Privacy

Private session replay and issue diagnostics

When enabled, we record sampled journeys on selected public and learning pages to understand conversion and learning difficulties. Paid-user journeys may be sampled more frequently. Recordings show masked page structure, clicks and scrolling; form values, private page text, payment frames, media and private account navigation are excluded. A small allowlist of public product labels remains readable. They are linked to first-party product events and account outcomes when you sign in. Browser session continuity can connect a visit before and after signup.

When an editor issue is detected, a separate private snapshot can include your unsaved PLC program, wiring, editor state and recent editor actions so we can investigate it. For sampled journeys, we also collect limited error messages and application stack locations when a browser error occurs outside the editor, linked to a broad page category. URLs and common credential patterns are removed from these messages. Recordings, error details and snapshots are encrypted in our own database, accessible to authorized administrators, and expire after 14 days. They are not sent to MetricFold or advertising services. The analytics opt-out on the cookie policy page disables both recordings and diagnostic snapshots.

What we collect

• Account name, email, password hash and preferences.
• Learning work: saved PLC source, attempts, pass/fail results, completions and last activity.
• First-party page and product events: page path, pseudonymous session hash, account ID when logged in, referrer host, campaign fields, device/browser category and actions within the learning and purchase journey.
• Subscription status, product, price, currency and payment-provider references. We do not receive full card numbers.
• Support, feedback and marketing-email choices you submit.

Why we process it

We process account, learning and billing data to provide the service and perform our contract. We use security logs, first-party funnel measurement and support evidence for legitimate interests in protecting the service, finding broken or confusing workflows, preventing abuse and improving learning outcomes. You can object on grounds relating to your situation.

First-party measurement

Measurement is handled by PLC Simulator’s same-origin application and database. It does not create a third-party analytics identity or transmit page and feature events to Google Analytics, PostHog or an advertising platform. Our cookie and analytics policy lists the functional storage, event fields and controls.

Retention

First-party page visits are kept for 90 days and bounded product events for 365 days. Account and learning data remain while the account is open. After a valid deletion request we remove ordinary account data, attempts and saved source within 30 days, subject to backups and records we must retain. Billing records are retained for seven years for South African tax and accounting obligations.

Processors and transfers

Hosting and database providers process application data to run the service. Dodo Payments processes checkout and billing information under its own privacy terms. Transactional email providers receive the recipient and required message content. We do not use Google Analytics or PostHog as analytics processors. Where a provider processes information outside South Africa, we assess appropriate POPIA safeguards and limit the data to the service purpose.

POPIA rights

PLC Simulator is operated from South Africa and is subject to the Protection of Personal Information Act. You may:

• Ask whether we hold personal information and request access.
• Correct inaccurate or out-of-date information.
• Object to processing on legitimate grounds or request deletion where applicable.
• Lodge a complaint with the Information Regulator of South Africa.

Delete or contact us

Signed-in users can open Profile and use Delete account. You can also contact the Information Officer at privacy@plcsimulationsoftware.com from the account email address.