Plio Privacy Policy and Data Protection Notice
1. Who we are
Plio is a software product operated by Paylists LTD, company number 14081565, registered office 20–22 Wenlock Road, London, England, N1 7GU. Paylists LTD is registered with the UK Information Commissioner's Office (ICO), reference ZB593551. This notice covers plio.co.uk, its associated application domains and Plio services.
Privacy contact: privacy@plio.co.uk. Security contact: security@plio.co.uk. General contact: office@plio.co.uk. We have not appointed a Data Protection Officer; privacy enquiries should be sent to the privacy contact.
2. Our data protection roles
For business account information, service administration, security, billing, support, site analytics and our own legal compliance, Paylists generally acts as an independent data controller. For personal data contained in business-provided R&D project records, uploaded documents, employee records, allocated costs and prompts processed on the customer's instructions, the customer generally acts as controller and Paylists as processor, under our Data Processing Addendum. These roles depend on the actual processing activity, not simply the label of a document.
3. Personal data we may process
Depending on the features you use, this may include:
- Business and user identification: names, work email addresses, job titles, company details, account permissions, authentication and support information.
- R&D project information: names and roles of employees, workers or contractors; qualifications or relevant expertise; work descriptions, project assignments, activity logs, experiments, comments and correspondence.
- Cost evidence: salary or payroll-derived figures, employment or contractor details, invoices, expense records, allocation percentages and justifications, where the business provides them.
- Uploaded files, chat prompts and Lister AI outputs, including personal data deliberately or incidentally included by users.
- Technical and security data: IP addresses, device/browser information, login events, audit logs, diagnostic information and cookies or local storage.
- Communications, billing and transaction records relating to our relationship with the customer.
Plio is intended for professional business use, not children. Do not submit special-category personal data, such as health or biometric data, or criminal-offence data unless separately agreed with us and lawfully justified. R&D project files may incidentally include sensitive information; customers should minimise or redact unnecessary material.
4. Sources of information
We obtain information from business administrators and authorised users, files and records they upload, the use of the application, correspondence with us, and authorised service providers. Where Plio uses publicly available scientific or technical publications, their contents and references may be used to support AI-assisted analysis. Plio does not independently validate every statement in those publications.
5. Purposes and lawful bases
For our controller processing, the relevant legal bases may include:
| Purpose | Typical lawful basis |
|---|---|
| Create and manage business accounts; deliver support and contracted services | Contract where the individual is a contracting party; otherwise legitimate interests in providing B2B services |
| Protect accounts, detect abuse, maintain logs and investigate incidents | Legitimate interests; legal obligation where applicable |
| Administer billing, taxation and business records | Contract where applicable; legitimate interests; legal obligation |
| Respond to requests or enforce legal rights | Legal obligation; legitimate interests |
| Measure site performance and analytics | Consent where required for non-essential cookies; legitimate interests where lawful |
| Send marketing to business contacts | Consent where required; otherwise legitimate interests where permitted, subject to applicable direct-marketing rules and opt-out rights |
For processor processing of Customer Content, the business determines its lawful basis and purposes and instructs us under the DPA. We do not treat the business's instructions as our own separate lawful basis for unrelated use of employee data.
6. AI Processing and Lister
Lister AI may process R&D project records, technical descriptions, uploaded documents, employee information, cost data and chat content to review technical explanations, identify potential evidence gaps and generate recommendations.
Relevant information may be shared with third-party AI service providers, including the OpenAI API platform, as described in our Subprocessor List.
AI-generated outputs may contain errors or inaccuracies and must be reviewed by users. Plio does not use these outputs to make solely automated decisions about individuals that produce legal or similarly significant effects.
7. Disclosure and service providers
We may disclose information to providers needed to host, secure and operate Plio, including infrastructure, managed database, communications and enabled AI providers, as identified on the Subprocessor List. We may also disclose information to professional advisers acting for Paylists, law enforcement, courts and regulators where lawfully required. Plio does not give external accountants or R&D tax advisers login or invitation-based access. If you export and independently share documents outside Plio, you control that sharing.
8. International processing and transfers
Paylists is established in the United Kingdom, while its hosting infrastructure — including the application layer (Vercel), database (Supabase) and underlying cloud infrastructure (AWS) — is located in the European Economic Area (Frankfurt, Germany). Personal data is therefore processed primarily in the European Economic Area, and may also be processed in the United Kingdom (for example, when accessed or managed by Paylists as a United Kingdom-established business) and in other countries where Paylists or its service providers operate. Personal data may therefore transfer in both directions between the European Economic Area and the United Kingdom in the normal course of providing the Services.
Where personal data is transferred from the EEA to the United Kingdom, Paylists relies on the European Commission adequacy decision for the United Kingdom where applicable. Where personal data is transferred from the United Kingdom to the EEA, Paylists relies on the UK adequacy regulations for the EEA where applicable.
Where personal data is transferred to a country that is not subject to an applicable adequacy decision or adequacy regulation, Paylists will use appropriate safeguards, such as the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism.
Where a data protection request or communication is sent to Paylists through its EU representative, the representative may forward the request and related personal data to Paylists in the United Kingdom so that Paylists can respond and comply with applicable law.
9. Retention and deletion
We retain controller data for as long as reasonably necessary for the relevant account, security, contract, compliance or legal purpose. Customer Content is retained while the account is active and handled upon termination under the User Agreement, DPA and actual retention and backup schedule. Secure backups may persist until their scheduled expiry, and some records may be retained where legally required or necessary for legal claims. Do not interpret Plio as providing HMRC-compliant long-term archival retention: customers remain responsible for preserving records for the periods applicable to their own business and tax affairs.
10. Security
We use technical and organisational security measures appropriate to the risks, described in our Security Statement. No internet service is completely risk free. Users should protect login credentials and report suspected compromise promptly.
11. Your data protection rights
Depending on your circumstances and applicable law, you may have rights of access, correction, erasure, restriction, objection, portability and withdrawal of consent. Contact privacy@plio.co.uk. Where your information is held in a customer's R&D records and that customer is the controller, we may refer the request to that customer or assist them in responding. You may complain to the ICO.
12. Cookies and marketing
See the Cookie Notice for cookies, local storage and consent controls. You may opt out of marketing by using the message's unsubscribe mechanism or contacting us. We do not rely on a website privacy notice as consent to all marketing.
13. Changes and contact
We may update this policy and will publish a new effective date. Material changes will be communicated where required. Contact privacy@plio.co.uk for questions about this notice.