Privacy Policy

Last updated: 17 July 2026

Who we are

Plepic OÜ ("Plepic", "we") is an Estonian private limited company, registry code 11275881, VAT number EE102813797, registered at Liivalaia 7, 10118 Tallinn, Estonia. We run agentic-coding training and build internal tooling that helps us operate the business.

For any data-related request, email kaido@plepic.com or call +372 5077 333. We act as data controller under the EU General Data Protection Regulation (GDPR).

1. The plepic.com website

What we collect

When you visit plepic.com we collect:

  • Usage analytics via Google Analytics 4 (property G-65CCEV6RS9): pages viewed, approximate country and city, device and browser, session duration, referring source. IP addresses are anonymised before storage.
  • Advertising measurement via Google Ads (conversion tag AW-17874572217): clicks from our ads and whether they led to a form submission, calendar booking, or contact action.
  • Contact events you trigger deliberately: clicking an email address, phone number, calendar link, or external form.

We do not run forms or collect account registrations on plepic.com. All signups happen through linked external services (Google Forms, Google Calendar), which have their own privacy policies.

Cookies

We set cookies only for analytics and ads measurement (_ga, _gid, _gcl_au). No advertising profile is built for you on our side; Google manages its own cookie lifecycles.

Legal basis

Legitimate interest (Article 6(1)(f) GDPR) in measuring and improving our own site and advertising. For visitors in the EU, we respect browser-level signals like Do Not Track and do not combine analytics identifiers with any personal profile held elsewhere. When your browser sends a Do Not Track signal, no analytics or advertising tag is loaded at all: we make no request to Google, set no cookies, and record no events.

2. The Skill Tree app (skill.plepic.com)

skill.plepic.com is a self-assessment tool for agentic coding skills. It runs in two modes, and what we hold depends on which one you use.

Without signing in

Your skill selections stay in your browser's local storage. No account exists and none of your selections reach us.

If you sign in

Signing in is optional and uses Google. It stores a single record in Google Firestore, keyed to your Google account ID:

  • Display name and avatar URL, as supplied by your Google account
  • Your claimed levels on the three skill axes (autonomy, parallelism, skill usage)
  • Your chosen stakes setting and the time you last updated the assessment

Every synced profile is public. Anyone with the link can read yours at skill.plepic.com/profile/<id>, and there is no private mode. Please sign in only if you are comfortable with that record being public. Profile data is stored in Firestore's eur3 European multi-region.

Usage analytics

The same Google Analytics 4 property as plepic.com (G-65CCEV6RS9): pages viewed, approximate country and city, device and browser, referring source. Profile URLs are normalised to /profile/:userId before they reach Analytics, so display names and account IDs are never sent to it. As on plepic.com, a Do Not Track signal means no tag is loaded at all. There is no advertising tag on this subdomain.

Legal basis

Legitimate interest (Article 6(1)(f) GDPR) for usage analytics. For the optional account, your consent (Article 6(1)(a) GDPR), given by choosing to sign in and withdrawn whenever you ask us to delete the profile.

Deleting your profile

The app has no self-service delete yet. Email kaido@plepic.com and we will remove the record. You can also revoke the app's access to your Google account from your Google security settings, though that on its own does not erase a profile we already hold.

3. YouTube automation tooling

Plepic operates the YouTube channel @plepic-agentic. We build and run an internal pipeline (the "YouTube Pipeline") that helps us publish, edit metadata on, and analyse performance of videos we produce ourselves. The pipeline is run only by Plepic's channel owner on a personal workstation.

YouTube API scopes we request

  • yt-analytics.readonly — read aggregated channel performance metrics for our own channel.
  • youtube.readonly — read channel metadata and list of our own videos.
  • youtube.upload — upload new videos to our own channel.
  • youtube.force-ssl — edit metadata (title, description, thumbnail, chapters) and manage comments on our own videos.

We request only the scopes strictly needed for channel owner operations. We never request access to other YouTube users' data.

How we handle YouTube data

  • OAuth refresh credentials are stored as an environment value on the operator's workstation (file permission 600, owner-only). They are not transmitted to any third-party service.
  • Channel and video performance data pulled via the API is stored as local JSON reports in our internal repository. We use it to inform our own content decisions.
  • We do not share data retrieved through YouTube APIs with any third party. We do not use it for advertising, profiling, or resale.
  • If you revoke access through myaccount.google.com/permissions, our tooling loses all access immediately and any cached data becomes stale.

Compliance with YouTube API Services

Our use of YouTube APIs complies with the YouTube API Services Terms of Service and Google's Privacy Policy. Data obtained through YouTube APIs is not shared, sold, or transferred to third parties, used for independent analysis outside the stated purposes, or used to build user profiles.

4. Email and CRM

When you email us, book a meeting, or engage in a sales conversation, we store your message and basic contact details in Google Workspace (Gmail, Google Calendar) and Pipedrive CRM to respond and maintain the relationship. We do not use this data for targeted advertising.

5. Your GDPR rights

You have the right to:

  • Access the personal data we hold about you
  • Request correction or deletion of that data
  • Object to processing, or restrict it
  • Request a portable copy of data you provided directly
  • Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local equivalent

To exercise any right, email kaido@plepic.com. We respond within 30 days.

6. Retention

Analytics data is retained according to GA4's default 14-month window. Skill Tree profiles are kept until you ask us to delete them, since the profile is the product: an assessment you can return to and update. Email and CRM records are retained for as long as the relationship is active and for up to 7 years afterwards to meet Estonian accounting-law retention requirements. Local YouTube analytics JSON reports are retained in our internal repository indefinitely for trend analysis, and contain no third-party personal data.

7. Changes

When we update this policy materially we will update the "Last updated" date at the top of this page and, if the change is significant, note it on the homepage.