This privacy policy informs you how Pluma processes personal data when you visit plumahouse.com, book a treatment online via booking.plumahouse.com, buy gift cards or bundles, or contact us. Data collected in the studio during the intake and the treatment (which may include health data) is processed only to the extent necessary for the treatment and with your consent; we inform you about this separately on site.
1. Who we are
The controller responsible for the processing of personal data via this website, online booking and the online shop is:
Pluma (Ostra Ventures LLC)
Pluma is part of Ostra Ventures LLC.
Email: hello@ostraventures.com · Phone/WhatsApp: +598 92 262 170 · Web: plumahouse.com
2. Contact for data protection questions
For all questions about data protection and for exercising your rights, you can reach us at:
Email: hello@ostraventures.com
Phone/WhatsApp: +598 92 262 170
3. What this policy covers
This policy describes how we process personal data when you visit plumahouse.com, book a treatment online, buy gift cards or bundles, or contact us.
Technically, our offering consists of two parts:
- The website plumahouse.com (home page, content pages, studios, treatments).
- The booking application booking.plumahouse.com for bookings and for purchasing gift cards and bundles.
Both are operated by Pluma and hosted with Render (server location Frankfurt, EU); booking and order data is stored in a database with Neon. Fonts and other website content are delivered from our own servers; no fonts are loaded from Google servers.
4. What data we process, for what purpose and on what legal basis
The legal bases depend on the applicable data protection law (e.g. Uruguayan Law No. 18.331 on the protection of personal data and, where applicable, the General Data Protection Regulation (GDPR)).
5. Cookies and tracking
We use technically necessary cookies, in particular a cookie that stores your language preference (pluma_lang). During checkout, our payment service provider Stripe may set cookies required for secure payment processing and fraud prevention. We also use PostHog (PostHog, Inc., USA) to measure reach and improve our service: a cookie (ph_*) stores a random, anonymous visitor ID that lets us see which pages are visited and at which step a booking is abandoned. Form field inputs are not recorded. For our ads on Google we also use the Google tag of Google Ads (Google LLC, USA): it sets cookies (e.g. _gcl_*) to measure whether a click on an ad leads to a booking and to show ads to previous visitors. After a booking, your email address is additionally sent to Google in encrypted (hashed) form so that Google can attribute the booking to the ad (enhanced conversions); Google does not receive the address in plain text. You can prevent the measurement at any time by blocking cookies in your browser.
6. Recipients of your data
We only share personal data with carefully selected service providers acting on our behalf on the basis of corresponding data processing agreements, and with parties acting as independent controllers. We do not sell your data.
6.1 Processors
6.2 Independent controllers
The following parties act as independent controllers for the data they process:
- Stripe — insofar as Stripe processes data to fulfil its own legal obligations (e.g. anti-money-laundering) and for fraud prevention
- WhatsApp (Meta) — if you contact us via WhatsApp, WhatsApp processes your data under its own terms
6.3 Recipients required by law
We also share personal data with tax advisers and accountants, with lawyers for the assertion or defence of legal claims, and with authorities (e.g. tax authorities, data protection authorities) where there is a legal obligation or an official request for information.
7. International data transfers
Some of our service providers are based in the USA or process data there or in the EU, i.e. possibly outside your country of residence. Where this is the case, we ensure an adequate level of data protection under the applicable law, in particular through:
- adequacy decisions or recognised certifications (e.g. the Data Privacy Framework for appropriately certified US providers),
- standard contractual clauses or comparable contractual safeguards, or
- your explicit consent to the specific transfer, where none of the above safeguards is available.
Further information on the safeguards applied is available on request at hello@ostraventures.com.
8. Retention period
9. Your rights
Under the applicable data protection law (e.g. Uruguayan Law No. 18.331 and, where applicable, the GDPR), you have in particular the right to:
- Access — a copy of your data together with supplementary information
- Rectification — correction of inaccurate data
- Erasure — subject to statutory retention obligations
- Restriction of processing
- Data portability — in a structured, machine-readable format
- Objection to processing based on legitimate interests, in particular to direct marketing
- Withdrawal of consent given, with effect for the future
- Lodging a complaint with the competent data protection authority
Please send requests to hello@ostraventures.com. We respond to requests within the statutory time limits.
Competent supervisory authority
You can lodge a complaint with the competent data protection authority in your country of residence. In Uruguay, this is the Unidad Reguladora y de Control de Datos Personales (URCDP).
10. Obligation to provide data
Providing your data is necessary for booking and paying for a treatment; without it we cannot provide the service. Voluntary information (e.g. notes on your booking) is optional.
11. No automated decision-making
Pluma does not use automated decision-making that produces legal effects or similarly significantly affects you.
12. Changes to this policy
We update this policy when our processing changes. The date below indicates the current version. We will also inform you directly of any material changes that affect you.
Last updated: 16 October 2026