Privacy Statement

Our privacy principles

Privacy isn't a feature we bolt on later. It shapes how we build Plus± from the beginning.

• Collect less. We only ask for the information required to deliver the service.
• Encrypt by default. Sensitive project content is protected before it reaches our infrastructure.
• Be transparent. We'll always explain what we collect, why we collect it, and who processes it.
• Keep you in control. You can access, export, or delete your information whenever you need to.

In short…

• We collect only what's required to deliver your work.
• Project content is encrypted in your browser before it reaches us.
• Our infrastructure providers only ever store encrypted content.
• We never sell your information.
• Every third party we use is named on this page.
• You can access, export, or delete your information at any time.
• We comply with applicable privacy laws, including the GDPR.

Who we are

Plus± (PlusPlusMinus) is a product design and frontend studio operated by Boom Pow Limited, a company registered in Hong Kong (company no. 3258397), with its registered address at The L. Plaza, 367 - 375 Queen's Road, Central, Sheung Wan, Hong Kong.

For the purposes of applicable data protection law, Boom Pow Limited is the data controller for the personal information described in this statement.

You can reach us about anything in this document at [email protected].

Scope

This statement covers:

• Our website — the public pages at plusplusminus.com, including our journal.
• The client dashboard — the platform where projects are briefed, tracked, and delivered.
• Communications — email, in-platform messages, and anything you send us during a subscription or an enquiry.
• Our services — the design and development work we deliver under your plan.

It does not cover third-party websites we link to, or services you connect to your own products. Those have their own privacy policies, and we encourage you to read them.

Information we collect

We split this into two categories, because they are treated very differently.

Information you provide

• Account details — your name, email address, company name, and timezone.
• Billing details — the information needed to invoice you. Card details are handled directly by our payment processor and never touch our servers.
• Project content — briefs, task descriptions, uploaded files, references, and messages. This category is end-to-end encrypted before it leaves your browser. See Encryption and security.

Information collected automatically

• Technical data — IP address, browser type, and device information, used for security and to keep the service working.
• Usage data — privacy-respecting, aggregated analytics about how our website is used. We do not build individual profiles.
• Service metadata — unencrypted operational data such as task statuses, dates, and plan tier, which we need to schedule and deliver work. See Encryption and security for exactly where the line sits.

How we use information

We use the information above to:

• Deliver the work you subscribe to — scheduling, scoping, and completing requests.
• Communicate with you about projects, deliverables, and your account.
• Bill you correctly and maintain accurate financial records.
• Keep the platform secure — detecting abuse, preventing unauthorised access, and maintaining audit trails.
• Improve the service, using aggregated and de-identified data only.
• Meet our legal obligations, including tax and accounting requirements.

That is the complete list. We do not use your information for advertising, and we do not sell or rent it to anyone.

Why we process your information

Where the GDPR or similar laws apply, processing needs a legal basis. Ours are:

• Contract — most processing happens because it is necessary to deliver the service you signed up for.
• Legitimate interests — security, fraud prevention, and improving the service, balanced against your rights.
• Legal obligation — retaining invoices and financial records where the law requires it.
• Consent — for anything optional, such as non-essential cookies. You can withdraw consent at any time.

Encryption and security

Project content — briefs, task descriptions, files, messages, and project names — is encrypted in your browser before it reaches our infrastructure. Only the operational metadata needed to run the service remains readable: account identifiers, task statuses, dates, and plan tier. It tells us that a task exists and when it is due — not what it says.

In practice this means:

• We can't casually browse your projects.
• Our hosting providers only store encrypted content.
• If our infrastructure were compromised, encrypted project data would remain unreadable without your keys.

Your encryption keys are generated on your device. Beyond encryption, we protect the platform with encrypted transport (TLS), strict access controls, audit trails, and continuous infrastructure monitoring.

If you're interested in exactly how this architecture works, our Security page explains it in detail.

Cookies and analytics

We keep this minimal:

• Essential cookies — required for login sessions and security. These cannot be switched off.
• Preference cookies — remember settings such as your theme choice.
• Analytics — we use Cloudflare Web Analytics, which is cookie-free and does not track you across the web. It sets nothing on your device and builds no individual profiles.

The full list, with lifetimes and purposes, lives in our Cookie Declaration.

Third-party services

Every provider we use is listed here, along with what it does and whether it can read your project content.

A note on email: because we work async, project content is never sent by email. At most, a notification tells you that something happened — a new update on one of your projects — never what it says. The work itself stays in the dashboard, encrypted.

We do not use third-party advertising or tracking networks.

International transfers

Plus± is operated from Hong Kong, and our infrastructure providers operate globally — Cloudflare, for example, serves content from data centres close to you.

Where personal information is transferred across borders, we rely on appropriate safeguards, including standard contractual clauses where required. It is worth restating in this context: the content of your projects crosses those borders as ciphertext.

Data retention

We keep information only as long as we have a reason to:

• Project data — retained for 90 days after cancellation, during which you can export everything. After 90 days it is permanently deleted.
• Accounts — retained while your subscription is active, and deleted within 30 days of a deletion request, subject to the legal retention requirements below.
• Database recovery window — our database keeps a short rolling recovery window (currently up to six hours) so we can restore from failures. Deleted data ages out of it automatically, and project content within it remains encrypted throughout.
• Invoices and financial records — retained for at least seven years, as required by Hong Kong tax and accounting law, and for as long as our statutory obligations require. These are processed by our accountants — see Third-party services.
• Support and email correspondence — retained for the life of our working relationship and up to two years after it ends, to keep context if you come back.

Your rights

Depending on where you live, you have the right to:

• Access the personal information we hold about you.
• Correct anything inaccurate.
• Delete your information, subject to legal retention requirements.
• Export your data in a portable format — available in the dashboard at any time, not just on request.
• Restrict or object to certain processing.
• Withdraw consent where processing is based on consent.
• Complain to your local data protection authority, though we would ask you to talk to us first.

To exercise any of these, email [email protected]. We respond within 30 days.

One honest caveat: because project content is encrypted with your keys, some rights work differently in practice. An access request for that content is best served by the export tools in your dashboard — you hold the keys, so you can always read your own work directly.

Age requirements

Plus± is a business service. You must be at least 18 to use it, and we do not knowingly collect personal information from anyone under that age. If you believe someone under 18 has provided us with personal information, contact us and we will delete it.

Changes to this statement

When we make material changes, we will notify active clients by email and update the dates at the top of this page. Continued use of the service after a change takes effect means you accept the updated statement. Previous versions are available on request.

Contact

Questions, requests, or concerns about privacy:

Privacy enquiries:

[email protected]

General support:

[email protected] or through your dashboard

Business address:

Boom Pow Limited, The L. Plaza, 367 - 375 Queen's Road, Central, Sheung Wan, Hong Kong

Related

• Security — How Plus± protects your data, including our encryption architecture.
• Cookie Declaration — Every cookie we use, what it does, and how long it lasts.
• Terms of Service — The legal agreement covering your use of the service.

Privacy shouldn't require a law degree to understand. If anything in this statement is unclear, let us know — we'd rather improve this page than leave you guessing.