Privacy Policy
How CustodyZero collects, uses, and protects your personal information. Includes GDPR and CCPA disclosures.
Last updated: May 30, 2026
This Privacy Policy explains how Plainsight Systems LLC (“CustodyZero”, “we”, “us”, or “our”) collects, uses, and shares information when you use custodyzero.com and any associated applications or services (collectively, the “Services”).
Read this policy before submitting any personal information to us. If you disagree with our practices, do not use the Services.
1. Who we are
CustodyZero builds local-first technology. We operate the product house at custodyzero.com, including the Factory change-control system and the Type writing instrument.
Contact: privacy@custodyzero.com
If you are in the European Economic Area (EEA) or UK, Plainsight Systems LLC is the data controller for the personal data described in this policy.
2. What we collect and why
Information you give us directly
| Data | Why we collect it | Legal basis (GDPR) |
|---|---|---|
| Email address | Early access waitlist, product communications, account creation | Contract necessity / Legitimate interests |
| Payment information | Billing for paid products | Contract necessity — processed by Stripe; CustodyZero does not store card numbers |
| Name (optional) | Account personalisation | Contract necessity |
| Support communications | Responding to your enquiries | Legitimate interests |
Information collected automatically
| Data | Why we collect it | Legal basis (GDPR) |
|---|---|---|
| IP address | Security, fraud prevention | Legitimate interests |
| Browser type and device | Ensuring the interface works correctly | Legitimate interests |
| Timestamps of actions | Security logging, dispute resolution | Legitimate interests / Legal obligation |
What CustodyZero products do NOT collect
CustodyZero’s products are designed around a core principle: your data stays on your hardware.
- Factory: all change-control artifacts are stored locally in your project directory. CustodyZero does not receive your code, artifacts, or governance decisions.
- Type: all documents, drafts, semantic indexes, and voice files are stored in your project directory on your machine. AI processing happens locally on your machine. CustodyZero does not receive your writing, annotations, or any data processed by Type.
We do not collect: precise geolocation, biometric data, health information, government-issued ID numbers, racial or ethnic origin, or any data processed locally by our products.
Your payment card details are entered directly with Stripe and are never transmitted to or stored by CustodyZero’s servers.
3. How we use your information
- Early access and communications: managing the waitlist, notifying you when products become available.
- Delivering the Services: account management, product access, software updates.
- Billing and account management: processing payments, sending receipts.
- Security and fraud prevention: detecting abuse, protecting accounts.
- Customer support: responding to questions and resolving issues.
- Legal compliance: meeting our obligations under applicable law.
We do not use your data to train AI models. We do not sell your personal information.
4. How we share your information
We share personal data only as described below. We do not sell it.
Service providers (processors acting on our instructions):
- Stripe — payment processing. Stripe’s Privacy Policy.
- Cloud infrastructure provider — hosting and data storage for the custodyzero.com website and account systems.
- Email service provider — transactional emails (receipts, notifications, waitlist communications).
Each service provider is bound by a data processing agreement and may only use data to perform services for us.
Other disclosures:
- Legal obligations: we will disclose data when required by law, court order, or government authority, or when necessary to protect the rights, property, or safety of CustodyZero, our users, or the public.
- Business transfers: if Plainsight Systems LLC is acquired, merged, or sells substantially all of its assets, user data may transfer to the acquiring entity. We will notify you before your data becomes subject to a materially different privacy policy.
- With your consent: for any use not described here, we will ask first.
5. International data transfers
Plainsight Systems LLC is based in the United States. If you are located in the EEA, UK, or another jurisdiction with data transfer restrictions, your personal data relating to your account and communications will be transferred to and processed in the United States.
Where EU or UK law requires a lawful transfer mechanism, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, both for our own operations and for our processors (including Stripe). You may request a copy of the applicable SCCs by emailing privacy@custodyzero.com.
Note that data processed locally by CustodyZero products (Factory, Type) is never transferred to us — it remains on your hardware in your jurisdiction.
6. How long we keep your data
| Data type | Retention period |
|---|---|
| Account data (email, settings) | Duration of your account, plus 30 days after deletion to allow for recovery |
| Waitlist data (email) | Until the waitlist closes or you unsubscribe, whichever comes first |
| Payment and billing records | 7 years from the date of the transaction (legal and tax compliance) |
| Security logs | 12 months |
| Support communications | 2 years from the date of last contact |
When retention periods expire, data is deleted or anonymised.
7. Your rights
If you are in the EEA or UK (GDPR)
You have the following rights under the GDPR:
- Access: request a copy of the personal data we hold about you.
- Rectification: ask us to correct inaccurate data.
- Erasure: ask us to delete your personal data. We will comply unless we are required to retain it by law or for legitimate dispute resolution purposes.
- Restriction: ask us to pause processing your data while a dispute about its accuracy or lawfulness is resolved.
- Portability: request your data in a structured, machine-readable format.
- Objection: object to processing based on legitimate interests.
- Withdraw consent: where we rely on consent for any processing, you may withdraw it at any time without affecting the lawfulness of prior processing.
We will respond to requests within 1 month. No fee is charged unless requests are manifestly unfounded or excessive.
You also have the right to lodge a complaint with your national supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu.
If you are a California resident (CCPA/CPRA)
California residents have the following rights:
- Right to Know: request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
- Right to Delete: request deletion of personal information we hold about you, subject to exceptions for completing transactions, legal compliance, and security.
- Right to Correct: request correction of inaccurate personal information.
- Right to Opt Out of Sale or Sharing: CustodyZero does not sell or share personal information as defined under the CCPA/CPRA.
- Right to Limit Use of Sensitive Personal Information: we do not collect or use sensitive personal information beyond what is necessary to provide the Services.
- Right to Non-Discrimination: we will not deny, charge differently for, or provide a lower quality of service because you exercised a CCPA/CPRA right.
How to submit a request: email privacy@custodyzero.com with the subject line “Privacy Request”. We will acknowledge within 10 business days and respond within 45 calendar days.
All users
To exercise any privacy right, email privacy@custodyzero.com.
8. Cookies and tracking
We use essential cookies required to operate the Services (session management, authentication). We do not use advertising cookies or track you across third-party websites.
If we introduce analytics or preference cookies in future, we will update this policy and provide appropriate controls.
9. Children’s privacy
The Services are not directed at anyone under 16. We do not knowingly collect personal data from children under 16. If you believe we have done so, contact us at privacy@custodyzero.com and we will delete it promptly.
10. Security
We use industry-standard security measures: encryption in transit (TLS), encryption at rest for sensitive data, access controls, and security logging. No system is perfectly secure. If you discover a security issue, please contact privacy@custodyzero.com.
In the event of a data breach that affects your rights and freedoms, we will notify you and the relevant supervisory authority within the timeframes required by applicable law.
11. Changes to this policy
We will update this policy at least annually. If we make material changes, we will notify you by email (if you have an account) and update the “Last updated” date above. Continued use of the Services after changes take effect constitutes acceptance of the revised policy.
12. Contact
Privacy enquiries: privacy@custodyzero.com
Postal address: Plainsight Systems LLC 11240 N 19th Ave Suite 22 PMB 1072 Phoenix, AZ 85029-4825 USA
For GDPR-related complaints or enquiries from EEA residents that are not resolved to your satisfaction, you may escalate to your national data protection authority.