Plexe procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Plexe AI is headquartered in the United Kingdom, but we may process personal data in other countries where we or our service providers operate. This may include jurisdictions outside your country of residence.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ For transfers from the UK or EEA, we rely on safeguards such as Standard Contractual Clauses (SCCs) or transfers to countries recognised as providing adequate protection For transfers from India (once the Digital Personal Data Protection Act, 2023 is enforced), we will comply with applicable cross-border transfer rules We require our third-party processors to implement contractual and technical safeguards to ensure an adequate level of protection for your personal data.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Whenever we transfer personal data internationally, we do so in compliance with applicable data protection laws. For example:” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Our Data Processing Agreement (DPA) governs this processing relationship.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You may request deletion of your personal data at any time, subject to our legal obligations and legitimate interests. After the 90-day period, personal data will be securely deleted unless required for regulatory or fraud prevention purposes.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Providing and maintaining the Services Meeting legal, accounting, and regulatory requirements Resolving disputes or enforcing agreements Upon closure of your account, we will retain personal data for up to 90 days to allow for retrieval or export, unless deletion is requested sooner and no legal obligation requires continued retention.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We retain personal data only for as long as required by law, or necessary to fulfil the purposes for which it was collected, including:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Subprocessors (e.g., AWS, Stripe), under strict data protection terms Affiliates or corporate acquirers, in connection with mergers or acquisitions Authorities, where required by law or court order Other third parties, but only with your explicit consent See our DPA for a list of subprocessors and data handling terms.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We do not sell your personal data. We may share it with:” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.