Privacy
What Profusia stores, where it lives, how long it is kept, who can see it, and how each data-protection right maps to something you can actually do. The security half of this picture is at /trust.
About this page. This page summarises our Privacy Policy at /legal/privacy, in force since 12 November 2026; where the two differ, the Privacy Policy governs. It describes how Profusia works on the date at its foot; when that changes, we update this page promptly and its date moves. It is a notice, not a contract.
Legal documents, in force since 12 November 2026: Terms · Privacy Policy · DPA · Acceptable use · Refund Policy
Who we are
Evadaroo & Company, LLC, a Pennsylvania limited liability company trading as Profusia AI, 502 W 7th St, Ste 100, Erie, PA 16502, USA. Privacy questions and requests: legal@profusia.ai. We have not appointed a data protection officer, and we have not appointed a representative in the EU or the UK.
Our role. We are the controller for account data — your account, your sign-in and the billing relationship — and for the records we keep to run and secure the service: sign-up, security and abuse records, the email do-not-send list, our own public-page counts, and questions asked of our help assistant. For the documents and data a customer puts into its workspace, that customer decides what happens to them and we act on its instructions. Our Terms of Service and Data Processing Addendum set out those instructions as a contract.
What we store, where, and for how long
Everything Profusia stores is on Cloudflare (Workers, R2, D1); copies of particular things also live with the outside services listed further down — for example the email we send, and the email you send us — and, when our operator takes a copy of the database by hand, on a device or in an account under our control (see “Backups”). Where a row gives a period, the service enforces it, usually by a daily job. Where a row says “until the workspace is erased”, no job removes it by age; the row says if anything else removes it sooner. Anything erased also leaves our backups on the schedule under “Backups”.
Your account and profile
| Data | Where it lives | How long |
|---|---|---|
| Your account: your email address, your name if you give one, and your password, stored only as a salted hash | Cloudflare D1 | Until the account is erased. Removing you from a workspace ends your access there but does not delete your account. An owner can erase anyone from a workspace except its last owner, and an admin can erase members and viewers, except while the workspace is suspended or held, or in the few days after that ends (see “When a workspace ends”), when they can still be removed; nobody can erase themselves in the product. Erasing you deletes your account unless you belong to another workspace (and where something still refers to it, reduces it to an anonymous placeholder). You can also ask us to delete your account (see “Your rights”). |
| Your profile picture, if you add one | Cloudflare R2 (the image) and D1 (a pointer to it) | Kept until you replace or remove it; either one deletes every stored copy at once. Shown only to signed-in people in the workspaces you belong to. Erased with your account. A browser that has shown it may keep a private copy for up to a week. |
| Your timezone, if you choose one instead of your device's | Cloudflare D1, and a cookie in your browser | Kept until you change it or go back to automatic. Erased with your account. The audit log records that it changed, never the zone itself. |
| Changes to your sign-in email: the old and new address, and when the change was asked for, confirmed, undone or cancelled | Cloudflare D1 — the confirmation and undo links stored only as hashes | A confirmed change is kept while your account exists: it keeps an address you gave up from being claimed by someone else for 30 days, and keeps your earlier activity attributed to you. A request that is never confirmed is deleted the next time you ask for a change once its link has been expired for a month, and in any case when your account is erased. All of it is erased with your account. |
| Your acceptance of our terms: each time you tick a box or press a button that accepts them — when you open or join a workspace, when you are asked at sign-in, and when you check out — which box it was, the edition of the terms, a fingerprint of the exact text of each document it covers (for an owner, the Terms of Service with the Acceptable Use Policy, Refund Policy and Data Processing Addendum that form the agreement with them, and the Privacy Policy you confirm you have read; for anyone else, the Acceptable Use Policy; at checkout, the Terms of Service and the Refund Policy), which dispute clause, where in the product, when, and the sign-in email you had then | Cloudflare D1 | Kept with the workspace it was for, until the workspace is erased. Erasing you from that workspace deletes your records there; its audit log keeps its own line about each acceptance for that log's 400 days. The workspace's owners and admins can export its record. |
| Sign-in sessions, access keys, connected-assistant tokens and share links | Cloudflare D1 — the secret itself stored only as a hash | The secret stops working when it expires or is revoked. Sign-in sessions last 30 days; access keys, connected assistants and share links last until they are revoked or rotated, unless an expiry was set. The record of each is kept until what it belongs to (the account, the document or the workspace) is erased: for a sign-in, the user-agent string of the browser it began in (which names the browser, its version, the operating system and the type of device) and when it was last used; for a share link, its label. |
| Your own shortcuts and settings: what you pin, the documents you follow, your working preferences and notification switches | Cloudflare D1 | Until you change or remove them. Only you can see them. Erased when you are erased from the workspace, or when the workspace is erased. |
| Your own list of what you recently opened in a workspace | Cloudflare D1 | 90 days from each visit, then swept by a daily job. Only you can see it, and you can clear it at any time. Erased with you or the workspace. |
| Your notifications in the app | Cloudflare D1 | Until you are erased from the workspace, or the workspace is erased. |
What a workspace holds
| Data | Where it lives | How long |
|---|---|---|
| Documents you publish, and every earlier version of them | Cloudflare R2 (the files) and D1 (their records, plus a text index so search can read inside documents) | Until you delete them. Deleting moves a document to the workspace trash, and nothing is erased until someone purges it or the workspace itself is deleted. A purge takes effect about three days after it is confirmed (unless the workspace’s access key explicitly asks for it to happen at once), and a restore cancels it until then; the document’s comments, open counts and share links go with it. A single earlier version cannot be deleted on its own, only the whole document. The search index follows the document: it leaves search when the document is trashed and is erased when the document is erased. Our database backups keep the document’s records, but not the file itself, until they age out (see “Backups”). |
| Datasets behind live pages | Cloudflare D1 | Until you delete them (the same trash-then-purge rule). The data address behind a live page answers anyone who holds it until the dataset is rotated; a table built from a project answers only its own page and signed-in members. |
| Projects, cards, spaces, sites and collections: their names, notes, fields (including names typed into them, such as a card’s Owner), checklists, and the context and goals written for them | Cloudflare D1 | Until deleted and purged (the same trash-then-purge rule), or until the workspace is erased. A card’s history is read from the audit log, and a project’s record of how its direction changed is kept until the workspace is erased. |
| Comments, chat messages and discussions | Cloudflare D1 | Until the workspace is erased, or the document, card or space they are on is erased. Deleting a comment hides it at once, but its text stays in our database until then; ask the workspace’s owner if you need it erased sooner, and we act on the owner’s request. If a person is erased, what they wrote stays in the conversation, shown as written by “A removed member”. |
| Invitations and password-reset links: the address an invitation was made for, who made it, the role and when; for a reset link (one asked for with “Forgot your password?”, or made in People or by our operator), which account it was for, who asked for it and when — the link itself stored only as a hash | Cloudflare D1 | Until the workspace is erased, whether or not the invitation or link was used. Erasing the person removes the ones that name them. If you were invited and do not want your address kept, ask the workspace that invited you, or write to us. |
Sharing and outside visitors
| Data | Where it lives | How long |
|---|---|---|
| Open counts for documents, share links and named portal visitors | Cloudflare D1 | Counted per day for each document, each share link and each named portal visitor, with no IP address or device identifier, and kept for two years (730 days), or erased sooner with the document. So a link the sender labelled for one person, or a named portal visitor, shows the sender whether and when it was opened. |
| Public-page visit counts: the UTC day, a page group (for example the home page, one guide or the help pages), the referring site reduced to one word from a short fixed list (for example a search engine or an AI assistant) or to none, and a count | Cloudflare D1 | 400 days, then swept by a daily job. Nothing else is stored with the count — no IP address, user agent, cookie, page address, query string or referrer URL. Pages on a customer’s own workspace address are never counted here. |
| Portal visitors (named portals only): the name a visitor typed, when they first came in and were last there, and their session (as a hash) | Cloudflare D1 | The session works until the visitor or the portal is revoked, or for 90 days. The typed name and the first and last visit stay with that workspace until the portal’s site or the workspace is deleted. The name is self-reported and unverified, and no IP address or device fingerprint is stored with it. To have your name removed, ask the workspace that sent you the portal. |
AI features
| Data | Where it lives | How long |
|---|---|---|
| AI usage record: for each request, the asker’s email address (or “public”, for the help assistant), the feature, the item asked about, the model that answered, the tokens and the cost — never the question or the answer | Cloudflare D1 | 90 days, then swept. Erasing a person removes their address from it. Daily spend totals with no personal detail are kept for 400 days. Separately, the workspace’s audit log records each in-app AI request — who asked, about which document, project or other item, which model answered, the tokens, and whether the question was spoken — never the question or the answer; those lines are kept for the audit log’s 400 days, and its owners and admins can export them. |
| Your conversations with the in-app assistant, where those features run (see “AI features” below): your questions, its answers and what it read to answer them | Cloudflare D1 | On by default. Kept until 90 days after the last exchange, then swept by a daily job. You can delete any of them, or all of yours, at any time, and an owner can switch the keeping off for the workspace, which stops new ones being kept. No screen, listing or export shows them to anyone else, workspace administrators included, and we open them only at your request or on the other grounds under “Who at Profusia can see your data”. They are in our backups, and their earlier turns are sent back to the AI provider with each new question. No recording of a spoken question is kept; where conversations are kept, the words the assistant heard are kept as your question. Erased with the workspace, and with you if you are erased from it. |
Security, abuse prevention and email
| Data | Where it lives | How long |
|---|---|---|
| Audit log (who did what, when) | Cloudflare D1 | 400 days, then swept by a daily job. Entries usually name a person by an internal id, but some name them by email address; entries are kept for their full 400 days even if the person is later erased, because the log has to show what happened. Erased with the workspace. Owners and admins can export it. |
| Security counters: the network (IP) address a request came from — and, for wrong passwords and password-reset requests, the email address tried; for sign-ups, a one-way fingerprint of it; for some limits, your account — with a count; and, for the plan’s monthly allowances, the workspace’s count this month of assistant calls (and each person’s own count) and of live-table updates | Cloudflare D1 | About two days, then swept by a daily job. Used to slow down repeated attempts — sign-in and password guesses, link and password-link guesses, sign-ups, assistant registrations, help questions, and repeated changes to an account (its profile, picture, email or preferences) — and to apply the plan’s allowances. The monthly allowance counts are kept until shortly after their month ends (at most about 40 days), and a person’s own count of assistant calls is shown to them in Plan & billing. (A self-serve sign-up request keeps its network address longer, as its own row says.) Cloudflare also processes IP addresses to deliver and protect the service. |
| Email delivery records: the address a message went to, what kind it was, and whether it was delivered, bounced or reported as spam | Cloudflare D1 | Kept until the workspace the message was for is erased (an unused sign-up confirmation: about 35 days); erasing a person replaces their address in it. An address that hard-bounces or reports a message as spam goes on a do-not-send list that we keep indefinitely, even after the account is erased, so we never write to it again; write to legal@profusia.ai to be taken off it. |
Billing and self-serve sign-up
| Data | Where it lives | How long |
|---|---|---|
| Billing status: which plan a workspace is on, how many seats, monthly or yearly, its status and renewal or end date, and Paddle's reference numbers for the customer and the subscription — never a card number | Cloudflare D1 | Kept while the workspace exists, and erased with it — after any subscription still running is cancelled at Paddle, and not before. A log of each notice Paddle sends us (what kind it was, Paddle’s reference for it, the workspace’s internal id and what we did with it), including any refund or chargeback Paddle tells us about, is kept indefinitely as our own financial record, including after the workspace is erased; while the workspace exists, it and the workspace’s audit log are how we see whether it has already had its one first-payment refund, and it holds no Paddle reference for the paying customer, and no name, email or payment detail. Payment and tax records are held by Paddle, our reseller and Merchant of Record, under its own privacy notice. |
| Sign-up requests: the email, the name and the workspace address you typed, the network address the request came from, and which Terms you accepted and when | Cloudflare D1 | If you never use the confirmation link, the address you asked for is free again after 24 hours, and the request's own copy of your name and email is deleted within about three days. The record that we sent you the confirmation — your email address, and whether it bounced or was reported as spam — is kept for about 35 days, because it is how the month's sending limit is counted and how a late bounce or complaint is matched to an address; the network address the request came from is kept for the same 35 days, so abuse of the confirmation email can be traced to where it came from rather than blocking everybody. A record that a request was made (no name, no email, no network) is kept for 90 days. Our own operations log keeps a line for each request — the workspace address you asked for and your email's domain (the part after the @), never the address itself — and that log is kept indefinitely, including after the workspace is deleted. If we suspend a request because it was used for abuse, its email, name and network address are kept as evidence for 90 days from the suspension and then deleted the same way, and the workspace address it asked for is held back from being registered again for ten years. If you do use the link, your email moves to your account, the network address is deleted at once, and the record of what you accepted stays with the workspace until it is deleted — and so does the record that we sent you the confirmation, like every other message Profusia sent for that workspace, erased with it. To check that an email address can receive mail, we look up its domain, never the full address, with Cloudflare's public DNS service. |
| Sign-ups you have completed: a one-way fingerprint of your email address (the same for its +tag and Gmail-dot spellings), how many workspaces it has opened through sign-up and how many started on a trial | Cloudflare D1 | Kept for 400 days after your last sign-up, so a free trial is one per person. It is not deleted when a workspace is, because that is exactly what it is for. It is not your address, but anyone holding it who already guessed your address could confirm the guess, so we treat it as personal data; it is never shown to anyone. |
Our own records and correspondence
| Data | Where it lives | How long |
|---|---|---|
| Our operations records: notes our operator keeps about a workspace, and a log of the operator’s own actions (for example applying a plan, suspending a workspace, placing a legal hold, taking a document down or downloading a backup) | Cloudflare D1 | Notes are erased with the workspace. The operator’s log is kept indefinitely as our record of how we ran the service; it records what was done and to which workspace, with the reason given for a takedown, a suspension or a legal hold, and carries no document content. You may ask for any notes about you. |
| Messages you send us at legal@, support@, billing@, security@, hello@ or notifications@profusia.ai (including any reply to an email the Service sent you), and our replies | Google Workspace (our mailbox) | Kept as our business record; we do not delete them on a schedule. Ask us to delete yours and we will, unless we need to keep it — for example to show how we handled a rights request, or for a legal claim. |
| Content and records preserved for a legal reason | Where they already are | Where the law requires it, or for an investigation, legal process or a claim, we may keep content and records beyond the periods on this page, for as long as that requires, and disclose them to law enforcement, the National Center for Missing & Exploited Children or a court. A workspace we must preserve is held, not erased, until the hold ends (see “When a workspace ends”). Where it is lawful and safe, we tell the workspace’s owner. |
Backups
Every night we copy the whole database and keep the most recent 14 nightly copies, in our storage in the same Cloudflare account as the service. Cloudflare also keeps a point-in-time recovery history of the database for up to 30 days, depending on our hosting plan. So something erased from the service stays in these copies until they age out, within about 30 days at most. Uploaded file contents are not backed up: once a file is purged, or lost, it cannot be recovered, so keep your own copy of anything you cannot afford to lose (the export under “Your rights” is free on every plan). Our operator may also take a copy of the whole database by hand: a nightly copy downloaded through the operator console (each download is recorded in our operator log and our own audit trail), or an export of the database made with our host’s own tools before a restore (not recorded). A copy like that is kept only on a device or in an account under our control, and is deleted once the recovery or test it was taken for is complete, and in any case within 30 days of being taken — unless we are keeping it for a legal reason, for example a backup downloaded when a legal hold is placed, which we keep for as long as that reason requires. Something erased from the service remains in such a copy until the copy is deleted. The copies are used only to recover from a failure and to test that recovery works, or as “Who at Profusia can see your data” allows. If we ever have to restore from one, we re-apply every erasure made since it was taken that our remaining records show, and tell a workspace’s owners about any we could not; if a failure leaves us unable to tell what was erased since then, we tell the owners of every workspace, so that they can check and erase again.
When a workspace ends
| What happens | What we keep, and for how long |
|---|---|
| A paid plan is cancelled | The workspace moves to the Free plan, and nothing is deleted. |
| An owner deletes the workspace | It becomes unreachable at once, and an owner can restore it for 30 days; after that a daily job erases its database rows and stored files for good, unless the workspace is suspended or held (below) — and then not until 30 days after that ends, during which an owner can restore it again. A workspace with a running subscription can’t be deleted until the subscription is cancelled, and the job cancels any that is still running before it erases anything. An owner who wants it erased sooner may ask us; we will do it where reasonably practicable and confirm in writing. |
| A self-serve workspace nobody paid for | When its trial ends it moves to the Free plan, and nothing is deleted then. Once nobody has used it for 90 days since its trial ended (or, if it started without a trial, since it was opened), it is scheduled for deletion: it becomes unreachable to everyone at once — every share link, portal, key and session into it stops working — an owner can restore it for 30 days, and it is then erased, so at the earliest about 120 days after its trial ended. |
| A Free workspace nobody uses, including one whose paid plan was cancelled | Once nobody has used it for 12 months, counted from the last time anyone used it or from when it moved onto the Free plan, whichever is later, it is scheduled for deletion in the same way: unreachable at once, restorable by an owner for 30 days, and then erased, about 13 months in all. |
| Before either of those two deletions | We tell the workspace’s owners 60, 30 and 7 days before the date it is to be scheduled for deletion, in Notifications and by email where we can send it; if no owner can be emailed at all, the notice in Notifications is the only warning, and if an email could not be sent for a while, the date moves later, never earlier. Using the workspace keeps it and starts its period again: any of its members signing in (to it or to any of their other workspaces), using a signed-in session in it or making a change in it, and an assistant connected to it acting in it or renewing its access, each count as using it; visits to its published pages do not. Once it is scheduled, the deletion route above applies, so an owner can still restore the workspace for 30 days before it is erased, and a member signing in during those 30 days puts it back. Neither is ever scheduled for a workspace with a live subscription, one for which we have recorded a deal of its own (which is how we record an order signed by both parties), one with a free window we opened or features we granted by hand, or one we set up ourselves and never put on a plan; and neither happens while a workspace is suspended or held (next row). |
| We suspend or terminate a workspace | Suspending a workspace deletes nothing, and reinstating it puts everything back. A workspace we have suspended, or one we must preserve for an investigation or legal process, is held: none of our erasures runs on it — not a deletion its owner asked for, before or after the suspension or hold began, not the deletion or erasure of an unused workspace above, and not the erasure of items emptied from its trash, which also cannot be erased at once — and nobody can be erased from it, until the suspension or hold ends. There are two exceptions: the erasure that follows a termination (below), which runs while the workspace is still suspended and is delayed only by a legal hold; and a self-serve sign-up request that was never confirmed and that we suspended, whose email, name and network address are still deleted 90 days after the suspension, as the row on sign-up requests says, unless it is under a legal hold. When a suspension or hold ends, normal retention resumes, but not the same night: each erasure it held waits its own period again from that day (30 days for a deleted workspace; a few days for the trash, and before anyone can be erased from it; and, after a legal hold ends, 30 days for one being erased after termination), and the periods for an unused workspace are counted from that day, with every notice given again. Apart from those erasures waiting, a hold for an investigation or legal process changes nothing in the workspace — what its members delete still leaves their view, and a kept assistant conversation a member deletes is still deleted — and it is recorded in our operator log and our own audit trail, not in the workspace’s audit trail. Records with their own periods on this page go on expiring meanwhile, unless we keep them, or a copy of them, for that purpose. For 30 days after we terminate, an owner may ask support@profusia.ai or legal@profusia.ai for an export, which we provide by reinstating the workspace for that purpose (after taking down anything that broke our rules; while it is reinstated, its members, their assistants and its links work again) or by another secure method we choose. We do not provide material that is unlawful to hold or return, material taken down on a valid legal notice, or what an authority directs us to withhold. After those 30 days, we may mark the workspace for erasure, and our nightly job erases it 30 days after that, as it would a deleted one but without a period in which it can be restored, unless we must preserve it; a legal hold delays that, and once the hold ends it waits 30 days more. |
| After a workspace is erased | Its copies in our backups remain until they age out (see “Backups”). We also keep a few records of our own: our operations and billing-notice logs; the workspace’s plan settings (the plan, trial and limits it had, against its internal id, with nothing about any person), which our erasure does not yet remove; a receipt of the erasure in our own audit trail, and the lines there recording when any legal hold on it was placed and released (400 days); a hold on the workspace’s address, so nobody else can take it, for a year (ten years if it was ever suspended); sign-up mailbox fingerprints (400 days); and the do-not-send list. Copies already held by Resend, Paddle, an AI provider or the customer’s own Google Drive stay under that party’s own terms. |
Who at Profusia can see your data
Profusia is run by one person, the company’s operator, who holds administrative access to the production database, file storage and backups and can read them, as the administrator of any hosting service can. Your content is not encrypted from us.
The operator console shows each workspace; its members’ names and email addresses, their roles, and when each joined and last signed in; the plan and billing status, including any refunds and chargebacks; usage and each member’s AI spend; the AI usage record, which names the documents asked about; the names of documents we have taken down, with the reasons; the addresses on pending invitations and reset links; and our notes about the workspace. It is not built to show the content of documents, comments or conversations.
We open customer content only (a) when the customer asks us to, or when one of its users asks us, for support, to look at something that user can already see; (b) to investigate a security incident or a reported breach of our Acceptable Use Policy; (c) where the law requires it, or where it is needed to respond to legal process, to establish, exercise or defend a legal claim, or to prevent death or serious physical injury; or (d) to keep the service running or restore it from a backup, where that cannot be done without opening it. A person’s kept assistant conversations we open only at that person’s request, or under (b), (c) or (d).
The operator can suspend a workspace, take down a single document (its members are shown the reason), make a password-reset link for any account (whoever uses it sets that account’s password and is signed in to it; the account holder is normally emailed when the password is changed with it), make an invitation that makes whoever accepts it an owner of a workspace (to set up its first owner, or to restore control to an owner whose identity we have verified), rotate a workspace’s access key, disconnect its assistants, place or release a legal hold (which keeps our erasure jobs off a workspace, and while it stands the trash purges and person erasures asked for inside the workspace wait too; it changes nothing else, so what members delete still leaves their view, a kept assistant conversation a member deletes is still deleted, and records that expire by age still go), mark a suspended workspace for erasure once its agreement has been terminated and the 30-day export window has passed (or withdraw that mark) and download a backup. A reset link, an owner invitation and a newly rotated key each give us, until they are handed on or used, a credential that could open the workspace; we make them only to pass on. Every one of these acts is recorded in the operator’s own log, and, where it concerns one workspace, in that workspace’s own audit trail as well — except a legal hold, which is recorded only in our own log and audit trail, because we tell an owner about a hold only where that is lawful and safe. A backup download is also recorded in our own audit trail, naming who downloaded which night. Viewing what the console shows, reading or changing the database or storage directly with our host’s own tools (its dashboard, command-line tools or programming interface), and a restore carried out with those tools, are not recorded. Our company’s internal operations console, Evadaroo HQ, can take the same recorded acts, except downloading a backup, releasing a legal hold, marking a workspace for erasure, reinstating a suspended workspace while anything in it is waiting to be erased, or making anything that could give someone access to our operator console, such as an owner invitation that names nobody or one of our own addresses.
We build Profusia with AI coding tools (Anthropic’s Claude Code), which run on Anthropic’s systems. The credential they deploy with can also read production data. A written rule forbids them to read customer content; that is a policy control, not a technical one.
Beyond this, no screen, listing or export shows your data to anyone at Profusia, and we do not read it.
Subprocessors and other outside services
These are all the outside services that receive personal data from Profusia itself, apart from the AI providers that answer our public help assistant, which, for the help assistant, receive only what is typed into it (see the help assistant below; they also answer our company’s own internal workspace). Two rows, Uiia and Evadaroo HQ, are our company’s own systems, which run on outside hosting of their own (and, for Uiia, outside AI model providers); ask us at legal@profusia.ai and we will name those providers. A sub-processor handles data for us, on our instructions; an independent controller decides for itself how it uses what it receives, under its own notice. This list last changed on 2026-11-11.
| Who | Role | What for, and what it receives | Where | Workspace content today? | Its terms |
|---|---|---|---|---|---|
| Cloudflare, Inc. | Sub-processor | All hosting: the application, file storage, the database and its backups, DNS and delivery. It sees everything stored in Profusia and the IP address of every request. At self-serve sign-up we also ask its public DNS service whether an email address’s domain can receive mail (the domain only, never the address). It also adds the analytics tag described below. | US company; global network; storage locations chosen by Cloudflare and not pinned to a region | Yes | Terms |
| Resend (Plus Five Five, Inc.) | Sub-processor | Delivers the email Profusia sends: a notification that somebody mentioned you or named you a card’s owner (the address, the title, up to 240 characters of the message, and a link); the messages a change of sign-in email or a password reset needs; an invitation a person makes (the address, the workspace’s name, the role and the link); a warning to a workspace’s owners before an unused workspace is erased; a reminder to a workspace’s owners before a yearly plan renews (the workspace’s name, the plan, the date and time it renews, the amount Paddle will charge where Paddle states it, otherwise the price in force for the plan and seats, and how to cancel); a notice to the owners of a workspace that is already paying when the price of its plan is going up (the workspace’s name, the plan, the price now and the new price, the date it reaches the subscription, and how to cancel); a notice to the owners of a workspace that is already paying when a feature is taken off its plan (the workspace’s name, the plan, the features it keeps and the date it keeps them until); and — where self-serve sign-up is open — the one confirmation link a new workspace needs, carrying no words the requester typed (at most 15 a day and 250 a month). | US | A small part: the title and up to 240 characters of a message, in a notification | Terms |
| Google LLC — Google Workspace | Sub-processor | Our company email (legal@, support@, billing@, security@ and hello@profusia.ai, and notifications@profusia.ai, the address the Service’s email comes from): what you send us, including any reply to an email the Service sent you, and our replies. | US | Only what someone chooses to email us | Terms |
| Paddle (Paddle.com Market Limited and its affiliates) | Independent controller; our reseller and Merchant of Record | Payment for paid plans, which are not on sale yet. You give your billing contact, payment and tax details to Paddle on its own checkout; payment details go to Paddle, never to us. We tell Paddle which workspace a purchase is for (its address and an internal reference) and how many seats. | UK and US | No | Terms |
| Uiia (uiia.app) | A separate product of our own company; not a sub-processor of workspace data | The help assistant on profusia.ai/help. Its script loads with that page, so Uiia receives your IP address and browser details when you open it, and any question you type there. It answers with outside AI model providers, some of which may keep what they are sent and use it to improve their models. It never loads on a workspace’s own address. We have not yet published how long Uiia keeps what it receives; ask legal@profusia.ai. | Run by our company, on outside hosting of its own | No | — |
| Evadaroo HQ | Our company’s own internal operations console | Reads the account, plan and usage records the operator console shows (workspaces, members’ names and email addresses, roles and usage), and can take the same recorded operator acts, except downloading a backup, releasing a legal hold, marking a workspace for erasure, reinstating a suspended workspace while anything in it is waiting to be erased, or making anything that could give someone access to our operator console. | Run by our company, on outside hosting of its own | No document content | — |
| Anthropic, PBC — Claude Code | Development tool | The AI coding tool we build and deploy Profusia with, running on Anthropic’s systems. The credential it deploys with can also read production data; a written rule forbids it to read workspace content. | US | Not permitted (a written rule, not a technical block) | Terms |
| Clerk, Inc. | Sub-processor, if switched on | Would handle sign-up, email verification, invitation email and password reset, seeing your email address and sign-in details. Not switched on; it receives nothing. | US | No | Terms |
AI model providers that receive workspace content. These are the only AI providers that receive a customer workspace’s content. Each row’s tier, training terms and models come from the same model registry the product routes on.
| Provider | Tier | When it answers a customer workspace | May it train on what it is sent? | Where |
|---|---|---|---|---|
| Anthropic (Claude) | Paid API | By default, whenever someone in a workspace whose plan includes in-app AI uses a feature that reads its content | No, under its published terms (we rely on those terms; we cannot check them ourselves) | Not pinned to one country: Anthropic processes a request on its own infrastructure |
| Cloudflare Workers AI | Free allowance, then paid | Not connected today, so it receives nothing. Once we connect it: only when someone picks one of its models, or when we place it in the order a feature uses | No, under its published terms (we rely on those terms; we cannot check them ourselves) | Not pinned to one country: Cloudflare's global network |
| Amazon Bedrock | Paid API | Never by default. Only when someone picks one of its models, or when we place one in the order a feature uses; until then it receives nothing. Its models were made by other companies and run inside Amazon Web Services: the company that made a model does not receive the request | No, under its published terms (we rely on those terms; we cannot check them ourselves) | United States: we call it in Amazon Web Services' US Regions |
Which of them answers, and in what order, is set by our operator. We do not send workspace content to any other AI provider, and before another one begins to receive it we post it here and email workspace owners at least 30 days ahead, as our DPA describes. Where a provider processes a request is not pinned to one country: each processes it on its own infrastructure. We have no zero-data-retention agreement with either: each says in its published terms that it does not train on what it is sent, though it may keep it for a time, for example to watch for abuse. Other AI providers, including free tiers that may keep what they are sent and use it to improve their models, answer our public help assistant and our company’s own internal workspace; they receive no customer workspace content.
- Email (Resend). Email is switched on. A notification that somebody mentioned you or named you a card’s owner is emailed once your workspace’s administrator has turned email on, and unless you have turned it off for yourself in Personal settings (the account menu, or the gear in the notifications panel); it carries your address, the notification’s title, up to 240 characters of the message, and a link. Resend also carries the messages a change of sign-in email needs — a confirmation link to the new address, a notice to the old address when the change is asked for, and another, with a link to undo it for seven days, when it is done — which cannot be switched off, because they are what protects your account. When someone in a workspace invites you by your email address, your address, the workspace’s name, the role and the invitation link are sent to Resend to deliver that one invitation. If you ask for a password reset (“Forgot your password?”) and your address has an account with a password, your address and a one-hour reset link are sent to Resend; when the password is then changed, a notice that it changed goes to the same address. And if you open a workspace yourself at profusia.ai/signup, Resend carries the one confirmation link that sign-up needs — with no words you typed in it. Where we can send it, a workspace’s owners are also emailed a warning before an unused workspace is erased, and a reminder normally between 45 and 15 days before a yearly plan renews (and never later than 7 days before) — the date and time, the amount Paddle will charge where Paddle states it (otherwise the price in force for the plan and seats), and how to cancel. When the price of a plan is going up, the owners of each workspace already paying on it are emailed a notice with the price now and the new price, the date it reaches the subscription and how to cancel. Those are the only messages Profusia sends: documents you follow are shown in the app and are not emailed, nothing is pushed to a device, and there is no marketing mail.
- AI features. Customer workspace content is never sent to an AI provider tier that may train on it. The only workspace whose content may reach such a tier is Profusia’s own internal workspace, where every screen that uses it says so. Which workspace that is, is a setting in our own configuration that only our operator can change; no customer workspace is opted in, and a customer has no way to opt itself in. The in-app AI features that read a workspace’s content — Ask a document; Discuss a site, space, project or card; the Navigator’s ask; Draft and Break it down; Say what you did; filing proposals; Propose a turn; Set this page; the two plan checks; and Build — run in a workspace only where its plan includes in-app AI (a Free trial does, using only our lower-cost models; the Free plan does not), and send what they need only to the providers in the table above: Anthropic’s Claude answers; Cloudflare Workers AI is listed too, and receives nothing until we connect it; Amazon Bedrock is listed too, never answers by default, and receives a workspace’s content only where someone picks one of its models or we place one in a feature’s order (its models run inside Amazon Web Services, and the company that made a model does not receive the request). Each person may have one in-app AI request in progress at a time. Every request that carries a workspace’s content is checked on each provider: each provider tier that may train on what it is sent is left out unless the workspace is Profusia’s own, and the request is refused if no other provider can answer, never sent to one that trains to get around that (filing proposals and Set this page then use counted rules with no model, and Propose a turn leaves its manual form). Each feature sends what it needs to one provider, in the request that produces the answer: for a question about a document, that document’s text; for a conversation about a site, space, project or card, the text of what it covers, including comment authors’ names; for a search-wide question, the matching passages; for Build, the names of the spaces and projects you can see, an outline of your documents and tables, and the full text of whatever you bring in; for filing proposals and Set this page, document names, headings and opening text; for Say what you did and Propose a turn, card names, statuses and dates; for the two plan checks, the project as its share link shows it, plus its documents’ text; and the conversation’s earlier turns. If that provider fails, the request goes to the next one in the order we have configured, which is always one of those two. The models are given no tools, and Build only proposes: nothing is written until a person accepts it.
- Spoken questions. Spoken questions are not available in a customer workspace: neither of the providers that receive workspace content can hear one, so no customer workspace is offered a microphone. Wherever they are available, nothing records without you pressing the button (there is no wake word and no open microphone), we store no recording, and the audit log notes only that a question was spoken and how long the clip ran — never the audio or the words.
- The help assistant. Profusia’s own help assistant — the question box on /help at a workspace’s address, and the “Ask about Profusia” assistant in Workspace settings and on All sites — answers from Profusia’s own published help and reads nothing from your workspace. Anyone can use it. What you type into it, with the last few turns of the conversation, is sent to an AI provider — usually a free tier, which may keep it, train on it and process it outside the United States — so type nothing confidential there. We do not store your question; our usage record notes only that one was asked, which model answered and what it cost. On profusia.ai/help the help assistant is Uiia (uiia.app), a separate product of the same company: its script loads with the page, so Uiia receives your IP address and browser details on every visit there, and anything you type into it; it answers with AI models that may keep what they are sent and use it to improve their models.
- Google Docs/Sheets sync, only if your workspace turns it on. Each night Profusia copies into the Drive folder an owner chose: the chosen projects (names, statuses, notes, fields including Owner, checklists, who last changed each card, and each card’s last three comments with their authors’ names); documents’ names and text; and, if chosen, a daily brief — a dated journal of the last two weeks’ changes, comments and recorded turns, naming who made each one, with what is waiting on the workspace’s owner and what is blocked or slipping. People are named by their name, or by their email address where they have given no name. Once there, those copies are in your Google Drive under your own terms with Google. Profusia stores the authorization Google issues, encrypted at rest under a key held outside the database. It is never shown back to you or anyone else, never included in an export, and erased with your workspace. It uses Google’s per-file scope, so it permits access only to the files Profusia itself creates in your Drive — Google enforces that, not us. Profusia reads only the folder you picked and the files it created there, and keeps the connected Google account’s email address so you can see which account is connected. Disconnect at any time; what is already in your Drive is yours and stays.
- Assistants you connect. An assistant a person connects with their own sign-in acts as that person, with that person’s role and only what they can see. An assistant connected with a workspace access key acts for the whole workspace and is not limited by roles. Either way, everything it does, including acts prompted by instructions it read in a document, comment, page or dataset, is the customer’s act under our Terms of Service. What the service returns to a connected assistant leaves Profusia and is held by that assistant’s vendor under the customer’s own terms with it.
- Paddle. Paid plans will be sold through Paddle (Paddle.com Market Limited and its affiliates), our reseller and Merchant of Record. Paid plans are not on sale yet. On the payment page Paddle processes your billing contact, payment and tax details as an independent controller under its own privacy notice. Payment details go to Paddle, never to us. We send Paddle your workspace’s address and an internal reference, so the payment lands on the right workspace, and the number of seats; what comes back to us is which plan, how many seats, monthly or yearly, its status and renewal or end date, any refund or chargeback, and Paddle’s own reference numbers.
- Cloudflare’s analytics tag. Our host, Cloudflare, adds a small analytics tag to pages it serves for us; our security settings block it from running, so it collects nothing, and we are switching it off. Profusia uses no advertising service and no analytics of its own beyond the counting described above.
Not on these lists, because you direct them: the vendors of the assistants you connect, your own Google account if your workspace turns on Drive sync, and the people and services you share with. Apart from the assistants you connect and the services listed above, Google sync is the only connection to another platform that carries your workspace’s content: it writes copies into your Drive and reads only the folder you chose and the files it created there.
When this list changes, its date moves. We add a new sub-processor here, with the date, at least 30 days before it starts handling workspace content, and we email workspace owners when we do — except where an urgent replacement is needed to keep the service secure or running, when we tell you as soon as we can.
Why we use your information
Where the GDPR or the UK GDPR applies to our own processing, we rely on:
- Contract — creating and running your account and workspace, the features you switch on (such as Google Drive sync and notification email), billing through Paddle, support, and the account messages that protect your sign-in.
- Legitimate interests — keeping the service secure and preventing abuse (the brief security counters, checks on self-serve sign-ups, one free trial per person, the do-not-send list), keeping the audit trail and our operations records, delivering an invitation a member asked us to send, serving a shared document or portal to the person it was sent to (including its cookies and the open counts the sender sees), counting visits to our own public pages, and investigating reports of misuse. We have weighed these against your interests: each uses the least data that works; the counters that slow down repeated attempts are kept for about two days; the longer-lived records — the evidence kept from a sign-up request, the one-trial-per-person fingerprint, the hold on a suspended workspace’s address and the do-not-send list — are each kept only for the period stated above; and none of it is used for advertising. You can object at legal@profusia.ai.
- Legal obligation — tax and accounting, responding to lawful requests, and reporting and preserving material where the law requires it.
- Consent — only where we ask for it; you can withdraw it at any time, without affecting what happened before.
For workspace content processed on a customer’s instructions, the customer’s own legal basis governs.
Your rights, as product actions
- Access & a copy — the console's “Export” button: the current version of every document you can see, plus projects, datasets, collections and the site structure (and, for owners and admins, the audit log and the record of who accepted our terms), packaged in your own browser. Your profile, your notifications and your kept assistant conversations are not in it yet: ask legal@profusia.ai for a copy. Comments, chat and earlier versions of documents belong to the workspace: ask its owner or an admin, and we will help them give you a copy.
- Erasure — a workspace owner can delete the whole workspace (unreachable immediately, reversible for 30 days, then erased; a workspace with a running subscription can’t be deleted until the subscription is cancelled), a workspace owner can erase anyone from it except its last owner, and an admin can erase members and viewers (you cannot erase yourself; ask one of them), except while the workspace is suspended or held, or in the few days after that ends, when they can still be removed. Erasing a person deletes their sessions, the invitations and reset links that name them, and everything that was theirs alone in that workspace — pins, follows, preferences, notifications, kept assistant conversations, the record of what they opened, and their record of accepting our terms there; their connected assistants are disconnected and no longer name them; and their name is removed from the record of who made or changed things. Their account is deleted unless they belong to another workspace. Names typed into text, such as a card’s Owner or a message, are not changed, our audit log keeps its entries for their full 400 days, and backups age out as described above. You can also ask us to delete your own account at legal@profusia.ai; if you are a workspace’s only owner, we will first ask you to delete the workspace or name another owner, so other people’s work is not stranded.
- Rectification — documents, projects and profile details are directly editable in the product; fixing a record is using it.
- Restriction and objection — you can ask us to restrict processing while a question is settled, and object to processing based on our legitimate interests.
- Complaining — you can complain to your data-protection authority, though we would like the chance to fix it first.
Anything a product act doesn't cover — and any privacy question at all — write to legal@profusia.ai. We confirm it is you, usually by emailing the address on the account, and reply within 30 days, or tell you within 30 days why we need longer (at most two more months). We do not charge. If your request is about content in a customer’s workspace, we pass it to that customer, which decides, and tell you we have.
California (CCPA/CPRA)
Profusia does not sell personal information and does not share it for cross-context behavioral advertising. There is no “Do Not Sell or Share” mechanism because there is no sale or sharing to opt out of.
Cookies and browser storage
There is no cookie banner because Profusia sets only first-party cookies: to keep you signed in, to do what you asked, and to remember a choice you made or where you left off:
| Cookie | What it does | Who gets it | How long |
|---|---|---|---|
profusia_session (__Host-profusia_session on secure addresses) | Keeps you signed in. It is tied to your account — that is its job. | Signed-in people | 30 days, or until you sign out |
profusia_sso, __Host-profusia_sso, profusia_gstate, __Host-profusia_gstate | Protect a single sign-on or a Google Drive connection while it is in progress | People signing in with single sign-on (not switched on), and an owner connecting Google | 10 minutes |
profusia_last_site, profusia_seen | Remember where you were working, and what was new since you were last there | Signed-in members | 180 days |
profusia_home_site | Remembers which site to open first | Signed-in members | 365 days |
profusia_tz, profusia_look | Your timezone, and your light or dark look | People who choose them | 1 year |
profusia_seeas (__Host-profusia_seeas on secure addresses) | Lets a member preview what an outsider sees | Members using “See it as…” | 30 minutes |
profusia_guest (__Host-profusia_guest on secure addresses) | Keeps you inside a portal you were given, under the name you typed | Portal visitors | 90 days |
profusia_unlock_{id} | Keeps one password-protected link open after you answer its password | People opening such a link | Until you close your browser |
pf_seen | Remembers which version of a shared document your browser last opened, so the page can say what changed | Anyone opening a share link | 90 days |
Your browser’s own storage also keeps your light-or-dark choice and your view preferences, a 24-hour upload link if you use one, a 24-hour console link an assistant gave you once you open it, an access key if you paste one into a page that asks for it, and, for that browser tab only, an assistant conversation you open full screen without keeping it. It stays on your device, and clearing your browser data removes it. None of these cookies or stored items is used for advertising or to follow you across other sites, and none is shared with anyone. The Cloudflare tag described above is blocked from running. Two pages load code from outside Profusia: on the payment page, Paddle’s checkout sets its own cookies when you choose to pay; and on profusia.ai/help, the Uiia help assistant’s script runs in your browser, and we have not yet confirmed what, if anything, it stores there. (Workspace settings would also load Google’s own script if we switched on Google’s folder picker for Drive sync; it is not switched on.)
Counting. Opens of documents are counted as numbers per day — per document, per share link and per named portal visitor. The public pages themselves (the marketing site, the guides, the help topics, the templates, and the trust and legal pages) are counted as a number per day, per page, and per referring site, where the referring site is reduced to a name from a short fixed list (for example a search engine or an AI assistant) or to none. No IP address, browser detail or query string is stored with either count, and the public-page count never includes a page on a customer’s own workspace address. A portal visitor who gave their name, and a link made for one person, do show the sender when it was opened.
Where processing happens
Profusia is run from the United States, so information you give us is processed in the US. Cloudflare's network is global: a request is answered from a Cloudflare location near you, and our database and file storage sit in locations Cloudflare chose when they were set up. We have not pinned them to a region. We do not currently offer a regional-pinning guarantee, and this page will say so until we do rather than implying one. Where an AI provider processes a request is not pinned to one country either: Anthropic (and Cloudflare Workers AI, once we connect it) processes it on its own infrastructure, which may be outside the United States. Amazon Bedrock is the exception: we call it in Amazon Web Services’ US Regions, and it processes a request there. Our Data Processing Addendum, which covers transfers of workspace content from the EEA, the UK and Switzerland with the Standard Contractual Clauses, is part of the agreement a customer accepts; ask us if you need a copy signed by both of us. We are not certified under the EU-US Data Privacy Framework.
Children
Profusia is for businesses and people aged 18 and over, and is not directed at children. We do not knowingly collect children’s information. If you believe a child has given us information, write to legal@profusia.ai and we will delete it, and tell the workspace’s owner about anything inside their workspace so they can remove it.
Changes
When what this page describes changes, we update the page promptly and the date at its foot moves; we keep earlier versions and will send any of them on request. For a change that materially affects how we handle workspace content, we will email workspace owners at least 30 days ahead, unless the change is required by law or needed to address a security risk or an active harm, when we will tell you as soon as we can.