Privacy notice
The waitlist, in plain terms.
Plaw Ltd · Last updated 1 November 2026
You are giving us an email address before Plaw has even launched. That deserves a straight answer about what happens to it, so this page is written for a person rather than for a lawyer, and it describes what the code actually does.
Who runs this list
Plaw Ltd, RR Pearl Tower One, Plot 1, Yusuf Lule Road, Kampala, Uganda. The founder, Holyweek Mark Asea, reads what arrives. To exercise any right on this page, write to privacy@plaw.ai.
What we collect and why
| What | Why it exists | Required? |
|---|---|---|
| Email address | To send the launch email and, from time to time, an update while we build. | Yes |
| Your name | So a reply reads like one person writing to another. It also tells us how much effort you put into the form. | No |
| Firm or team | To understand who we are building for before we decide what to build next. | No |
| Interest area | Chosen from a short list, so the first update can be about the part of compliance you actually carry. | No |
| A hash of your IP address | To cap signups from one connection at five per hour. We store the SHA-256 hash, never the address itself, so the raw IP is not in our database. | Automatic |
| A Cloudflare Turnstile token | Checked once, against Cloudflare, to confirm the signup came from a person and not a script. It is not kept after that check. | Automatic |
What we do not do
- We do not sell, rent or trade this list to anyone.
- We do not put analytics, advertising tags or tracking pixels on the waitlist page. The only third-party script on it is the Turnstile check named above.
- We do not add you to any other list, and we do not use your address for anything beyond the launch and updates about Plaw.
Who else handles it
Two processors, both under their standard data processing terms. Cloudflare hosts this page, stores the list in its D1 database and runs the bot check. Resend delivers the email. Nobody else is given access, and we do not run marketing analytics on top of it.
Where it lives
Cloudflare and Resend are United States companies and may process data there, including for a UK or EU resident. Those transfers rest on the standard contractual clauses with the applicable UK or EU addendum that both providers publish. If you want the specifics before you join, ask and we will send them.
Why we are allowed to email you
Your consent, given when you submit the form, is the lawful basis for the marketing emails under Article 6(1)(a) of UK and EU GDPR and the privacy and electronic communications rules that sit alongside it. Protecting the form from abuse is a legitimate interest under Article 6(1)(f), which is why the hashed IP exists. Consent is yours to withdraw at any time, and withdrawing it costs you nothing but the updates.
How long we keep it
Until Plaw launches, or until you ask us to remove it, whichever comes first. Before anything beyond the launch email goes out we ask separately, so joining this list does not buy us a permanent right to email you.
Unsubscribing, and the honest difference between that and deletion
Every email carries a link that is unique to you. It opens a confirmation page rather than acting on its own, because mail clients click links to check them and a scan should not remove you from anything. Confirming, or the one-click unsubscribe the headers advertise, stops the emails immediately.
What it does not do is erase the row. Unsubscribing marks your entry so that we keep honouring the objection and cannot accidentally re-add you. If you want it gone properly, write to privacy@plaw.ai and we delete it by hand within one month. We would rather say that plainly than promise more than the system does.
One design note, because you may care: we store only a hash of your unsubscribe token, not the token itself. If the database ever leaked, nobody could use it to unsubscribe anyone else.
Your rights
- Ask for a copy of what we hold about you.
- Have anything wrong corrected.
- Have it erased, as above.
- Object to marketing, or restrict how we use it.
- Take your data with you in a machine-readable form.
- Lodge a complaint with your data protection authority, such as the Information Commissioner's Office in the UK. We would rather you wrote to us first, and we will not be offended.
If this changes
If we want to use your address for something not described here, we ask first rather than quietly rewriting this page. Any material change gets a new date at the top.