Privacy Policy

The controller of personal data processed in Prolpy (https://prolpy.com) is Prime Helmsman Consulting, Ojcowska 103, 32-089 Bębło, Poland, NIP 5130286196, REGON: 525405609 ("we").

Contact for anything related to personal data, and for everything else: contact@prolpy.com.

Prolpy is a service for businesses: it measures how AI assistants (ChatGPT, Claude, Google AI Mode) mention brands. This policy explains what personal data we process when you use it, why, where it is stored, for how long, who else processes it, and what your rights are under the GDPR (Regulation (EU) 2016/679).

Sign-in data from Google: your name, email address, profile photo URL and Google account identifier. We receive them when you choose "Continue with Google". We also store the sign-in tokens Google issues, only to keep the link between your Google account and your account with us.

Session data: a session identifier stored in a cookie, the session's expiry, and the IP address and browser user agent of the device that signed in (used to secure your account).

What you enter: brands (name, website, category, description, market), competitors, prompts, scan schedules, and client report settings (report name and logo).

What the service produces for you: the answers AI assistants return to your prompts, the brands and sources those answers name, checks of public web pages the answers cite and of your own website, your visibility scores, tasks and history.

Billing data: when you buy a paid plan, Stripe collects your company name, billing address, email, tax ID and payment details. Card data never reaches our servers. We store your Stripe customer and subscription identifiers, the plan status, and a record of each paid invoice (invoice number, company name, email, tax ID, country, amount).

Usage records: how many AI answers your account used each month and their estimated cost, and how many website analyses you ran, to enforce plan limits.

Technical logs: our hosting provider records requests (time, path, status, IP address) for operating and securing the service.

Analytics, only if you accept analytics cookies (section 11): which pages of our public website are visited and whether a visitor started signing in, finished onboarding, got a first scan, and started or completed checkout, with the device, browser, referring page and an approximate location, collected by Google Analytics under a random identifier stored in a cookie. We never send names, email addresses, brands or prompts to Google Analytics.

We don't use advertising cookies, and we don't sell or share personal data for advertising.

Signing in with Google asks for three permissions only: your basic profile (name and photo), your email address, and OpenID sign-in. We use them solely to create your account, sign you in and show who is signed in. We don't request access to Gmail, Drive, Calendar or any other Google data.

We don't sell Google user data, don't use it for advertising, and don't let people read it except where you ask us to (support) or the law requires it. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove our access at any time at myaccount.google.com/permissions; deleting your account (section 9) deletes the data we received from Google.

To provide the service you signed up for: your account, scans, results, reports and billing — performance of a contract (Art. 6(1)(b) GDPR).

To keep the service secure and working, prevent abuse, enforce plan limits and handle support — our legitimate interest (Art. 6(1)(f) GDPR).

To issue and keep invoices and meet tax and accounting obligations — legal obligation (Art. 6(1)(c) GDPR).

To measure how our website and signup are used with Google Analytics — your consent (Art. 6(1)(a) GDPR; for storing analytics cookies on your device, the consent the Polish electronic communications law requires). You can withdraw it at any time under Cookie settings, without affecting processing before the withdrawal.

The database is Cloudflare D1, created with the EU jurisdiction: the data is stored in the European Union. The application runs on Cloudflare Workers, Cloudflare's global network, so a request may be processed at the Cloudflare location nearest to you before the data is stored in the EU.

Some sub-processors (section 6) are located in the United States. Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses and, where the recipient is certified, the EU–US Data Privacy Framework.

Cloudflare, Inc. (USA; data stored in the EU) — hosting, database, backups and request logs.

Google LLC / Google Ireland Limited — sign-in with Google (OAuth).

OpenAI (OpenAI, L.L.C., USA / OpenAI Ireland Ltd) — answers your prompts as ChatGPT with web search, and reads your brand's website during onboarding.

Anthropic (Anthropic, PBC, USA) — answers your prompts as Claude with web search.

SearchApi (searchapi.io) — fetches Google AI Mode results for your prompts.

Stripe Payments Europe, Limited (Ireland) and Stripe, Inc. (USA) — payments, subscriptions, invoices and the billing portal.

Google Ireland Limited / Google LLC (USA) — Google Analytics 4, only if you accept analytics cookies: measures visits to our website and the steps of signing up (section 11).

What we send to AI providers is the text of your prompts and the market to answer for (country and language), plus, when you add a brand, the text of its public website. Prompts don't contain personal data unless you type it into them, so please don't. Under their API terms, these providers don't use API data to train their models and keep it for a limited time for abuse monitoring.

To give you results, the service reads public web pages: your brand's website, and pages that AI answers cite, to check whether they mention your brand. It reads them like a search engine crawler, identifying itself, and stores only what it found (for example "mentions brand X"), not the pages.

Account data, brands, prompts, scores, mentions, cited sources, tasks and history: for as long as your account exists.

The full text of each AI answer: 12 months from the answer, then it is deleted automatically. The score, the mentions and the cited sources measured from it stay.

Website analyses from onboarding: a 24-hour cache, deleted automatically after 12 months at the latest.

Sessions: until you sign out or the session expires (7 days without use).

Invoices and payment records: 5 years from the end of the calendar year in which the tax obligation arose, as Polish tax and accounting law requires — also after the account is deleted.

Request logs: a few days, as kept by Cloudflare.

Analytics (only with consent): Google Analytics keeps the event data for 14 months, then deletes it. Its cookies expire after at most 2 years, and are deleted from your browser when you reject analytics.

Backups: the database can be restored to any point in the last 30 days (Cloudflare D1 Time Travel), so deleted data disappears from backups within 30 days.

Export: Settings → Your data → Export JSON downloads one file with your account, brands, competitors, prompts, scans and every result, including the AI answers we still hold.

Deletion: Settings → Your data → Delete account deletes the account and everything under it immediately: brands, prompts, scans, answers, mentions, sources, tasks, report links, usage records and your sign-in data. If you have a paid plan, cancel it in the billing portal first. Invoices are kept as described in section 8.

You can also ask us by email at contact@prolpy.com; we answer within one month.

You have the right to access your data, to have it corrected, to have it deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest. Most of this you can do yourself in Settings; for anything else, write to us.

You have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland (uodo.gov.pl).

Providing data is voluntary, but without an email address from Google sign-in we can't create an account, and without billing data we can't sell a paid plan. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

Necessary: a session cookie that keeps you signed in (and a short-lived signed copy of the session, so pages load faster), and browser storage for preferences such as the brand you last opened and your cookie choice. These are needed for the service to work, so they don't need consent.

Analytics, only with your consent: on your first visit a banner asks whether we may use Google Analytics; nothing is pre-selected, and rejecting is as easy as accepting. Until you choose, and if you reject, the Google Analytics script is not loaded and no analytics cookies are set. If you accept, Google Analytics 4 runs on our pages (never on client report links) and sets its cookies (_ga and _ga_ followed by an identifier) to recognise repeat visits. It records which public pages are visited and the signup steps listed in section 2, never your name, email address, brands or prompts. Google signals and ad personalization are turned off, and Google states that Google Analytics 4 uses IP addresses only to estimate an approximate location without storing them.

Legal basis and withdrawing consent: your consent (section 4). You can change your choice at any time with Cookie settings at the bottom of every page of our website; rejecting stops analytics and deletes its cookies from your browser. Withdrawing doesn't affect processing before it.

Retention and transfers: Google Analytics keeps the event data for 14 months; its cookies expire after at most 2 years. Google may process this data in the United States (section 5).

A client report link shows the report of one brand to anyone who has the link, without signing in. Reports are marked so search engines don't index them. You can revoke a link at any time in Settings; revoked links stop working immediately.

Connections are encrypted (HTTPS), data is encrypted at rest by our hosting provider, access to production data is limited to the people who run the service, and API keys and secrets are kept out of the code.

If you add personal data of others to the service (for example a person's name in a prompt), you are responsible for having a legal basis for it. For customers who need one, we offer a data processing agreement: write to us.

We will update this policy when the service or the law changes. Material changes are announced by email or in the app before they take effect. The date at the top shows the current version.