Profusia AI — Privacy Policy

Effective date: 12 November 2026

The short version — a summary only; the numbered sections give the full detail. What we keep: what you and your workspace put into Profusia, your account, and the records we need to run, secure and bill for the Service, each for as long as Section 1 says. What we never do: sell personal information, use it for advertising, train AI models on your workspace's content, or have our own AI features send a customer's workspace content to an AI service that may train on it (our company's own internal workspace is the one exception, Section 5.3). An assistant you connect yourself receives what it reads under your own terms with its vendor (Section 7). Who else handles it: the outside services listed in Section 3, chiefly Cloudflare, which hosts everything; where your workspace's plan includes in-app AI, the AI providers listed there answer it, and none of them may train on your content. Your rights: some you can use directly in the product, and the rest are one email away (Section 10). Contact: legal@profusia.ai.

This policy explains how Evadaroo & Company, LLC, trading as Profusia AI ("Profusia", "we", "us"), handles personal data when it provides the Profusia service: the product, its websites at profusia.ai and at each workspace's own address, and the connection that AI assistants use (together, the "Service"). It covers what we collect, where it lives, how long we keep it, who else handles it, and how each data-protection right maps to something you can do.

What this document is. This policy is a notice. It explains our practices. It is not a contract and creates no contractual rights or obligations beyond those in our Terms of Service and, where it applies, our Data Processing Addendum (the "DPA"), which governs on what it covers. How our agreements rank against each other is set out in Section 16.2 of the Terms of Service. This policy is our privacy notice and /privacy summarises it; if the two ever differ, this policy is the statement we stand behind, and we will correct the page.

Who we are. Evadaroo & Company, LLC, a Pennsylvania limited liability company trading as Profusia AI, 502 W 7th St, Ste 100, Erie, PA 16502, United States. Privacy questions and requests: legal@profusia.ai. We have not appointed a data protection officer, and we have not appointed a representative in the EU or the UK.

Our role. We are the controller for your account, sign-in and billing relationship with us, and for the records we keep to run and secure the Service: abuse-prevention records (rate limits, sign-up records and the email do-not-send list), our own operator log, our own public-page counts, questions asked of our help assistant, and our own use of audit and delivery records, and of the cookies we set for people opening shared links or portals, to keep the Service secure. For what a customer puts into its workspace (its "workspace content", which our Terms of Service call "Customer Content"), including the people its documents describe, and for the records kept for that workspace (its members' roles and preferences, its audit trail, its open counts, its AI usage record, its notifications, and its members' kept assistant conversations and lists of what they opened), the customer is the controller (under US state laws, the "business") and we act on its instructions as its processor (or "service provider"). Once our DPA forms part of a customer's agreement with us, it governs on what it covers.

---

1. What we keep, and for how long

Where it lives. The Service's data is hosted on Cloudflare: files, profile pictures and our database backups in Cloudflare R2, and everything else in Cloudflare's D1 database. Email you send us is held in our Google Workspace mailbox, and the providers in Section 3 hold what is sent to them. Your browser keeps the cookies and browser storage described in Section 9.

How to read the tables. Where a row gives a period, that is the period the Service is built to apply, usually by a nightly job, and the row says when it works differently. "Until the workspace is erased" means there is no time limit: the record is kept until then, unless another event the row names removes it sooner. Keeping a record is not a promise that it cannot be lost; Section 1.8 says what is backed up and what is not. Anything erased also leaves our backups on the schedule in Section 1.8, and Section 1.9 says what happens when a workspace ends.

1.1 Your account and profile

1.2 What a workspace holds

1.3 Sharing and outside visitors

1.4 AI features

1.5 Security, abuse prevention and email

1.6 Billing and self-serve sign-up

1.7 Our own records and correspondence

1.8 Backups

We back up the whole database every night and keep the most recent 14 nightly copies, in the same Cloudflare account as the Service. Cloudflare also keeps a point-in-time recovery history of the database for up to 30 days, depending on our hosting plan. Something erased from the Service therefore remains in these copies until they age out, within about 30 days at most. We may also take a copy by hand: a nightly backup we download, or an export of the database we make before a restore. A copy like that is kept only on a device or in an account under our control, and is deleted once the recovery or test it was taken for is complete, and in any case within 30 days of being taken — unless we are keeping it for a legal reason (Section 1.7), for example a backup downloaded when a legal hold is placed, which we keep for as long as that reason requires. Something erased from the Service remains in such a copy until the copy is deleted. Uploaded file bytes are not backed up: once a file is purged, or lost, it cannot be recovered. Backups exist to restore the Service after a failure, and we do not use them for anything else except as Section 4 allows. If we ever restore from a backup, we re-apply every erasure made since that backup that our remaining records show; if a failure leaves us unable to tell what was erased since then, we tell the owners of every workspace, so that they can check and erase again.

1.9 When a workspace ends

2. What we do not do

• We do not sell personal information, and we do not share it for cross-context behavioral advertising.
• We do not train AI models on your content, and our own in-app AI features do not send a customer's workspace content to any AI provider tier that may train on it (Section 5; our company's own internal workspace is the one exception, Section 5.3). An assistant you or your workspace connect receives what it reads under your own terms with its vendor, which may differ (Section 7). Questions you type into our public help assistant are not workspace content and may be answered by such a tier, so do not type anything confidential there.
• No advertising and no trackers. We place no advertising pixel, cross-site tracker or analytics script of our own on any page we serve, including the pages we host for customers; the only counting we do is our own (Sections 1.3 and 9). One exception you should know about: our host, Cloudflare, adds a small analytics tag to pages it serves for us; our security settings block it from running, so it collects nothing, and we are switching it off. Two pages load code from another service: the payment page (/pay) loads Paddle's checkout when you go to pay, and the help page at profusia.ai/help loads the Uiia help assistant's script for everyone who opens it (Section 3). If we ever switch on Google's folder picker for Drive sync, Workspace settings will also load Google's own code, and we will update this policy first.
• We do not profile you or make automated decisions producing legal or similarly significant effects.
• We do not send marketing email. If we ever start, we will update this policy first, every message will carry a one-click unsubscribe, and we will get the consent EU and UK law requires. The only email the Service sends is listed under Resend in Section 3.

3. Who else handles personal data

These are all the outside services that receive personal data from Profusia, apart from the AI providers that answer our public help assistant, which, for the help assistant, receive only what is typed into it and are described in Section 5.5 (they also answer our company's own internal workspace, Section 5.3). A sub-processor handles data for us, on our instructions. An independent controller decides for itself how it uses what it receives, under its own notice. Each acts under its own published terms, linked from its name where it has them.

AI model providers that receive workspace content (Section 5):

These are the only AI providers that may receive workspace content. We do not send it to any other — our code leaves every other provider out of a request that carries a customer's workspace content — and before another one begins to receive it we give the notice described below.

Not on these lists, because you direct them: the vendors of the assistants you connect (Section 7), your own Google account if your workspace turns on Drive sync (Section 6), and the people and services you share with (Section 4). The Google Drive sync is the only case in which Profusia signs in to another platform on your behalf; it happens only if an owner turns it on, and it only ever writes.

Changes to these lists. The current list, with the date it last changed, is published at /privacy. Where the DPA applies, we email workspace owners at least 30 days before a new sub-processor, including a new AI provider for workspace content, begins processing workspace content, except where an urgent replacement is needed to keep the Service secure or running, when we tell you as soon as we can.

4. When we share or disclose personal data

4.1 Who we share it with

We share personal data only:

• With the services in Section 3, to run the Service.
• At your direction. When you or your workspace share a link, portal or embed, invite someone, sync to Google Drive, or connect an assistant, the people and services you chose receive what you chose to give them.
• Within your workspace. Its owners and administrators can see your name, email address, role and profile picture; what you published, commented on and changed (the activity feed and the audit log); and how much in-app AI you have used. Other members see your name, picture, what you write and what you change wherever they can see it. Every member, in any role, can also read the workspace's member list (each person's name, email address and role) and the addresses of invitations not yet accepted, for example through an assistant they connect; and every member can see the workspace's outward links: each share link's label and its opens, on the documents that member can see, and each named portal's visitors, with the names they typed and when they came. Nothing in the product shows anyone else in the workspace your kept assistant conversations or your list of what you opened, though the customer can obtain your kept conversations from us where it is legally required to produce them (Section 1.4).
• To comply with law. We disclose data in response to a subpoena, court order or other legally binding request, or to establish, exercise or defend legal claims, and we report and preserve material as US law requires, including reports to the National Center for Missing & Exploited Children. For a legally binding request for workspace content, we tell the affected customer before we disclose where the law allows it and doing so would not put anyone at risk or compromise an investigation, and otherwise as soon as that becomes lawful and safe; we disclose only what the request requires. We do not give notice before making a report of child sexual abuse material.
• To protect people and the Service. Where we believe in good faith that it is needed to prevent serious harm to someone, to investigate or stop fraud, abuse or a security incident, or to enforce our Terms of Service and Acceptable Use Policy, we may disclose the data needed for that, including to law enforcement (for workspace content, only as Section 16.13 of our Terms of Service allows), and we tell the affected customer where that is lawful and safe.
• To our professional advisers. Lawyers, accountants and insurers may receive data under a duty of confidentiality, as needed to run the business.
• In a business transfer. If Evadaroo & Company, LLC or the Profusia AI business is merged, acquired, reorganized, passed to a successor (including under the company's own succession arrangements) or sold, personal data may transfer with it. It remains protected by this policy unless you are told otherwise and given the chance to delete your data first.

We do not sell personal information or share it for cross-context behavioral advertising.

4.2 Who at Profusia can see your data

Profusia is run by one person, who holds administrative access to the production database, storage and backups and can read them. Workspace content is not encrypted from us.

• What the operator console shows: each workspace; its members' names and email addresses, their roles, and when each joined and last signed in; the plan and billing status, including any refunds and chargebacks; usage and each member's AI spend; the AI usage record, which names the documents asked about; the names of documents we have taken down, with the reasons; the addresses on pending invitations and reset links; our notes about the workspace; and the do-not-send list of email addresses. It does not show the content of documents, comments or conversations.
• When we open workspace content: only (a) at the customer's or a user's request for support; (b) to investigate a security incident or a reported breach of our Acceptable Use Policy; (c) where the law requires, or as Section 16.13 of our Terms of Service allows — to respond to legal process, to establish, exercise or defend a legal claim, or to prevent death or serious physical injury; or (d) to keep the Service running or restore it from a backup, where that cannot be done without opening it — and in each case we open only what that purpose needs.
• What we can do, and how it is recorded: suspend a workspace; take down a single document (its workspace's members are shown the reason); create a password-reset link to hand to an account holder (who is emailed when it is used, where we can send one — and, for an account that belongs only to self-serve workspaces nobody is paying for, only if sign-up proved its address); rotate a workspace's access key, which gives us the new key, and an access key acts for the whole workspace; create an invitation that makes whoever accepts it an owner of a workspace; disconnect assistants; place or release a legal hold, which holds every erasure of the workspace and of anything or anyone in it, including the trash purges and person erasures asked for inside it, and changes nothing else in it (Section 1.9); mark a suspended workspace for erasure once its agreement has been terminated and the 30-day export window has passed, or withdraw that mark; and download a backup. Every one of these is recorded. Each is written to our operator log; and each that concerns one workspace is also written to that workspace's own audit trail, which its owners and admins can read — except a legal hold, which we record only in our operator log and our own audit trail, because we tell an owner about a hold only where that is lawful and safe. A backup download is also written to our own audit trail, naming who downloaded which night. Viewing what the operator console shows is not recorded. Reading or changing the database or storage directly with our host's own tools (its dashboard, command-line tools or programming interface) is also possible, and is not recorded by us; nor is a restore from a backup, which we would carry out with those tools.
• Our internal operations console (Evadaroo HQ) can do the same, except download a backup, release a legal hold, mark a workspace for erasure, reinstate a suspended workspace while anything in it is waiting to be erased, or create anything that would give someone access to our operator console, and what it does is recorded in the same way.
• A person's kept assistant conversations we open only at that person's request, or on grounds (b) to (d) above; and if the customer that runs the workspace is legally required to produce them, we may provide them to it (Section 1.4).
• The AI coding tools we build Profusia with (Anthropic's Claude Code) run on Anthropic's systems. The credential they deploy with can also read production data. A written rule forbids them to read workspace content; this is a policy control, not a technical one.

Beyond what this section describes, no screen, listing or export shows your workspace content to anyone at Profusia, and we do not read it. To keep the Service running we do look at operational records, such as counts, sizes, timestamps, error records and configuration.

5. AI features, and what reaches AI providers

5.1 What is available

The in-app AI features that read workspace content — Ask a document; Discuss a site, space, project or card; the Navigator's ask; Draft and Break it down; Say what you did; filing proposals; Propose a turn; Set this page; the two plan checks (reading a plan as its recipient would, and checking it against its own documents); and Build — run in a workspace only where its plan includes in-app AI. A Free trial includes it; the Free plan does not. During a Free trial they use only our lower-cost models. Each person may have one in-app AI request in progress at a time. An owner or admin can restrict them (Section 5.6).

5.2 How those features work

When one of these features runs, the text it needs is sent to one of the AI providers listed in Section 3 as receiving workspace content — today Anthropic; Cloudflare Workers AI is listed there too and receives nothing until we connect it, and then only where someone picks one of its models or we place it in a feature's order; Amazon Bedrock is listed there too, is never used by default, and receives workspace content only where someone picks one of its models or we place one in a feature's order — in the request that produces the answer. That can include document and card text, comments with their authors' names, outlines of a site or project, and the earlier turns of the conversation. If the first provider is unavailable, the same request is retried with the next one in the order we have configured, which is always one of the providers listed there. Except for Amazon Bedrock, which we call in Amazon Web Services' US Regions, we do not choose, or promise, the country in which a provider processes a request: each processes it on its own infrastructure (Section 13). The models are given no tools: a model answering your question cannot act on your workspace, and Build proposes changes and writes nothing until a person accepts them (a change to an existing document, or a link or portal, is always accepted one at a time). Conversations are kept as Section 1.4 describes.

5.3 Training tiers

Some providers' free tiers may use what they are sent to improve their products, and may let their staff read it. A customer's workspace content is never sent to an AI provider tier that may train on it, no customer workspace is opted in, and a customer has no way to opt itself in. The only workspace for which we accept that trade today is the company's own internal workspace, where every screen that uses such a tier says so. Our code enforces this rule on every request that carries a workspace's content (the help assistant in Section 5.5 reads none), and the check fails closed: any provider that our own list of providers marks as one that may train is left out of the request unless the workspace asking is the one we accepted the trade for, and if no other provider can answer, the request is refused rather than sent. Naming a workspace in our own configuration is the only way past that check, and we name only the company's own internal workspace.

5.4 Spoken questions

Spoken questions are not available in a customer workspace: none of the AI providers that receive workspace content can hear one. If that changes, we will update this policy first. Wherever they are available, nothing records without you pressing the button (there is no wake word and no open microphone), we store no recording, and the audit log notes only that a question was spoken and how long the clip ran — never the audio or the words. Answers are read back by your own browser's speech synthesis, so no hosted voice service is involved.

5.5 The help assistant

The help assistant — the question box on /help, the "Ask about Profusia" assistant in Workspace settings and on All sites, and the Uiia assistant on profusia.ai/help — answers from Profusia's own published help and reads no workspace content. Anyone can use it, on any plan. What you type into it, with the last few turns of the conversation, may be answered by AI providers' free tiers, which may keep what they are sent and use it to improve their models, and may process it outside the United States, so type nothing confidential. For the question box and the "Ask about Profusia" assistant, we do not store your question; our usage record notes only that one was asked, which model answered and what it cost. Uiia is a separate product of our own company; this policy does not yet set out what Uiia keeps of a conversation, and you can ask us at legal@profusia.ai.

5.6 What providers keep, and your controls

Each provider handles what it receives under its own API terms, and most keep API inputs for a limited period to monitor abuse. We have not negotiated zero-data-retention terms with any provider. An owner or admin can switch off every model for the workspace in Workspace settings › AI access (and, on plans with groups, for a group or a person), and an owner can stop conversations being kept.

6. Google Drive sync (optional)

If a workspace owner connects it, Profusia copies plans and documents into a Google Drive account the owner connects, so a NotebookLM notebook or a shared folder stays current.

• What is copied. Each night, what follows is copied into the files the owner set up. Each copy is made from the whole workspace as its owner sees it, so it can include documents and cards that some members cannot see in Profusia. Once in your Drive, the copies are governed by your agreement with Google, and anyone who can open them there can read them.
  • The chosen projects: each card's name, status and who last changed it, its notes, its fields (including names typed into them, such as Owner) and its checklist; the last three comments on each card, with their dates, their authors' names and their full text; and the names of the documents attached to it, with who last changed each and the note left with that change.
  • Documents, where the owner chose them: the text of the workspace's written documents (Markdown, plain text, web pages, CSV and JSON files, or those in one folder), with each one's name, description and facts (owner, type, state and review date).
  • A Daily brief across all the workspace's projects: what is waiting on the owner, what was decided, what is stuck, and a 14-day history of what changed and who changed it, one dated line per change, including card comments (up to 160 characters of each) and the decisions recorded about a project's direction, with their reasons.
• The authorization Google issues is stored encrypted at rest under a key held outside the database. It is never shown back to you or anyone else, never included in an export or any API response, and erased with your workspace. Google's folder picker is not switched on today; if we switch it on, choosing a Drive folder will give your browser a one-hour access token, limited the same way, so the picker can open.
• Scope. It uses Google's per-file (drive.file) scope, so it permits access only to files Profusia itself created. Google enforces that, not us. Nothing is read from your Google account except its email address, which we show so you know which account is connected, and, once the folder picker is on, the name of the folder you pick.
• Connecting is owner-only and requires a person, not a machine credential. Disconnect at any time: we ask Google to revoke our access, and delete our record of it; you can also remove Profusia in your Google account settings. What is already in your Drive is yours and stays.

7. Assistants you connect (MCP)

You may connect an assistant, for example Claude or ChatGPT, over the Model Context Protocol (MCP).

• Who it acts as. An assistant a person connects with their own sign-in acts as that person, with that person's role and only what they can see. An assistant connected with a workspace access key acts for the whole workspace and is not limited by roles. Either way, everything it does, including acts prompted by instructions it read in a document, comment, page or dataset, is the Customer's act under our Terms of Service. A workspace's owners can disconnect the assistants anyone there has connected, and its admins those of members and viewers.
• What it reads leaves Profusia. When the assistant calls Profusia, what we return goes to that assistant and its vendor, including the text of documents, plans and comments it can see and the names in them. That vendor handles it under its own terms and privacy policy, and under your own agreement with it, not ours. Connecting an assistant is your instruction to send it that content.
• What you type into that assistant's own client is governed by that vendor's privacy policy, not ours. We see only the calls the assistant makes to us.
• The audit log records which assistant made each change, and the person or key it acted for.

8. If you open a shared document or a portal

If a workspace sends you a link to a document, or a portal onto part of its site:

• The workspace that sent it decides what you see and is the controller of its content. For anything about the content, including a request to correct or remove information about you, contact that workspace; if you write to us instead, we will pass your request on and tell you we have.
• Cookies. We set a first-party cookie so the page works: pf_seen (up to 90 days) lets a shared document tell you what changed since you last opened it, a portal session lasts up to 90 days, and a password-protected link stays open until you close your browser (Section 9).
• Counting. Opens are counted per document, per link and per named portal visitor, per day, with no IP address or device identifier. So the workspace that sent it can see whether and when a link labelled for you, or a portal you entered under your name, was opened, and not only the person who sent it: any of its members can see this.
• A name you type into a portal is shown to that workspace, with when you first and last visited and the days you opened it. It is not verified. To have it removed, ask that workspace.
• Links work like keys. Anyone who holds a share link, portal link or live-data address can open what it points to until it is revoked or expires. If a link is posted publicly, search engines may index the page, and a chat or document tool you paste it into may fetch its title and a short preview.
• Pages can run code. A page a workspace publishes can contain scripts that run in your browser. Open pages only from workspaces you trust.

People described in a customer's documents. If a customer's workspace contains information about you, that customer is the controller and we act only on its instructions. Contact the customer; if you write to us, we will pass your request on and tell you we have.

9. Cookies and browser storage

We set first-party cookies, and use your browser's own storage, only to provide what you are using:

Browser storage. Your browser's local storage keeps your look and view preferences, a 24-hour upload link if you use one, a 24-hour console link an assistant gave you once you open it, and an access key if you paste one into a page that asks for it. It stays on your device, and clearing your browser data removes it. Your browser's session storage, which is cleared when you close the tab, briefly holds working state for the page you are on: for example an assistant conversation you have not kept, an undo you can still take, the last view you opened, and a key you pasted for that tab only.

Why there is no banner. We use only first-party cookies and browser storage needed for features you use, so we do not show a consent banner. None is used to track you across other sites or for advertising. The Cloudflare tag described in Section 2 is blocked from running.

Other services' code. On /pay, Paddle's checkout sets its own cookies when you choose to pay, under Paddle's privacy notice. On profusia.ai/help, the Uiia assistant's script runs in your browser; we have not yet confirmed what, if anything, it stores there.

Counting. We count opens of documents and visits to our public pages (the marketing site, the guides, the help topics, the templates, and the trust and legal pages) as numbers per day: per document, per link and per named portal visitor for opens, and per page group and referring site for public pages, where the referring site is reduced to a name from a short fixed list (for example a search engine or an AI assistant) or to none. No IP address, browser detail or query string is stored with either count, and the public-page count never includes a page on a customer's own workspace address. A portal visitor who gave their name, and a link made for one person, do show the workspace's members when it was opened. IP addresses are kept for about two days, only to limit abuse (a self-serve sign-up request keeps its network address longer, Section 1.6).

10. Your rights

How to ask. Email legal@profusia.ai. We confirm receipt within 10 business days and answer within 30 days, extendable once by a further 60 days where a request is complex, in which case we tell you. We verify a request before we act on it, usually by emailing the address on the account. Where that is not enough to be sure, or there is no account, we may ask for other information that shows the request is yours, and we will not act on a request we cannot verify. We use what you give us for verification only for that. You may ask through an authorized agent (Section 12). We do not charge for a rights request unless it is manifestly unfounded or excessive.

If you are a user in a customer's workspace, or anyone whose information is in one: for the workspace's content (documents, projects, comments, datasets) and its records about you, such as your notifications, contact that customer, which controls them. If you write to us instead, we will pass your request to the customer and tell you we have. For your sign-in account itself (your email address, password, name, photo, timezone and sessions), we are the controller and handle your request ourselves. Your kept assistant conversations and your list of what you opened are the workspace's records, but only you can see them, so we handle requests about them with you directly, on the workspace's behalf.

11. Legal bases (GDPR and UK GDPR)

Where the GDPR or the UK GDPR applies to our own processing, we rely on:

• Contract. Where you are our customer, or act for it: creating and running your account and workspace, the features you switch on (including Google Drive sync), billing through Paddle, support, and the account messages that protect your sign-in. For people a customer invites, who are not party to our contract, we rely instead on our and the customer's legitimate interest in providing the workspace the customer asked for: your account, its security messages and, where your workspace has turned it on, notification email you can switch off in Personal settings.
• Legitimate interests. Keeping the Service secure and available, and preventing abuse: rate limits that briefly use your IP address, checks on self-serve sign-ups, one free trial per person, and the email do-not-send list. Also keeping the audit trail and our own operations records; delivering an invitation a workspace member asked us to send; providing a shared document or portal to the person it was sent to, including the cookies in Section 9 and the open counts the sender sees; understanding in aggregate how people find our public pages; investigating reports of misuse, which can mean opening the reported content; and establishing, exercising or defending legal claims. We have weighed these against your interests: each uses the least data that works; IP addresses used to limit abuse are kept for about two days, and a self-serve sign-up request that is never confirmed keeps its network address for about 35 days (90 days from a suspension, Section 1.6); the one-trial fingerprint (400 days) and the do-not-send list (until you ask us to remove an address) are kept longer because that is what they are for; every period is stated in Section 1; and none of it is used for advertising. You can object at legal@profusia.ai.
• Legal obligation. Tax and accounting, responding to lawful requests, and reporting and preserving material where the law requires it.
• Consent. Only where we ask for it; you can withdraw it at any time, without affecting what happened before.

An email address is required to have an account; without it we cannot create one. Everything else in your profile is optional. For workspace content processed on a customer's instructions, the customer's own legal basis governs; ours is our contract with the customer.

12. California and other US state privacy laws

We do not sell personal information and do not share it for cross-context behavioral advertising, so there is no "Do Not Sell or Share" mechanism because there is nothing to opt out of. We do not use or disclose sensitive personal information for purposes beyond those permitted without an opt-out.

Your rights, whether or not a law requires them. Several state privacy laws apply only to businesses above size thresholds we may not meet. Whether or not a state privacy law applies to us, we honour requests to know, access, correct and delete, as Section 10 describes and subject to the exceptions those laws allow, and we let you appeal a decision. We do not discriminate against anyone for exercising these rights. Use legal@profusia.ai for all of it, including an appeal; we will respond to an appeal within 45 days with our reasons.

Do Not Track and Global Privacy Control. We do not track you across other websites. Apart from Paddle's checkout on the payment page, which runs under Paddle's own privacy notice, and the Uiia assistant on profusia.ai/help (Section 9), we do not let third parties do so through the Service, so a browser's Do Not Track or Global Privacy Control signal has nothing further for us to switch off. We treat a Global Privacy Control signal as a valid request to opt out of sale and sharing, which we do not do in any case.

Authorized agents. You may make a request through an authorized agent. We may ask the agent for your signed permission, and ask you to confirm your identity with us directly.

What we collect, by category:

How long each is kept is in Section 1. We do not sell or share any of it.

Where we act for a customer. Where we process personal data on a customer's behalf, we act as a service provider / processor under these laws, on the terms in the DPA, and we do not retain, use, or disclose it for any purpose other than performing the Service, keeping it secure, complying with the law, and the other disclosures in Section 4.1 that these laws allow a service provider to make.

13. Where processing happens, and international transfers

We are a US company, and the Service is run from the United States. Cloudflare's network is global: a request is answered from a Cloudflare location near you, and our database and file storage sit in locations Cloudflare chose when they were set up. They are not pinned to a region, and we do not offer a regional-pinning guarantee. The outside companies in Section 3 are US companies, except Paddle (UK and US). Where an AI provider processes a request is not pinned to one country: Anthropic and Cloudflare Workers AI each process it on their own infrastructure, which may be outside the United States. Amazon Bedrock is the exception: we call it in Amazon Web Services' US Regions, and it processes a request there. The AI providers that answer our public help assistant may also process a question in other countries (Section 5.5).

• Workspace content from the EEA, the UK or Switzerland is transferred under the Standard Contractual Clauses in our DPA, with the UK Addendum and the Swiss amendments, where the DPA applies.
• Your own account data you provide directly to us in the United States when you sign up or sign in from abroad. We protect it as this policy describes.
• We are not certified under the EU-US Data Privacy Framework, and we have not appointed a representative in the EU or the UK.

14. Security

The security half of this picture is at /trust. In short:

• most of the product's reads and writes of a workspace's data are designed to go through one workspace-scoping layer; paths that query the database directly for one workspace are designed either to name that workspace in the query or to check a record's workspace before using it (file and dataset delivery work the second way), and the jobs that must work across workspaces by design — among them sign-in and credential resolution, rate limiting, billing, the nightly jobs and the operator console — are written separately; an automated test checks that one workspace cannot reach another's data;
• each workspace is served from its own subdomain;
• every sign-in, link and access credential is stored only as a hash, except the address of a live data table, which is itself the key that reads it and is revoked by rotating the table; the one third-party credential, Google's, is encrypted (Section 6);
• traffic is encrypted in transit, and Cloudflare encrypts what it stores; workspace content is not otherwise encrypted from us (Section 4);
• delivered pages run under a content security policy that limits what they can load and send, and never execute on our servers, although a page's own scripts run in the reader's browser and, on a signed-in member's screen, act with that member's permissions, so publish and open only pages you trust;
• privileged actions are recorded in an audit trail the product never edits, kept 400 days, which owners and admins can export.

No way of storing or sending data is completely secure. These measures reduce risk; they do not guarantee that the Service is free of vulnerabilities or that an incident cannot happen.

What we do not have yet: two-factor sign-in, for anyone; the operator console is protected by a password, and can also be reached with our platform key and by our own operations console's signed requests. Sign-in sessions last 30 days.

What we do not claim: no SOC 2 report, no ISO 27001, no HIPAA attestation, no third-party penetration test — none in progress. Isolation is logical, not physical. We say so here and at /trust rather than implying otherwise.

Reporting a vulnerability. If you believe you have found a vulnerability, please tell us at security@profusia.ai (see also the contact published at /.well-known/security.txt per RFC 9116). We do not run a paid bounty program. Our vulnerability disclosure policy is Section 4.3 of our Acceptable Use Policy: research that follows its rules is authorized by us, and we will not bring a legal claim over it. That authorization binds only us and cannot authorize testing of anyone else's systems.

15. Security incidents

If we confirm a security incident affecting personal data we hold, we will tell affected customers as Section 3.7 of our DPA sets out, and tell affected individuals and regulators where the law requires and within the time it requires. Attempts that do not compromise personal data (blocked sign-ins, pings, port scans, denial-of-service attempts) are not incidents. Telling you about an incident is not an admission of fault.

16. Children

Accounts are for people aged 18 and over. The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18. A customer may share a page with anyone and is responsible for what it shares with a minor. If you believe a child has given us personal information, write to legal@profusia.ai: we will delete account data ourselves, and tell the workspace owner about anything inside their workspace so they can remove it.

17. Changes to this policy

We will post any change here with a new effective date. We keep every earlier version and will send any of them on request. For a material change, we will email each workspace owner at least 30 days before it takes effect. Where a change is required by law, or is needed to address a security risk or an active harm, it may take effect sooner, with notice as soon as practicable. Other changes take effect when posted. We will not use personal data we already hold in a materially different way from what this policy said when we collected it without your consent, where the law requires consent.

18. Contact

• legal@profusia.ai — privacy questions, rights requests, appeals, and reports of misuse.
• security@profusia.ai — vulnerability reports.
• support@profusia.ai — help with the product.

Evadaroo & Company, LLC · 502 W 7th St, Ste 100, Erie, PA 16502 · USA