Plenu Subscriber Privacy Policy
Introduction
HomeFill LLC, a Tennessee limited liability company doing business as Plenu ("Plenu," "we," "us," or "our"), is committed to protecting the privacy of our subscribers. This Subscriber Privacy Policy ("Policy") explains how we collect, use, disclose, and protect your personal information when you create an account and subscribe to our household supply service.
This Policy applies to you once you become a subscriber. If you are a website visitor who has not yet subscribed, please review our Landing Page Privacy Notice at plenu.online/privacy.
Contact information:
| Purpose | Contact |
|---|---|
| Privacy questions and rights requests | privacy@plenu.online |
| Legal notices | legal@plenu.online |
| General support | support@plenu.online |
| Mailing address | HomeFill LLC dba Plenu, 2141 Century Farms Pkwy, Ste 1013-113, Nashville, TN 37013 |
1. About Plenu and Our Data Architecture
Plenu is a household supply subscription service (NAICS 455219). We use technology — including AI-assisted personalization — to curate and ship household supply boxes tailored to your household's needs.
Our privacy-by-design architecture: When you subscribe, Plenu assigns your account a pseudonymous identifier (a UUID — a random string of characters). Our AI systems and internal analytics operate using this UUID only. Your name, email address, and payment information are stored exclusively in specialized, access-controlled systems (Stripe for billing, Klaviyo for communications, and your secure account portal). Our AI personalization layer never has access to your name or payment information — it works only with your preferences, consumption signals, and delivery history, linked by UUID.
This architecture means that even if our AI operational data were accessed without authorization, it would not expose your identity or payment details.
2. Information We Collect
2.1 Account Information
When you create a subscriber account, we collect your name, email address, delivery address, and optionally your phone number.
2.2 Billing Information
Payment is processed by Stripe, our payment processor. Plenu stores only the last four digits of your card, your billing ZIP code, and your card type for display purposes in your account. We do not store your full card number, CVV, or complete billing details — Stripe handles and secures all payment data.
2.3 Subscription Information
Your subscription tier (Solo, Plus, Family, or XL), subscription start date, billing cycle, and subscription status.
2.4 Box Composition Preferences
To personalize your household supply boxes, we collect: - Household size (number of adults and children — counts only, no names or dates of birth) - Product category preferences - Brand preferences, or your preference to receive brand-agnostic selections - Consumption level signals (Heavy, Typical, or Light) for product categories
2.5 College Subscriber Verification
If you subscribe at the college rate, we collect annual confirmation that your student status is current. Verification method details will be provided at the time of verification.
2.6 Delivery Preferences
Your delivery address and any special delivery instructions you provide.
2.7 Communication Preferences
Your email opt-in status for marketing communications and, if provided separately, your consent status for SMS notifications.
2.8 AI Interaction Logs
When you interact with Plenu's AI-assisted features (such as preference updates or recommendation reviews), we retain anonymized, per-session summaries linked to your UUID only — not to your name or contact information. See Section 6 for details on how long we keep these.
2.9 Device and Usage Data
For account security and service operation, we collect your browser type, device type, IP address, and (if applicable) app version.
2.10 Survey Responses
At intervals after subscription (approximately 15, 30, 60, 90, and 180 days), we may invite you to participate in optional subscriber surveys. Participation is voluntary.
3. How We Use Your Information
We use your personal information for the following purposes:
To fulfill your subscription: We use your preferences, household data, and delivery address to pack and ship your household supply boxes.
To personalize your experience: We use your consumption signals and preferences to refine box composition over time through our AI-assisted personalization system.
To process billing: We work with Stripe to process your subscription payments and send receipts.
To communicate with you: We send transactional messages — subscription confirmations, shipment notifications, delivery updates, and renewal reminders — as part of delivering your subscription. These messages are part of the service and are not optional while you are a subscriber.
To send marketing communications: With your consent, we may send promotional emails about new products, features, or offers. You may unsubscribe at any time using the link in any marketing email.
To send SMS notifications: With your separate, explicit consent per the Telephone Consumer Protection Act (TCPA), we may send SMS messages. Standard message and data rates may apply. Reply STOP at any time to opt out.
To improve our service: We use aggregated, de-identified analytics to understand how our service is used, improve box composition, and enhance the subscriber experience.
For fraud prevention and security: We use account and device data to detect unauthorized access and protect your account.
For legal compliance: We retain and use information as required by applicable law, including tax and financial record requirements.
4. AI and Automated Processing
Plenu uses artificial intelligence to assist with household supply recommendations and box personalization.
AI transparency (required under Tennessee SB 1580, effective July 1, 2026, and EU AI Act Article 52, effective August 2, 2026):
- Our AI will always identify itself as AI at the start of any interaction. You will never be misled into thinking you are speaking with a human.
- Our AI is not a therapist, counselor, or mental health professional and does not provide mental health services or advice. If any message you send contains indicators of a mental health crisis, our system will direct you to the 988 Suicide and Crisis Lifeline (call or text 988).
- Our AI does not make binding decisions about your subscription without human oversight. All AI-generated box recommendations may be reviewed and adjusted by you.
- You may request human review of any AI-generated recommendation at any time by contacting support@plenu.online.
- Under the EU AI Act, Plenu's AI features are classified as Limited Risk AI systems under Article 52. Disclosure that you are interacting with an AI occurs at the start of every AI-assisted interaction.
5. How We Share Your Information
We do not sell your personal information. We do not share your personal information with advertising networks or data brokers.
We share information only with the following categories of service providers, for the specific purposes described:
| Service Provider | Purpose | Data Shared |
|---|---|---|
| Stripe | Payment processing | Billing information (managed by Stripe) |
| Klaviyo | Email and SMS communications | Email address, name, communication preferences, subscription status |
| IONOS | Website hosting | Standard web traffic data |
| PostHog | Product analytics | Anonymized, UUID-based usage data |
| Sentry | Error monitoring | Anonymized error and performance data |
| Hostinger | Database infrastructure | Operational subscription data (UUID-based) |
| AWS | Cloud infrastructure backup | Encrypted operational data |
All service providers are contractually required to use your information only for the purposes for which we share it and to protect it with appropriate security measures.
6. Data Retention
We retain your information for the following periods:
| Data Type | Retention Period |
|---|---|
| Account data (name, email, address) | While subscribed + 7 years after cancellation |
| Billing records | 7 years (tax and legal compliance) |
| Subscription tier | 180-day active confidence window; history retained 7 years |
| Box composition preferences | 30-day active decay window; historical record retained 7 years |
| Weekly consumption signals | 14-day active window; anonymized aggregate retained |
| AI interaction logs | 90 days rolling, then anonymized aggregate only |
| Survey responses | 7 years (anonymized after 2 years) |
Upon account deletion or cancellation with deletion request:
- Plenu will perform crypto-shredding of your operational data within 30 days — your UUID-linked data encryption key is permanently deleted, rendering that data permanently inaccessible.
- Your PII will be deleted from Stripe and Klaviyo within 30 days.
- A non-identifying audit record (a tombstone entry) is preserved in our append-only audit chain; this record contains no personal information and cannot be linked back to you.
7. Your Privacy Rights
Depending on your state of residence, you may have the following rights regarding your personal information. We honor these rights for subscribers in the following states: California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.
Right to know / access: You may request a copy of the personal information we hold about you and information about how we use it.
Right to correct: You may request that we correct inaccurate personal information.
Right to delete: You may request deletion of your personal information, subject to exceptions required by law (such as retention of billing records for tax compliance).
Right to data portability: You may request your personal information in a portable, machine-readable format.
Right to opt out of sale or sharing: We do not sell or share personal information for cross-context behavioral advertising. If you submit an opt-out request, we will confirm there is nothing to opt out of for sale or sharing.
Right to non-discrimination: We will not deny you service, charge different prices, or provide a lower quality of service because you exercised a privacy right.
Right to appeal: If we decline to act on a request, you may appeal our decision by contacting privacy@plenu.online. We will respond to appeals within 60 days.
7.1 California-Specific Rights (CCPA/CPRA)
California residents have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:
Right to know categories: The categories of personal information we collect are: identifiers, commercial information, internet or other electronic network activity information, geolocation data (delivery address only), and inferences drawn from the above to create a preference profile.
Right to limit use of sensitive personal information: We collect household demographic signals (counts of adults and children) and consumption-level preferences. These are not "sensitive personal information" as defined under the CPRA, but we limit their use to service fulfillment and personalization purposes only.
Global Privacy Control (GPC): We respect GPC signals as opt-out signals from sale and sharing of personal information. Because we do not sell or share personal information, receipt of a GPC signal will be acknowledged and recorded.
Shine the Light (Cal. Civ. Code § 1798.83): California residents may request information about personal information disclosed to third parties for their own direct marketing purposes in the preceding calendar year. We do not disclose personal information to third parties for their direct marketing purposes.
7.2 Tennessee (TIPA)
Under the Tennessee Information Protection Act (effective July 1, 2025), Tennessee residents have the rights described in Section 7 above. HomeFill LLC dba Plenu is the controller of your personal information for purposes of TIPA. The purpose of processing is household supply subscription service delivery and personalization.
8. How to Submit a Privacy Rights Request (DSAR)
To submit a Data Subject Access Request or exercise any privacy right:
- Email privacy@plenu.online with the subject line: Privacy Rights Request
- Include your name, the email address associated with your account, and a description of your request.
- We will respond within 30 days. If we need additional time (up to 45 additional days), we will notify you within the initial 30-day period and explain why.
Authorized agents: You may designate an authorized agent to submit a request on your behalf. We will require written permission signed by you confirming the agent's authorization, and we may verify your identity directly.
We will verify your identity before processing any request to protect your account from unauthorized access.
9. Security
We implement technical and organizational measures to protect your personal information:
- Encryption in transit: HTTPS/TLS 1.3 for all data transmitted between your device and our systems.
- Encryption at rest: AES-256-GCM encryption for operational data stored in our database infrastructure.
- Key management: Environment-based key management with planned migration to AWS KMS.
- Access controls: Least-privilege, role-based access controls limiting employee access to personal information.
- Payment security: Plenu does not store payment card data — Stripe, a PCI-DSS Level 1 certified processor, handles all payment information.
- AI data isolation: Our AI systems operate on UUID-only data and cannot access your name, email, or payment information.
Data breach notification: In the event of a security breach affecting your personal information, we will notify you in accordance with Tennessee Code § 47-18-2107, within 45 days of discovery, or sooner as required by applicable law.
No security system is impenetrable. If you believe your account has been compromised, contact support@plenu.online immediately.
10. Children and Minors
Plenu's subscription service is intended for adults 18 years of age and older. College subscribers must also be 18 or older. We do not knowingly collect personal information from minors under 18. If we become aware that we have collected personal information from a minor, we will delete it promptly. If you believe a minor has created an account, please contact privacy@plenu.online.
11. International Subscribers
Plenu's service is based in the United States and is primarily intended for US residents. If you access our service from outside the United States:
- EU/EEA residents: For email and SMS communications managed through Klaviyo, transfers of personal data from the EU/EEA to the US are covered by Data Privacy Framework (DPF) protections and Standard Contractual Clauses (SCCs). HomeFill LLC dba Plenu acts as a data controller for your personal information. Your EU AI Act rights, including disclosure that you are interacting with an AI (Article 52), are honored as described in Section 4.
- DPO contact: For EU data protection inquiries, contact privacy@plenu.online.
12. Changes to This Policy
We may update this Policy from time to time. If we make material changes, we will notify you by email (to the address associated with your account) and by posting the updated Policy at plenu.online/subscriber-privacy at least 30 days before the changes take effect. Your continued subscription after the effective date constitutes acceptance of the updated Policy.
The version history block at the top of this document will always reflect the current effective date and version number.
13. Contact Us
For any privacy-related questions, concerns, or to exercise your rights:
HomeFill LLC dba Plenu, 2141 Century Farms Pkwy, Ste 1013-113, Nashville, TN 37013
- Privacy: privacy@plenu.online
- Legal: legal@plenu.online
- Support: support@plenu.online