Privacy

What we collect

• Your account email and name (so you can log in).
• Your scenario progress — source code you write in the editor, attempts, pass/fail results. We need this to save your work and show your dashboard.
• Product analytics through Google Analytics 4 and PostHog, including page views and feature events.
• Privacy-masked PostHog session replays used to diagnose broken or confusing product journeys.

Why we collect it

To run the product you paid for (or didn’t — free tier is a real product), to figure out which scenarios trip people up, and to improve what we ship. We don’t sell your data and we don’t use it for advertising.

Retention

We keep account data as long as you have an account. If you delete your account we remove your email, name, attempts, and saved source code within 30 days. Analytics Google Analytics data is retained under its configured settings (currently 14 months). PostHog analytics and masked replay data follow the retention settings on our PostHog Cloud project; email us for the current period used in an institutional review. Billing records (invoices, payment receipts) are kept for seven years to satisfy South African tax and accounting obligations.

POPIA compliance

PLC Simulator is operated from South Africa and is subject to the Protection of Personal Information Act (POPIA). Under POPIA you have the right to:

• Confirm whether we hold personal information about you.
• Request a copy of that information, at no charge, once per year.
• Correct inaccurate or out-of-date information.
• Object to processing on legitimate grounds.
• Lodge a complaint with the Information Regulator of South Africa.

Our Information Officer is reachable at privacy@plcsimulationsoftware.com.

Payments — Dodo

Paid subscriptions are processed by Dodo Payments (“Dodo”). When you subscribe, Dodo receives your name, email, billing country, and card details. We receive only the subscription status, plan, and a Dodo customer reference — never the card number. Dodo’s own privacy policy governs their processing.

Google Analytics 4

On the production site only, we load GA4 to understand aggregate usage. GA4 drops a cookie (_ga) that helps it deduplicate visitors. We don’t hook GA4 up to advertising networks and we don’t use its User-ID feature. You can block GA4 with any standard content blocker — the product works fine with it blocked. See our cookie policy for the full list.

PostHog analytics and masked session replay

In production we use PostHog Cloud in its US region for product analytics, surveys and session replay. Replay helps us see where a workflow fails, but it is configured to mask form inputs, code and preformatted text, and PLC editor surfaces. Canvas recording is disabled. Do not enter real plant credentials, production secrets, or personal information into PLC programs or free-text fields.

PostHog receives product events and masked interaction data. Blocking PostHog with a content blocker does not prevent the core simulator from working.

Cookies

Only two categories of cookies are set:

• Session cookies from Laravel — required to keep you logged in. These expire when your session ends.
• Google Analytics (_ga, _ga_*) — only loaded on the production site. Not loaded in local or staging builds.

Your right to delete

Open your profile and scroll to Delete account to self-serve. You can also email privacy@plcsimulationsoftware.com from the address on your account and we’ll delete your account and everything tied to it within 30 days. Billing records that must be retained under South African tax law will be kept for the statutory period and then purged.

Questions

Same address — privacy@plcsimulationsoftware.com. We read every message.