PLENU Privacy Notice

About This Notice

Welcome to PLENU. We're getting ready to launch in Nashville, Tennessee, and we appreciate your interest. This Privacy Notice explains what we do with the information you share on this pre-launch landing page at plenu.online.

This Notice covers our landing page only. When PLENU's full subscription service launches (target: August 1, 2026), this Notice will be replaced by our complete Privacy Policy. We'll notify you in advance of that change.

PLENU is operated by HomeFill LLC, a Tennessee limited liability company doing business as PLENU ("PLENU," "we," "us," or "our"). By using our landing page or signing up for our waitlist, you agree to this Privacy Notice.

1. What We Collect

1.1 Information You Provide

When you sign up for our waitlist or express Founding Member interest:

• Email address (required)
• First name (required for Founding Member interest)
• ZIP code (helps us understand interest in our launch area)
• Subscription tier preference (Solo, Plus, Family, or XL)
• Phone number (optional — see Section 4)
• Any messages you send us

1.2 Information Collected Automatically

When you visit our landing page:

• IP address and approximate location (analytics + Nashville-area validation)
• Browser, device, operating system
• Pages viewed, time on page, basic navigation paths
• Marketing source attribution (UTM parameters, QR code identifiers — anonymized, no personally identifying information)
• Cookies and similar technologies (see Section 6)

1.3 What We Do NOT Collect

We do NOT collect on our landing page:

• Payment card or financial information
• Social Security numbers, driver's license numbers, or other government IDs
• Date of birth or detailed demographic information
• Information from anyone under 13 (knowingly)

Sensitive Personal Information (CPRA). We do not collect or process "sensitive personal information" as defined by the California Privacy Rights Act (CPRA), including government IDs, account credentials, precise geolocation, contents of communications, genetic or biometric data, or information concerning health, sexual orientation, racial or ethnic origin, religious beliefs, or union membership. Because we do not collect sensitive personal information on our landing page, the CCPA "Limit the Use of My Sensitive Personal Information" link is not applicable.

2. How We Use What We Collect

We use the information you share with us to:

• Notify you when PLENU launches in your area
• Contact you with Founding Member onboarding details when we're ready to begin accepting subscriptions
• Plan our launch capacity using aggregate tier preference, ZIP density, and signup velocity (no individual profiles shared externally)
• Attribute waitlist signups to marketing sources (e.g., QR code, referral, direct visit) using anonymized source tags — helps us understand which outreach channels are working
• Send promotional emails about PLENU (with your consent; opt out anytime)
• Improve our landing page through aggregated analytics
• Prevent fraud and protect security
• Comply with legal obligations

3. What Your Signup Means — and Doesn't

Signing up for our waitlist or expressing Founding Member interest is NOT a purchase or a binding subscription. Specifically:

• Waitlist signup = a request to be notified when we launch
• Founding Member interest = an expression of interest, not a guaranteed slot or locked-in pricing
• Tier preference (Solo / Plus / Family / XL) is for our capacity planning. You can change tiers when you actually subscribe
• Nothing is charged automatically. We will contact you before any subscription begins
• PLENU determines when and how to onboard Founding Members based on launch capacity and operational readiness

4. Phone Number — Optional

Providing your phone number is optional. If you provide it:

• We use it solely to contact you about PLENU's launch and your potential onboarding (by phone or text)
• We will NOT send you marketing or promotional text messages based on this submission
• If we offer SMS marketing later, we will collect your separate explicit consent at that time (per TCPA)
• You may remove your phone number from our records anytime by emailing privacy@plenu.online

5. How We Share What We Collect

We do not sell your personal information.

We share information only with the limited service providers needed to run our landing page:

• Klaviyo — our email and waitlist management platform; stores email, name, ZIP, tier preference, and (if provided) phone number
• Google Analytics 4 — anonymized website usage analytics
• IONOS — our website hosting infrastructure; processes standard server logs (IP address, request timestamps, user agents) as part of delivering the landing page

Each service provider is contractually required to use information only as needed to provide their services to us and to protect your information.

We may also share information when required by law or legal process; to protect rights and safety; or in connection with a merger, acquisition, financing, or sale of business assets (with continued privacy protections).

5.1 Categories Disclosed in the Past 12 Months (CCPA Taxonomy)

In the 12 months preceding the effective date, we have disclosed the following categories of personal information (as defined by California Civil Code §1798.140) to the service providers listed in Section 5:

• Identifiers — name, email address, phone number (where optionally provided)
• Commercial information — subscription tier preference, Founding Member signup intent
• Internet or other electronic network activity information — analytics events, page views, source attribution UTM/QR tags
• Geolocation data — ZIP code, IP-address-derived approximate location

Sources of the information: directly from you (waitlist signup form) and automatically from your visit (analytics).

Business purposes for which we disclose: waitlist management, launch capacity planning, marketing communications (with consent), security and fraud prevention.

Categories of third parties to whom we sell or share for cross-context behavioral advertising: None. We have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months.

5.2 How PLENU Handles Subscriber Data (Effective August 1, 2026)

This section is forward-looking and applies once you become a Plenu subscriber.

When PLENU's full subscription service launches, we are committed to a privacy-protective data architecture:

• Pseudonymous subscriber identifier: Each subscriber is assigned a pseudonymous UUID (a randomly generated identifier). Your PII (name, email address, payment details) is stored only in the source systems that require it (such as our payment processor, Stripe, and our email system, Klaviyo). Your PII is NOT stored in Plenu's AI operational data layer.
• Operational data layer is PII-free: Plenu's AI operational systems work with the UUID only — not your name, email, or personal identifiers. This limits the exposure of personal information to the minimum necessary for service operation.
• Source-of-truth systems: Your personal information remains in Stripe (payment/billing), Klaviyo (email communications), and your account portal. Plenu's internal AI agents access operational data (box composition preferences, consumption signals, delivery status) but do not access your PII from Stripe or Klaviyo.
• Crypto-shredding: If you request deletion of your account, your household's encryption key (used to protect your operational data) will be deleted (crypto-shredded), rendering your operational data permanently inaccessible even if any records remain in backup systems.

This architecture was ratified by Plenu's CEO under the Customer Data Separation Architecture (BATCH 74.2, June 22, 2026) and is designed to meet CCPA, TDPSA (TN), and GDPR privacy standards from Day 1.

6. Cookies and Tracking Technologies

Our landing page uses cookies for two limited purposes:

• Google Analytics — anonymous aggregate analytics about how visitors use our page
• Klaviyo — email signup engagement tracking to improve waitlist communications

We do NOT use advertising pixels (such as Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, or Hotjar) on our landing page.

When you visit our landing page, you'll see a cookie consent notice giving you control over how cookies are used. You can also manage cookies through your browser settings at any time. See our separate Cookie Policy for full details.

7. Your Privacy Rights

You have the following rights regarding information we collect on our landing page:

• Access — see what we have about you
• Correction — fix inaccurate information
• Deletion — have us remove your information
• Opt out of marketing emails — unsubscribe via any marketing email or by emailing us
• Withdraw from waitlist — have your signup removed entirely

To exercise any of these rights, email privacy@plenu.online. We respond within 45 days. For complex requests, we may extend this period by an additional 45 days with notice to you, as permitted under CCPA and most state privacy laws.

Authorized Agents. You may designate an authorized agent to submit a privacy request on your behalf. The agent must provide written permission signed by you, and we may require you to verify your identity directly with us or confirm separately that you provided the agent with permission. Authorized agent requests should be submitted to privacy@plenu.online with the subject line "Authorized Agent Request."

8. State-Specific Privacy Rights

If you reside in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you have additional rights under your state's comprehensive consumer privacy law:

• Right to know what categories and specific pieces of personal information we have collected
• Right to delete (subject to legal exceptions)
• Right to correct inaccurate information
• Right to data portability
• Right to non-discrimination for exercising your rights
• Right to opt out of sale or sharing of personal information (PLENU does not sell or share personal information for cross-context behavioral advertising — see Section 5)
• Right to limit the use and disclosure of sensitive personal information (PLENU does not collect sensitive personal information on the landing page — see Section 1.3)

California residents: PLENU does not sell personal information. We recognize and honor the Global Privacy Control (GPC) signal as an opt-out of sale or sharing.

Tennessee residents: Under the Tennessee Information Protection Act (TIPA, effective July 1, 2025), you have the rights enumerated above.

Email privacy@plenu.online to exercise these rights. We respond within 45 days; for complex requests we may extend by 45 days with notice as permitted by applicable state law.

8.1 AI in the PLENU Service — Forward-Looking Disclosure

Plenu's subscription service (launching August 1, 2026) uses artificial intelligence. We make the following disclosures in compliance with the Tennessee Mental Health AI Misrepresentation Act (TN SB 1580, effective July 1, 2026) and the EU AI Act Article 52 (effective August 2, 2026):

• AI identity: Plenu's service is AI-powered. Our household organizer assistant is an artificial intelligence system, not a human. It will identify itself as AI at the start of any interaction.
• Not a mental health service: Plenu's AI is not a therapist, counselor, psychologist, social worker, or other licensed mental health professional. It will never represent itself as such. Plenu does not provide mental health services of any kind.
• Crisis resources: If you or a household member is experiencing a mental health crisis, please contact the 988 Suicide and Crisis Lifeline (call or text 988) or go to your nearest emergency room. Plenu's AI is programmed to provide this referral if a crisis is indicated.
• Scope: Plenu's AI is designed for household supply management and logistics only. It does not provide medical advice, financial advice, legal advice, or mental health services.

This section satisfies TN SB 1580 § 2(b) (operator disclosure) and EU AI Act Art. 52(1) (transparency obligation for Limited Risk AI systems).

9. How Long We Keep Information

• Waitlist and Founding Member interest signups: until you ask us to remove your information, or 24 months after PLENU's public launch — whichever comes first
• Marketing email opt-ins: until you unsubscribe
• Website analytics: Google Analytics 4's default data retention is 2 months; we may extend this to 14 months in the future, in which case we will update this Notice

After PLENU's public launch, our full Privacy Policy will apply with different retention rules for subscriber data.

10. Data Security

We use reasonable security measures including encryption in transit (HTTPS / TLS 1.3) and access controls. No system can guarantee absolute security, but we work to protect your information.

In the event of a data security incident affecting your personal information, we will notify you and applicable regulators in accordance with applicable state and federal law, without unreasonable delay and within the timeframes required by your state's breach notification statute (including Tennessee Code §47-18-2107 which sets a 45-day notification window).

11. Age — 18+ Only

Our landing page is intended for adults 18 years of age and older. By using our landing page or signing up for our waitlist, you represent and warrant that you are at least 18 years of age. We do not knowingly collect information from anyone under 18.

We also do not knowingly collect information from children under 13 (per COPPA). If you believe a child under 13 has provided us with information, email privacy@plenu.online and we will delete it promptly.

12. International Users

PLENU operates in the United States. If you access our landing page from outside the U.S., your information may be transferred to and processed in the U.S., which may have different data protection laws than your country.

Our email service provider (Klaviyo) participates in the EU-U.S. Data Privacy Framework and the UK Extension (Klaviyo DPF Listing 6149), which provides an adequacy-equivalent transfer mechanism. If you access our landing page from the European Economic Area, United Kingdom, or Switzerland, we rely on the Data Privacy Framework (where applicable) and Standard Contractual Clauses (SCCs) as the legal mechanism for transfer of your information to the United States.

13. Contact Us

• Email: privacy@plenu.online
• Mail: HomeFill LLC dba PLENU, Attn: Privacy Officer, 2141 Century Farms Pkwy, Ste 1013-113, Nashville, TN 37013

14. Updates to This Notice

We may update this Privacy Notice. For material changes, we will post the updated version with a new "Last Updated" date and notify waitlist signups by email before changes take effect.

When PLENU launches its full subscription service (target: August 1, 2026), this Notice will be replaced by our complete Privacy Policy. We will give advance notice and ask for your acknowledgment of the new Privacy Policy before applying it to subscription-related data practices.