as business records, until you ask us to delete them.

3. How We Use Information

  • To provide, operate, and maintain the Service, including workspace isolation, formula versioning, inventory calculation, and reporting.
  • To create accounts, authenticate sign-in, and send invitations.
  • To send the emails you ask the Service to send, such as a quote to your customer.
  • To bill for paid plans, and to send receipts and notices about your subscription.
  • To provide AI Features, by sending the relevant content to the AI provider serving the request and returning its output to you.
  • To respond to support and beta-access requests, and to act on bug reports and feature requests.
  • To monitor, secure, and troubleshoot the Service, including detecting abuse and unauthorized access, and to measure how much AI usage a workspace generates so we understand what the Service costs to run.
  • To back up the Service so it can be restored after a fault.
  • To comply with legal obligations.

We do not sell Account Data or Customer Data. We do not use one workspace's Customer Data to populate, train, or improve another workspace's account, and we do not use Customer Data to train AI models. We do not use Customer Data for Formed, the skincare business Formed Skin LLC also operates — see Section 5.3 of the Terms of Service, which states that boundary as a contractual commitment rather than a policy statement.

We do not currently send marketing email. We email you about your account, your subscription, and changes to the Service or these documents. If we introduce announcement or marketing email, it will carry an unsubscribe link.

4. Who Receives Information

4.1 Infrastructure and Operations

These providers process information on our instructions in order to run the Service. The same list, with what each receives, is in our Data Processing Agreement.

  • Supabase — managed PostgreSQL database, file storage for uploaded documents and images, and authentication. Holds Account Data and Customer Data.
  • Vercel — application hosting, serverless execution, and content delivery. Application code runs in Vercel's US East region. Generates server logs.
  • Cloudflare — R2 storage for our nightly backups. Holds a copy of the database and of uploaded files.
  • Resend — email delivery. Delivers workspace invitations, quotes a workspace member emails to a customer (including the quote PDF), support requests, ingredient suggestions, and beta-access requests.
  • Sentry — error monitoring, active on deployments where it is configured. Receives technical fault information. It is configured to exclude request bodies, cookies, user identities, IP addresses and session recordings; URLs it records may contain workspace identifiers.
  • Stripe — payment processing and subscription billing. Receives the billing contact's name, email address and payment card details, which go directly to Stripe; we do not store card numbers.
  • Google Maps Platform — address search, where it is enabled. Receives the address text you type into an address search box, so it can suggest matches.
  • Google — where you sign in with a Google account, Google acts as your identity provider. We receive your email address and whether Google has verified it. We do not receive your Google password.

4.2 AI Model Providers

  • Anthropic (Claude) — processes content submitted to AI Features, including the reading and transcription of uploaded documents and images.
  • OpenAI — processes content submitted to the text-based assistant, where a workspace has selected OpenAI as its provider.

AI Features are part of the Service, and using one sends the relevant content to a model provider. They are available to workspaces whose plan includes them. They run on model access Formed Skin LLC contracts for, so nothing is required from you to enable them; a workspace may instead supply its own API key and choose which provider to use. Either way, content leaves our systems for the provider serving the request only when you use a feature that needs it — we do not send your records to a model provider in the background. Each provider handles what it receives under its own commercial or API terms, together with our configuration with that provider. We name the providers here so you can read those terms.

4.3 Integrations You Choose to Connect

If you connect Shopify, Google Calendar, Meta or Instagram, Klaviyo, or Judge.me, information flows to and from that service according to the permissions you grant. Those are the integrations that exist today; anything the application shows as planned is not built and connects to nothing. These services act for you, not for us, and each provider's own privacy practices govern its handling of the data.

4.4 Legal and Business Transfers

We may disclose information where required by law, subpoena, or legal process; to protect the rights, property, or safety of Formed Skin LLC, our users, or others; or in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality protections. If your information is transferred to a new owner, we will tell you before it becomes subject to a different privacy policy.

4.5 What We Ask of Them

Our infrastructure and AI providers are engaged under their standard terms, which include confidentiality and data-protection commitments. We have not separately negotiated bespoke data-protection agreements with each of them.

5. Security

Our security practices, limited to what is actually in place:

  • Encrypted transmission (TLS) between your browser and the Service.
  • Credentials you store for third-party integrations, and the API keys you store for AI providers, are encrypted with AES-256-GCM before they are written to the database, using a key held in the application environment and never in the database itself. This is an additional layer over the encryption at rest described below, applied specifically to the secrets you connect.
  • Encryption at rest (AES-256) for all data stored in the Service's database and file storage.
  • Workspace isolation enforced in the database by PostgreSQL row-level-security policies rather than by application code alone, and exercised by an automated isolation test suite that runs in continuous integration on every proposed change and on every change to the main branch.
  • Nightly backups to a storage provider separate from our database host.
  • Internal access limited to the people who need it to build, operate, or support the Service.

We do not maintain physical infrastructure of our own, and we do not currently hold an independent security certification.

No method of transmission or storage is completely secure. If we become aware of a security incident affecting your information, we will notify you as required by applicable law and, for Customer Data, on the timeline in our Data Processing Agreement.

6. Data Retention

We keep information only as long as we need it for the purposes in this Policy, or as the law requires.

Information How long we keep it
Account Data While your account exists. A workspace owner can close their account from the workspace's billing settings; 30 days later every workspace they own is deleted, along with their profile, workspace memberships and login, unless they undo it first. To close a login that owns no workspace, email hello@madewithpluto.com.
Customer Data While the workspace exists. A workspace owner can delete a workspace from its settings; 24 hours later its records and uploaded files are deleted from our live systems, unless the owner undoes it first. Closing the account deletes them 30 days later, as above.
Uploaded documents and images Until deleted from the workspace, or deleted with it as above.
AI conversations Until deleted from the workspace, or when the workspace is deleted. Per-request usage counts are kept as operating records.
After a subscription ends Available for export for 30 days, as described in Section 13 of the Terms of Service. After that we may delete it from our live systems, and you can ask us to do so at any time.
Billing records Stripe keeps payment and invoice records under its own legal obligations. We keep the workspace's Stripe customer reference while the workspace exists, and invoice records as long as tax law requires.
Support requests, bug reports, feature requests, suggestions Kept as operating records.
Beta-access requests Kept as business records until you ask us to delete them.
Server logs and error reports Held by our hosting and error-monitoring providers for their standard periods, after which they are deleted.
Backups Nightly backups of the database and uploaded files are kept for 30 days. A file that no longer appears in any kept backup is removed by a weekly cleanup, so deleted data has normally left these backups within five weeks. Our database provider also keeps its own short-term backups on its standard schedule.

We may keep limited information longer where the law requires it, or to resolve a dispute, enforce our agreements, or investigate a security incident. Deleted data can remain in backups until those backups expire as shown above; while it is there, it is protected the same way and is not used for anything except restoring the Service.

7. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, export, or delete personal information, and to object to or restrict certain processing.

Send any request to hello@madewithpluto.com. There is no self-service privacy control in the application, with these exceptions, which you can use yourself today:

  • You can correct your own name and avatar in your account settings.
  • You can export your workspace's records as CSV files from within the application.
  • A workspace owner can download everything in a workspace, and close it, from its settings.

A few things worth knowing before you write to us:

  • We may need to verify your identity, or your authority to act for a business, before we can act on a request.
  • If your request concerns information a Pluto customer controls — for example, your order record in a maker's workspace — it should generally go to that business, which decides what happens to it. We will help that business as our Data Processing Agreement requires.
  • Rights differ by jurisdiction and are subject to exceptions. Describing a right here does not mean every privacy law applies to Formed Skin LLC, or that a given right is available to you.

We will respond within the timeframe applicable law requires.

8. California and Other U.S. State Residents

If the California Consumer Privacy Act, as amended, or a similar U.S. state privacy law applies to a given interaction, the following describes our practices. This description does not concede that Formed Skin LLC meets any statute's applicability thresholds.

  • Categories collected: identifiers (name, email address, IP address); commercial information (billing records, and order and purchase records within a workspace); internet or network activity (server logs, error reports); and the contents of documents and messages you provide. Sections 2.1 to 2.11 describe each in detail.
  • Sources: you; your workspace members; the person who invited you; third-party services you connect; and automatic collection by our hosting and error-monitoring providers.
  • Business purposes: providing and securing the Service, authentication, billing, support, fault diagnosis, backup, abuse prevention, enforcing usage limits, and legal compliance.
  • Categories of recipients: the infrastructure, backup, email, payment, error-monitoring, identity, address-search and AI providers listed in Section 4, and the integrations you choose to connect.
  • Sale or sharing: we do not sell personal information, and we do not share it for cross-context behavioral advertising. We run no advertising technology and no third-party analytics on the Service — see Section 10. Because there is no sale or sharing to opt out of, a browser's Do Not Track or Global Privacy Control signal does not change anything we do.
  • Sensitive personal information: we do not ask for it, our Terms of Service prohibit uploading it about identifiable individuals, and we do not use it to infer characteristics.
  • Submitting a request, and appealing: email hello@madewithpluto.com. If we decline a request, you may appeal by replying to our response and asking for the decision to be reviewed.
  • Non-discrimination: we will not deny you the Service, or provide a different level of service, because you exercised a privacy right.

9. Where Your Information Is, and Who the Service Is For

The Service is offered to businesses in the United States, and is hosted and operated from the United States. It is not currently marketed to, or offered to, businesses or individuals in the European Economic Area, the United Kingdom, or Switzerland. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

Our application code runs in our hosting provider's US East region, and our database and file storage are provided by a US-based managed host.

This Policy does not describe rights or transfer mechanisms under the laws of the European Economic Area, the United Kingdom or Switzerland. It will be updated before the Service is offered there.

10. Cookies and Browser Storage

We use strictly necessary cookies only — the authentication cookies that keep you signed in, and two cookies that record which workspace you are working in. We do not use advertising cookies, cross-site tracking pixels, or third-party product-analytics cookies.

The application also stores display preferences in your browser's local storage — your light or dark theme, sidebar width, saved table layouts, pinned pages, recent searches, and which notifications you have already seen. That data stays on your device and is not sent to us as an identifier.

11. Children

The Service is intended for business use by people aged 18 or older, which matches the eligibility requirement in Section 3 of our Terms of Service. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, contact hello@madewithpluto.com and we will delete it.

12. Changes to This Policy

We may update this Policy. Ordinary clarifications — better wording, corrections, a reorganized section — take effect when published, and the Effective Date above is updated. For material changes, including a change in the categories of information we collect, the purposes we use it for, or the categories of recipients, we will email account holders or show a notice in the application before the change takes effect.

13. Contact Us

Questions or requests about this Policy may be sent to hello@madewithpluto.com, which is the address for all privacy correspondence.

Formed Skin LLC is a Washington limited liability company whose registered office is 522 W Riverside Ave, Ste N, Spokane, WA 99201, United States. That address identifies the entity; it is not an operating or correspondence address, and a request sent there will take longer to reach us than email.