What we hold, and what we do with it

Protegy Solutions, based in Texas, United States, is the controller of the personal information described here. Contact us at [email protected].

• Account details — your name, email address, and the business details you enter at signup: business name, industry, rough size, years trading.
• Your interview — the full transcript of your conversation with the AI consultant, which is whatever you chose to describe about how your business runs.
• Your report — the workflow map, org structure, teams, tools and recommendations generated from that interview, and any corrections you make to them.
• Purchase status — whether you have paid, and when. Card details are handled by Stripe and never reach us.
• Basic usage data — sign-in times and which parts of the product you have opened.

We do not ask for your financial records, your customer lists, or personal information about your employees. If you choose to mention such things during the interview they become part of your transcript, so share only what you are comfortable storing with us.

• To produce your analysis. Your transcript is processed by AI to build your workflow map and write your recommendations.
• To keep your report available. It is stored so you can return to it from your dashboard.
• To run your account. Sign-in, purchase status, and account emails. We do not send marketing email without your consent.
• To improve Protegy, using de-identified information only. See below.

If you are in a jurisdiction that requires a legal basis, ours is the performance of our contract with you for the first three, and our legitimate interest in improving the product for the fourth.

We use business information with identifying details removed — names, business names, contact details — to test and improve how the interview is conducted, how accurately the analysis reads a business, and how well the reports hold up.

This is genuinely how the product gets better: a real description of how a catering company takes a booking exposes weaknesses that an invented example never will.

We do not use identifiable client information for product development, we do not publish client content, and we do not provide your content to any third party to train their AI models.

If you would rather your business was excluded from this entirely, email us and we will exclude it.

We use these providers, and no others touch your content:

• Anthropic — processes your interview to generate the analysis. Anthropic’s API terms prohibit using API inputs and outputs to train their models, and your content is not retained by them beyond the call.
• Clerk — authentication, passwords and sessions. Where you sign in with Google, Google confirms your identity to Clerk; we receive your name and email address and nothing else.
• Stripe — payment processing. Stripe holds your card details; we hold only whether you paid.
• Cloudflare — traffic delivery and protection for protegyai.com.

Your account records and reports live in our own database, on infrastructure we control, reachable only by the application itself.

We do not sell, rent or license your data, and we do not share it for advertising.

You — everything, from your dashboard.

Us — Protegy staff can view accounts, interviews and reports through an administrative portal. This is how support and consulting engagements work, and it is the same access a business consultant has to the notes they keep on you. Access is limited to people who need it to run the service.

Other clients — never. Every request is authenticated and every query is scoped to your own account.

For as long as your account exists. Delete your account from Settings and your profile, interviews and reports are removed from our database immediately.

Encrypted infrastructure backups are kept on a rolling fourteen-day window, so a copy may persist there briefly before being overwritten. We do not restore deleted accounts from backups.

• See and export your data — Settings → Profile → Export My Data.
• Correct anything wrong — edit it in the product, or email us.
• Delete your account and everything in it — Settings → Profile → Danger Zone. Immediate and irreversible.
• Object to de-identified use of your information for product improvement — email us and we will exclude your business.

If you are covered by GDPR, UK GDPR or the CCPA, those regulations give you further rights, including the right to complain to your local supervisory authority. Send any formal request to [email protected] and we will respond within the time the applicable law allows.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Protegy is operated from the United States and your data is stored there. If you use the product from outside the United States, you are sending your information to the United States for processing.

All traffic is encrypted in transit using TLS 1.2 or above. Backups are encrypted and stored off-site. Authentication, passwords and sessions are handled by Clerk; card details by Stripe. Our database sits on infrastructure we control and is not exposed to the public internet.

Separation between accounts is enforced by the application: every request is authenticated and every query is scoped to the signed-in account. We do not claim database-level isolation, because we do not implement it.

No system is perfectly secure. If a breach affects your information we will tell you and the relevant authorities as the law requires.

Protegy is a business product and is not intended for anyone under 18. We do not knowingly collect information from children.

We will update this policy as the product changes, and the date at the top will show when. If a change materially affects how we handle your information, we will tell you by email before it takes effect.

[email protected] — for questions, corrections, exclusions, or a formal data request.

The commercial agreement is in our Terms of Service.