Privacy Policy

This Privacy Policy explains how Prabloe (“Prabloe”, “we”, “us”) collects, uses, discloses, retains, and protects personal data when you use the Prabloe platform, its applications, its programmatic interfaces, and any related service (together, the “Service”). It forms part of, and should be read with, our Terms of Use. Capitalised terms not defined here have the meaning given in the Terms.

We have written this policy to be specific rather than reassuring. Where a practice is uncertain, limited, or not yet available, it says so.

1. Who we are and the capacity in which we act

For personal data you give us as an individual user — your account details, your prompts, the content you create with the Service — Prabloe is the controller(or, under India’s Digital Personal Data Protection Act, 2023, the Data Fiduciary). We decide why and how that data is processed.

Where an organisation — a school, university, employer, or business — provisions the Service for its members and instructs us on its use, that organisation is the controller and Prabloe acts as a processoron its documented instructions under a Data Processing Agreement. In that case the organisation’s own privacy notice governs, this policy describes our processing on its behalf, and rights requests should be directed to the organisation first. See Section 16.

Contact for all privacy matters, including rights requests and the grievance mechanism required under the DPDP Act: privacy@prabloe.com.

2. Summary

3. Personal data we process

We group personal data into the categories below. “Source” is where it comes from: you (you provide it), device(collected automatically from your browser or client), or third party(received from another service).

Data we ask you not to send

The Service is not designed for, and must not be used to process, special category data under the GDPR (health, biometric, genetic, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, sex life or sexual orientation), payment card numbers, government identity numbers, or protected health information. Do not paste such data into a prompt or upload. If you do, you do so on your own instruction and at your own risk, and we may remove it.

4. Where each kind of data actually lives

This section is deliberately concrete, because “we store your data” is not an answer anyone can act on.

5. Incognito

An incognito session is held in memory for as long as the tab is open and is written to no store — not your browser’s local storage, not your memory, not our database, not our analytics. Nothing about it is used to train or evaluate anything. It does not survive a reload, and closing or leaving the session destroys it. The prompt is still transmitted to the model provider that answers it, because there is no way to produce an answer without doing so; incognito controls what we keep, not the fact that a request leaves your device.

6. How the Service processes your content with AI models

Routing across multiple models

The Service is not a single model. A request is routed to one of several third-party models chosen by the capability you invoked (conversation, lesson generation, diagramming, research, image or video generation), the Prabloe model family you selected, availability, and capacity. Model names presented in the product are Prabloe’s own; the underlying model serving a given request may change at any time.

What is transmitted

When a request is made, we transmit to the selected provider:

• the text of your prompt;
• the conversation turns and attachments needed as context for it;
• the instructions that shape how Prabloe teaches — which may include your stated learning style, custom instructions, and relevant memory, because personalisation is not possible without them;
• model parameters and our own account credentials for that provider.

We do not transmit your email address, name, or account identifier to model providers.

What providers do with it

Providers process the request to return a response, under contractual terms that engage them as our processors and, where applicable, restrict use of the content to serving the request. We cannot and do not warrant a provider’s internal practices beyond those terms. Providers may retain content briefly for abuse detection under their own policies. A current list of the model providers in use is available from privacy@prabloe.com, and is provided as standard to organisations under a Data Processing Agreement.

Automated decision-making

The Service produces automated output — explanations, lessons, assessments of your answers, difficulty adjustments. This is automated processing, and it shapes what you are taught next. It does not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the GDPR: we do not use it to decide credit, employment, insurance, admission, or any comparable outcome, and you should not use the Service to make such decisions about anyone else. Automated assessments are advisory, are visible to you, and can be disregarded.

AI transparency

Content the Service generates is generated by artificial intelligence. It is labelled as such in the product, and you must not present it as human-authored where that distinction matters. Where generated audio, image, or video output is technically capable of carrying provenance metadata, we apply it.

7. Purposes and legal bases

For users in the EEA, the UK, and other jurisdictions that require a lawful basis, we rely on the bases below. “Legitimate interests” means we have assessed that our interest is not overridden by your rights; you may object at any time (Section 14).

Under the DPDP Act, processing is on the basis of your consent or a legitimate use recognised by that Act, and the notice requirements of Section 5 of that Act are met by this policy and the consent presented at sign-up.

8. Model training, and how to turn it off

We use your content to train or fine-tune models only where you have consented.Consent is requested at sign-up and is recorded against your account. You can withdraw it at any time in the product’s privacy settings or by writing to privacy@prabloe.com.

Regardless of your setting, the following are never used for training:

• incognito sessions;
• content processed for an organisation under a Data Processing Agreement;
• billing data and the credits ledger;
• content submitted by a user we know to be a child;
• requests routed through provider credentials you supplied yourself — that content is yours and your provider’s, and we take no training interest in it.

Where training does occur, we take reasonable steps to remove direct identifiers and to aggregate before use. Withdrawing consent stops future use immediately; it does not reverse processing already carried out, and parameters already learned by a trained model cannot practically be disentangled from it — a limitation of the technology, not a policy choice. Withdrawal will reduce personalisation quality, and we will say so rather than pretend otherwise.

9. Provider credentials you supply

Where the Service offers you the option to connect a model provider account of your own, the following applies. Credentials you supply are secrets; we treat them as such.

• They are encrypted before storage and are never written to logs, analytics, error reports, or support tickets.
• After they are saved we display only a non-reversible fragment sufficient to identify which credential is which. We cannot show you the full value again, and we cannot recover it for you.
• They are used for one purpose: to authenticate requests you initiate to the provider you nominated. They are never used for another user, for our own workloads, or for evaluation or training.
• Deleting a credential removes it from our systems. It does not revoke it at the provider — do that in the provider’s own console, which is the only place it can be done.
• When a request runs on your credential, the provider is your counterparty: their terms, their privacy policy, their retention, and their charges apply to that request directly, and we have no visibility into or control over them.

10. Payments

Where the Service is offered on paid terms, payment is taken by a third-party payment provider acting as merchant of record. That provider is the seller for the transaction and is responsible for the checkout, for payment-card handling under PCI DSS, and for the assessment and remittance of applicable taxes.

We never receive your card number, CVV, or bank credentials. They are entered on the provider’s systems. What the provider returns to us, and what we store, is: a transaction identifier, an event identifier used to make webhook delivery idempotent, the purchase outcome, what you are entitled to as a result, and the billing country and any tax identifier needed for our records. We hold a credit balance and an append-only ledger of grants and spends against your account, which is what lets you audit your own usage and lets us investigate a billing dispute.

11. Recipients and sub-processors

We disclose personal data to the categories of recipient below, each under a written contract imposing confidentiality and processing restrictions.

A current, named list of sub-processors is available from privacy@prabloe.com and is supplied as standard to organisations under a Data Processing Agreement, together with our commitment to give advance notice of a change and to accept reasonable objections.

We also disclose personal data where required by valid legal process, where necessary to protect the rights, property, or safety of users, the public, or Prabloe, and in connection with a merger, acquisition, financing, or sale of assets — in which case the recipient remains bound by this policy for data already collected, and we will give notice where the law requires it.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. We use no third-party advertising cookies or advertising trackers.

12. International transfers

Prabloe and its providers operate globally, and personal data may be processed in countries other than your own, including the United States and India. Where personal data is transferred out of the EEA or the UK to a country without an adequacy decision, the transfer is made under the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where the UK GDPR applies), supported by a transfer risk assessment and, where appropriate, supplementary technical measures including encryption in transit and at rest and minimisation of the data transferred. You may request a copy of the relevant safeguards from privacy@prabloe.com.

13. Retention

We keep personal data no longer than necessary for the purpose it was collected for. The periods below are maximums; we delete earlier where we can.

Backups are retained on a rolling schedule and are overwritten in the ordinary course. Data you delete may persist in a backup until that backup ages out; it is not restored to live systems.

14. Your rights

Subject to the law that applies to you, you have the right to access your personal data and obtain a copy; rectify inaccurate data; erase data; restrict or object to processing, including processing based on legitimate interests and direct marketing; port data to another controller in a structured, machine-readable format; withdraw consent at any time; and not be discriminated againstfor exercising any of them. Under the DPDP Act you additionally have the right to nominate another person to exercise your rights in the event of death or incapacity, and the right to a grievance redressal mechanism — which is the contact address below.

Much of this is self-service: content in your browser is deletable from Settings, and account data is exportable and deletable from your account settings. For anything else, write to privacy@prabloe.com. We respond within the period the applicable law requires — one month under the GDPR (extendable by two where a request is complex), 45 days under California law (extendable by 45). We will ask you to verify your identity before acting on a request, and we may refuse a request that is manifestly unfounded or excessive, telling you why.

Complaints.You may complain to your supervisory authority — in the EEA, the authority where you live or work; in the UK, the Information Commissioner’s Office; in India, the Data Protection Board. We would prefer you raise it with us first, but you are not required to.

California

The categories in Section 3 map to the CCPA/CPRA categories of identifiers, commercial information, internet activity, geolocation (coarse, IP-derived), audio, and inferences. The business and commercial purposes are those in Section 7; the recipients are those in Section 11. We do not sell or share personal information and have not in the preceding twelve months. We do not knowingly sell or share the personal information of consumers under 16. You may exercise your rights, including through an authorised agent, at privacy@prabloe.com. Sensitive personal information is used only for purposes permitted without a right to limit.

15. Children and learners under the age of majority

The Service is not directed to children under 13, and we do not knowingly collect their personal data. If you are between 13 and the age of majority where you live, you may use the Service only with the consent of a parent, guardian, or your educational institution, who accepts the Terms on your behalf. In jurisdictions setting a higher digital-consent age — up to 16 in parts of the EEA — that higher age applies.

Under India’s DPDP Act, processing the personal data of a child requires verifiable parental consent, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children in any jurisdiction. Where we know a user is a child, their content is excluded from model training.

If you believe a child has provided us personal data without the required consent, write to privacy@prabloe.com and we will delete it.

Schools and universities. Where an institution provisions the Service for students, it is the controller, we are the processor, and we process student data only on its documented instructions. We do not use student data for advertising and do not use it for model training under those arrangements. Institutions subject to student-records legislation should contact us for the applicable contractual terms before rolling the Service out.

16. Enterprise and institutional customers

On request, and without charge, we make available to organisations:

• a Data Processing Agreement incorporating Standard Contractual Clauses and the UK Addendum;
• a current named sub-processor list, with advance notice of changes and a right to object;
• a description of our technical and organisational measures (Section 17);
• a completed security questionnaire, and support for your own review;
• a contractual security-incident notification commitment, without undue delay and in any event within 72 hours of our becoming aware;
• assistance with data-subject requests, data-protection impact assessments, and prior consultations;
• deletion or return of processed data on termination.

What we do not claim. Prabloe does not currently hold SOC 2, ISO/IEC 27001, or any comparable third-party audit certification, and is not configured for HIPAA-regulated workloads. We would rather tell you that than be asked in a procurement review. Write to privacy@prabloe.com to discuss what your programme requires.

17. Security

We maintain technical and organisational measures appropriate to the risk, including:

• Encryption. All traffic is served over HTTPS with modern TLS. Data at rest in our managed database is encrypted. Credentials you supply are additionally encrypted at the application layer before storage.
• Credential isolation.Provider and platform secrets are held server-side in the deployment platform’s secret store and are never exposed to a browser. Privileged database keys are used only by server code.
• Access control. Row-level security restricts each record to its owner. Sensitive tables are readable only by server-side code with no client-facing policy at all. Administrative access to production is limited to named individuals, requires multi-factor authentication, and is logged.
• Abuse and cost controls.Durable per-identity and per-IP rate limits, request size limits, and an aggregate spend ceiling. Paid entitlement checks fail closed — if we cannot confirm your balance, we decline the request rather than proceed.
• Data minimisation by design. The chat endpoint persists no message content; rate-limit records hold no content at all; incognito writes nothing anywhere. These are properties of the code, tested in our test suite, not policy promises.
• Change control. Changes go through version control and review; automated tests enforce security-relevant invariants; secrets are excluded from the repository.

No system is perfectly secure. Use a unique credential, enable the strongest sign-in method offered, keep your device secure, and tell us immediately at security@prabloe.com if you suspect unauthorised access. We welcome good-faith vulnerability reports to that address and will not pursue legal action against researchers who report responsibly, avoid privacy violations and service degradation, and give us reasonable time to fix the issue before disclosure.

18. Personal data breaches

If a breach of security leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to your rights and freedoms. Where the breach is likely to result in a high risk to you, we will notify you directly and without undue delay, describing what happened, the likely consequences, and what we are doing about it. Where we act as a processor, we will notify the controller without undue delay and assist with their own notification duties.

19. Cookies and local storage

We use the minimum set of browser storage the Service needs. We do not use third-party advertising cookies.

You can clear browser storage at any time in your browser settings; doing so signs you out and removes locally held work. We honour Global Privacy Control signals where the law requires it.

20. Changes to this policy

We update this policy as the Service changes. The “Last updated” date at the top always reflects the current version. For material changes — a new purpose, a new category of recipient, a change in legal basis — we will give notice in the product or by email before the change takes effect and, where the change relies on consent, we will ask again rather than assume. We keep prior versions and will provide one on request.

21. Contact

Privacy questions, rights requests, and grievances: privacy@prabloe.com. Security reports: security@prabloe.com. Everything else: legal@prabloe.com. We acknowledge privacy correspondence within 7 days.