Skip to content

Privacy Policy

Last updated: 14 October 2026

PlainIEP is run by Thomas Knight, a sole trader based in the United Kingdom ("we", "us"). Contact: [email protected].

The short version

What we collect and why

When you subscribe. Payments are handled by Stripe through Stripe Managed Payments. Stripe is the merchant of record (checkout and receipts show “Sold through Link”, Stripe’s checkout service): it sells the subscription to you, takes payment, and handles sales tax. Stripe collects your payment and billing details under Stripe's privacy policy; we never see your full card number. Stripe tells us your email address, a customer ID and whether your subscription is active.

Access record. To let you in, we keep one record per subscriber: your email address, your Stripe customer and subscription IDs, the date your access runs until, and when we last checked that with Stripe. It holds no IEP information. We keep it while you subscribe and delete it on request.

Sign-in. We set one cookie, piep, which keeps you signed in on that browser for up to 30 days. It holds only a signed reference to your Stripe customer ID. If you ask for a sign-in link, we look up your email in Stripe, store a one-time code for 15 minutes, and keep a count of link requests for that email for one hour to prevent abuse.

Usage limit. To enforce the limit of 20 analyses a day, we keep a daily count against your customer ID. It is deleted automatically after two days.

Your IEP. PDF pages and photos are read on your device (including on-device text recognition for scans). You see the text before it is sent. The text goes to our server and to Cloudflare Workers AI to produce your report, and is then discarded. We don't write it to any database, file or log. Cloudflare states that it does not use Workers AI inputs or outputs to train AI models or to improve its services, and does not make them available to other customers.

Free checklist emails (optional). If you choose to leave your email for IEP-prep tips, we store your email, the state you pick (optional), the campaign tags in the link you arrived from (utm tags) and the referring page, with the date. You can unsubscribe or ask us to delete it at any time.

Visit counts. When the home page or sample report loads, our server adds one to a daily count for the ad campaign tag in the link (or "direct"). No cookies, IP addresses or device identifiers are stored. The campaign tags are also kept in your browser's session storage for that visit, so a checklist sign-up can record which ad you came from.

Support emails. Mail to [email protected] is forwarded by Cloudflare Email Routing to our support inbox (Google Gmail). We use it only to answer you.

Who processes data for us

These providers may process data outside your country, including in the United States.

Children's information

The service is for parents, guardians and others aged 18 or over who are authorized to hold the document. An IEP contains information about a child, which we treat as highly sensitive: that is why it is processed once and never stored. We don't knowingly collect information directly from children.

Your rights

You can ask for a copy of the data we hold about you, or for it to be corrected or deleted, by emailing [email protected]. Depending on where you live (for example the UK, EU or some US states), you may have further rights, including the right to complain to a data-protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk).

Security

All traffic uses HTTPS. Access records are kept in Cloudflare's storage. IEP text is not kept, so it can't be leaked from our systems later.

Changes

If we change this policy, we'll update this page and the date above. If a change is material, we'll email current subscribers.