Effective date: 19 October 2026
This policy explains what personal data Pramaan ("Pramaan", "we") collects, why, how long we keep it, and your rights.
- Privacy questions and requests: privacy@pramaan.dev
- Anything else: support@pramaan.dev
- Address: 66 Paul St, London EC2A 4NA
1. Our two roles
| Whose data | Our role | Who decides |
|---|---|---|
| Builders: people who sign up, their workspaces, members and billing | Controller | Pramaan |
| Builders' end users and the people builders look up or message, when a builder calls a superpower | Processor (service provider) | The builder. Ask the builder first about your data; we will help them. |
| Pramaan Data: public-source answers we keep and reuse (section 5) | Controller | Pramaan |
| Visitors to our sites | Controller | Pramaan |
2. What we collect from builders
| Data | Examples | Why | Legal basis |
|---|---|---|---|
| Account | name, email, sign-in records, job role you choose | run your account | contract |
| Workspace | workspace name, members, roles, invites | let teams work together | contract |
| Keys | key prefix and last four characters; the full key is not kept in readable form | secure access | contract, legitimate interest (security) |
| Billing | top-ups, balance, usage, receipts. Card details are handled by our payment provider, not by us | charge for the Service | contract, legal duty (tax, accounting) |
| Call records | who called which superpower, when, price, status, approver, a fingerprint (hash) of the input | billing, limits, support, abuse prevention | contract, legitimate interest |
| Own keys and connections | provider credentials (encrypted), connected app accounts | make calls you ask for | contract |
| What you type on Home | your question to the app's assistant | suggest superpowers | contract |
| Support and email | messages to us | help you | contract, legitimate interest |
| Device and log data | IP address, browser, request ids | security, debugging | legitimate interest |
- We do not log request bodies or credentials in our server logs.
3. What we process for builders (as processor)
When a builder calls a superpower, we process whatever that call involves, on their instructions. That can include:
- people and company lookups (names, work emails, job titles, social profiles);
- identity and fraud checks (for example documents, phone numbers, IP addresses);
- hiring and court-record checks. The builder must hold the person's consent and send its record id;
- messages and their recipients: SMS, email, voice and social posts;
- files that builders upload, and media we generate for them;
- data in apps the builder connects (CRM, calendar and so on).
The DPA (DPA.md) governs this processing. Job results and files are kept as described in section 6.
4. Opt-out lists
- When someone replies STOP to a text, or uses an unsubscribe link, we add them to that builder's opt-out list.
- Anyone can also choose "stop all messages from apps built on Pramaan". That puts them on a platform-wide list, and every builder's sends to them are refused.
- We store only a keyed hash of the phone number or email address, not the address itself.
- Login codes (one-time passcodes) the person asked for still go through after STOP, because the person asked for them. Everything else is blocked.
5. Pramaan Data (public answers we keep)
- What it covers: answers we fetch from public sources using Pramaan's own provider accounts, for example a company's public details or a public profile.
- What it never covers: anything from a builder's own provider accounts or connections, and any content a builder supplies.
- Why: to build Pramaan's own data set and answer requests faster and more reliably.
- Legal basis: legitimate interest. We weighed it against your rights:
- Our interest: answering requests faster, more cheaply and more reliably, without fetching the same public record again for every request.
- What we keep: answers from public sources that a builder already asked for.
- Your expectations: the information was already public, so keeping a copy adds little new intrusion.
- Safeguards: encrypted, personal fields deleted 24 months after last use, never sold, and you can ask us to erase a record about you at any time.
- Result: we think our interest is not outweighed by your rights. You can object at any time, and we will stop using your record unless we have a compelling reason not to.
- How it is kept: encrypted.
- How long: personal fields are deleted 24 months after a record was last used. Company and other non-personal data is kept. A record is also erased sooner when you ask and the law gives you that right (section 10).
- Where the data comes from: public sources reached through our providers, such as people and company data providers.
6. How long we keep things
| Data | Kept for |
|---|---|
| Account and workspace | while the workspace is open, then deleted 90 days after it closes. Your sign-in identity is kept while you still belong to another workspace |
| Billing, ledger, meter and usage records | at least as long as tax and accounting law requires (usually 7 years). We do not delete them automatically |
| Call logs | 13 months. Daily totals, without any inputs or outputs, are kept until the workspace is deleted |
| Job results and scheduled-run history | 30 days after the job finishes |
| Files (uploads, generated media, exports) | 7 days. Unfinished uploads are removed after 1 hour |
| Own-key credentials and connections | until you delete or disconnect them |
| Opt-out entries | indefinitely, as hashes, so the opt-out keeps working |
| Pramaan Data records | personal fields deleted 24 months after last use; business details (companies, places, products) kept; erased sooner on a valid request |
| Rented inbox mail | until the inbox is deleted, or released after non-payment |
| Server logs | 30 days |
| Backups | up to 90 days, including any manual backup copies |
7. Who we share data with
- Subprocessors that run the Service for us: see Subprocessors.
- Providers that carry out superpowers. We send them only what each call needs. They see a hashed workspace tag, never your workspace name.
- Connected apps you authorise.
- Authorities, when the law requires it. Where we can, we tell you first.
- A buyer, if Pramaan is sold or merged.
- We do not sell personal data.
8. AI models
- Some superpowers send your input to an AI model provider, as you ask.
- The Home assistant sends what you type to a model provider, on Pramaan's own account.
- We may use usage data, and aggregated, de-identified information, to run and improve the Service. We never train AI models on builders' inputs or outputs.
- Text and AI-judgment models: our agreements with model providers do not allow them to train on this data.
- Image, video and audio generation: the provider keeps the generated file briefly so it can be delivered, under that provider's own terms.
9. International transfers
- Our hosting, database and subprocessors run in the United States and the EU.
- Where the law requires it, we use Standard Contractual Clauses, with the UK addendum for UK data.
10. Your rights
- Depending on where you live, you can ask to access, correct, export or delete your data, and to restrict or object to its processing. You can also withdraw consent.
- Builders: many of these you can do in Settings. For the rest, email privacy@pramaan.dev.
- People a builder looked up or messaged: contact the builder first. You can also contact us, and we will pass the request on or help.
- Pramaan Data: ask us directly to erase a record about you.
- We answer within 30 days and will not treat you differently for asking.
- You can complain to your local data protection authority.
11. Security
See Security. In short:
- credentials and stored answers are encrypted;
- every workspace is kept separate from the others;
- keys are shown once;
- results do not name providers.
If a breach affects your data, we will tell you and the regulator as the law requires.
12. Cookies
We use cookies that the app needs to work (sign-in and session, workspace choice), and none for advertising. Full list: Cookies.
13. Children
The Service is not for anyone under 18, and we do not knowingly collect children's data. If you think a child has signed up, tell us and we will delete the account.
14. Changes
We will post changes here and update the date. For material changes (a new purpose, a new kind of data, a new kind of subprocessor) we will tell builders in advance by email or in the app.