Last Updated: June 27, 2026
This Privacy Policy (the “Policy”) explains how ________________ (“PRUVY”, “we”, “us”, or “our”) collects, uses, discloses, and otherwise processes personal data when you access or use the PRUVY platform, including all related websites, applications, software, tools, features, and services (collectively, the “Service”), made available through the platform at: https://pruvy.ai
This Policy applies to personal data processed in connection with your use of the Service, your interactions with us (including through support channels, communications, and marketing activities), and any other activities described in this Policy.
This Policy should be read together with our Terms of Use, available at https://pruvy.ai, which govern your access to and use of the Service, and our Cookie Notice, which explains how we use cookies and similar technologies. Capitalized terms not defined in this Policy have the meanings given to them in the Terms of Use.
By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you must not access or use the Service.
1.1. For the purposes of applicable data protection laws, including the General Data Protection Regulation (GDPR), the data controller responsible for the processing of personal data under this Policy is:
________________ is a private limited liability company incorporated under the laws of ________________, company registration number: ________________, registered address: ________________.
1.2. This Policy applies to the processing of personal data in connection with your access to and use of the Service, including, without limitation:
1.3. The Service is offered to users worldwide. This Policy is primarily governed by and drafted in accordance with European Union data protection laws, including the GDPR, and applies to the processing of personal data of individuals located in the European Economic Area (EEA) or UK. Where you access or use the Service from outside the EEA or UK, your personal data may nevertheless be processed in accordance with this Policy and applicable international data protection requirements.
1.4. We may update or modify this Policy from time to time to reflect changes in our data processing practices, the Service, or applicable legal requirements. Any updated version of this Policy will be made available through the Service and will be identified by an updated “Last Updated” date at the top of this document. Where required by applicable law, or where changes materially affect your rights or the manner in which we process personal data, we may provide additional notice, such as through in-Service notifications or other reasonable means. Your continued use of the Service after the effective date of an updated Policy constitutes your acknowledgment of the updated Policy.
1.5.1. This Policy is designed to be compatible with, and to give effect to, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation, or “GDPR”), as well as the UK GDPR and the Data Protection Act 2018 in relation to individuals in the United Kingdom. Where any provision of this Policy is inconsistent with the GDPR in respect of individuals to whom the GDPR applies, the GDPR shall prevail.
1.5.2. We process personal data in accordance with the data protection principles set out in Article 5 of the GDPR. In particular, personal data is: (a) processed lawfully, fairly, and in a transparent manner (“lawfulness, fairness, and transparency”); (b) collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes (“purpose limitation”); (c) adequate, relevant, and limited to what is necessary for the purposes for which it is processed (“data minimisation”); (d) accurate and, where necessary, kept up to date (“accuracy”); (e) kept in a form that permits identification for no longer than necessary for the purposes of processing (“storage limitation”); and (f) processed in a manner that ensures appropriate security of the personal data (“integrity and confidentiality”). We are responsible for, and able to demonstrate compliance with, these principles (“accountability”).
1.5.3. The lawful bases on which we rely under Articles 6 and, where applicable, 9 of the GDPR are described in Section 4 (Legal Bases for Processing). The rights available to data subjects under Chapter III of the GDPR (Articles 12 to 23) are described in Section 10 (User Rights), and information regarding international transfers under Chapter V of the GDPR is described in Section 8 (International Data Transfers and Cross-Border Transfer of Information).
1.5.4. Where we are required to appoint a representative in the European Union under Article 27 of the GDPR and/or a representative in the United Kingdom, the details of such representative are set out below. Where required, our Data Protection Officer or designated privacy contact may be reached using the details in Section 16 (Contact Information).
EU/UK Representative: ________________
2.1. We collect and process different categories of personal data depending on how you access or use the Service, the features you use, and your interactions with us. The categories of personal data we may collect are described below:
When you create an Account or otherwise use the Service, we may collect account and contact information, including your name, username, email address, login credentials (stored in hashed or encrypted form), company or organization details (where you use the Service in a professional capacity), and account preferences or settings. This information is required to create and administer your Account, authenticate you, and provide access to the Service.
If you subscribe to a paid plan or otherwise make purchases through the Service, we may collect information related to your subscription and billing status, such as your selected subscription plan, billing cycle, invoice information, transaction references, and payment status. We do not store full payment card numbers or other complete payment instrument details on our systems.
Payments for subscriptions and other paid features of the Service are processed by third-party payment service providers. These providers collect and process your payment information in accordance with their own terms and privacy policies. PRUVY receives only limited information necessary to confirm and administer the transaction, such as payment confirmation, transaction identifiers, billing status, and related metadata.
When you use the Service, you may submit or upload content for review and receive quality-assurance results in return. This may include:
Inputs and Outputs may contain personal data to the extent that such information is included by you. You are responsible for ensuring that you do not submit personal data of third parties or any sensitive personal data unless you have a valid legal basis and all required permissions to do so.
We may automatically collect technical and usage information when you access or use the Service. This may include your IP address, device identifiers, browser type and version, operating system, log files, access times, usage events, error reports, and performance or diagnostic data.
We use cookies and similar technologies to operate and improve the Service, enable core functionality, analyse usage, and, where applicable, support optional features. Depending on your preferences and applicable law, this may include strictly necessary cookies, analytics cookies, and other optional cookies. Further information about our use of cookies and similar technologies is provided in our Cookie Notice.
If you contact us or otherwise communicate with us, we may collect and process the information you provide, such as support requests, emails, messages, feedback, survey responses, or other communications.
In certain cases, we may receive personal data from third parties, such as social login providers (where you choose to use such functionality), service providers acting on our behalf, or publicly available sources, to the extent relevant and permitted by applicable law.
The Service may allow you to invite or refer other individuals, or to collaborate with team members. In such cases, we may process limited contact information relating to those individuals solely for the purpose of delivering the invitation or facilitating the relevant feature, and only where you have obtained the necessary permissions to share such information.
3.1. We process personal data for the purposes described below, depending on how you access or use the Service, the features you use, and your interactions with us:
We use personal data to provide, operate, and maintain the Service, including to create and manage Accounts, authenticate users, process Inputs, produce and deliver Outputs, store User Content, and ensure the proper functioning and availability of the Service.
We use personal data to administer user Accounts and subscriptions, including to manage billing cycles, process renewals and cancellations, send account-related notifications, and provide customer support and assistance.
We process personal data as necessary to facilitate transactions, issue invoices and receipts, maintain financial records, and comply with applicable accounting, tax, and financial reporting obligations.
We use personal data to protect the security and integrity of the Service, prevent and detect fraud, abuse, and unauthorized activities, enforce our Terms of Use, investigate potential violations, and comply with applicable legal and regulatory requirements.
We use personal data to analyse how the Service is used, monitor performance, diagnose technical issues, and improve the functionality, reliability, and user experience of the Service. Where possible, such analysis is performed using aggregated or de-identified data and is carried out in a manner that does not involve training artificial intelligence models on User Content unless expressly disclosed otherwise.
Where permitted by applicable law, we may use personal data to send you product updates, service-related announcements, and promotional communications. You may opt out of receiving marketing communications at any time by following the unsubscribe instructions provided in such communications or by contacting us.
We process personal data as necessary to comply with applicable laws, lawful requests from public authorities, regulatory requirements, and to establish, exercise, or defend legal claims and protect our rights and the rights of others.
We may create and use aggregated, anonymized, or de-identified data derived from personal data for statistical, analytical, and business purposes. Such data does not identify you and is not considered personal data under applicable data protection laws.
4.1. For individuals located in the European Union, the EEA or UK, personal data is processed in accordance with the GDPR and on one or more applicable legal bases, as set out below, depending on the purpose of processing.
We process personal data where such processing is necessary to provide the Service in accordance with the Terms of Use accepted by you. This includes, for example, enabling access to the Service, creating and managing Accounts, processing subscriptions, producing and delivering Outputs, and providing customer support.
We process personal data based on your consent where required by applicable law. This may include, for example, sending marketing communications or using non-essential cookies or similar technologies. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before such withdrawal.
We process personal data where such processing is necessary for our legitimate interests, provided that such interests are not overridden by your fundamental rights and freedoms. These legitimate interests may include operating and improving the Service, ensuring its security and integrity, preventing fraud and abuse, enforcing the Terms of Use, and conducting internal business operations.
We process personal data where such processing is necessary to comply with a legal obligation to which we are subject, including obligations relating to accounting, taxation, regulatory compliance, and responses to lawful requests from public authorities.
5.1. Use of AI systems (transparency). The Service uses artificial intelligence systems to analyse User Content and produce Outputs such as quality-assurance assessments, compliance checks, scores, flags, and recommendations. When you use these features, you are interacting with an AI system. PRUVY provides this information in accordance with applicable transparency requirements, including Regulation (EU) 2024/1689 (the “EU AI Act”).
5.2. Purpose and limitations. The AI systems used by the Service are intended to assist with the review of content against platform policies, brand requirements, and campaign or quality criteria. Outputs are provided for informational and decision-support purposes only, may not be complete or error-free, and should not be relied upon as a definitive legal, regulatory, or compliance determination. You remain responsible for any decision you make on the basis of an Output.
5.3. Human oversight. The Service is designed to support, and not replace, human judgement. We recommend that Outputs be reviewed by a person before any decision with legal or similarly significant effect is taken, and the Service does not remove your ability to exercise such oversight.
5.4. No automated decisions about individuals; no profiling. PRUVY does not use the AI systems to make decisions that produce legal or similarly significant effects concerning individuals on a solely automated basis, and does not carry out profiling of individuals within the meaning of Article 22 of the GDPR. Automated analysis performed by the Service is directed at the content submitted for review, and not at evaluating, scoring, or making decisions about the natural persons who may appear in or submit that content.
5.5. Training of AI models. We do not use your User Content to train artificial intelligence models unless expressly disclosed to you and, where required by applicable law, with your consent. Where Inputs are processed by third-party AI model providers solely to generate Outputs, such processing is described in Section 7 (How We Share Personal Data).
5.6. Prohibited and high-risk uses. You must not use the Service for any purpose prohibited under the EU AI Act or that would cause the Service to operate as a high-risk AI system without the safeguards required by law. This includes refraining from using Outputs to evaluate, rank, or make consequential decisions about individuals (for example in relation to employment, access to services, or similar matters). You are responsible for ensuring that your use of the Service and of any Outputs complies with the EU AI Act and other applicable laws.
We have implemented appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify affected individuals and the relevant supervisory authority in accordance with applicable data protection laws.
7.1. We may share personal data with trusted third-party service providers that process data on our behalf for the purpose of operating, maintaining, and improving the Service. This may include providers of hosting and cloud infrastructure, technical and customer support tools, analytics services, security services, and email or communication delivery platforms. Such service providers act as data processors and are contractually required to process personal data only in accordance with our instructions and applicable data protection laws.
7.2. Payments for subscriptions and other paid features of the Service are processed by independent third-party payment providers. These providers process personal data under their own terms and privacy policies and act as separate data controllers in relation to payment data. PRUVY does not control and is not responsible for the data processing practices of such payment providers, beyond receiving limited transaction confirmations and billing metadata necessary for accounting and subscription administration.
7.3. Certain features of the Service rely on third-party artificial intelligence model providers and infrastructure providers to analyse Inputs and produce Outputs. In such cases, Inputs may be transmitted to these providers solely for the purpose of generating Outputs and operating the Service. Users are strongly advised not to include personal data of third parties or any sensitive personal data in their Inputs. PRUVY does not control how third-party providers process data beyond the scope required to produce Outputs.
7.4. The Service may allow you to publish, share, or otherwise make certain content available to other users or third parties, including by sharing Outputs or reports with collaborators, brands, agencies, or other recipients. Any personal data included in content that you choose to share will be disclosed according to your instructions and settings. Once content is shared, PRUVY cannot control further use, copying, or redistribution of such content by recipients.
7.5. We may disclose personal data where required to do so by applicable law, regulation, court order, or other legally binding request, or where disclosure is necessary to protect the rights, property, or safety of PRUVY, our users, or third parties. This may include disclosures to courts, regulators, law enforcement authorities, or other competent public bodies.
7.6. Personal data may be disclosed in connection with actual or contemplated corporate transactions, such as mergers, acquisitions, reorganizations, asset sales, financing, or similar business transfers. In such cases, personal data may be shared with relevant counterparties and advisers subject to appropriate confidentiality and data protection safeguards, and in accordance with applicable law.
8.1. The Service is operated globally, and personal data we collect may be transferred to, stored in, and processed in countries other than the country in which you are located, including countries that may not provide the same level of data protection as your country of residence. This may occur where our service providers, infrastructure, or affiliates are located in, or process data from, such countries.
8.2. Where personal data is transferred outside the European Economic Area (EEA) or the United Kingdom, PRUVY will ensure that such transfer is carried out in accordance with applicable data protection laws and subject to appropriate safeguards providing an adequate level of protection. These safeguards may include transfers to countries that benefit from an adequacy decision of the European Commission (or, where applicable, the UK authorities), or the use of European Commission-approved Standard Contractual Clauses (and the UK International Data Transfer Agreement or Addendum, where applicable) together with any additional measures required to protect the transferred data.
8.3. Where personal data of individuals located in Brazil is transferred internationally, PRUVY will carry out such transfers in accordance with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, “LGPD”), including on the basis of adequacy, appropriate contractual safeguards, your consent, or another legal basis permitted under the LGPD.
8.4. By using the Service, where permitted by applicable law, you understand that your personal data may be transferred and processed as described in this Policy. You may contact us using the details in Section 16 to request further information about the safeguards applied to such transfers.
9.1. We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and processed, as described in this Policy, and to comply with applicable legal, accounting, tax, and regulatory requirements.
9.2. The retention period for personal data depends on the category of data, the purpose of processing, and applicable legal obligations. In particular:
Account and contact information is generally retained for as long as your Account remains active. Following account termination, such data may be retained for a limited period where necessary for account administration, dispute resolution, enforcement of the Terms of Use, or compliance with legal obligations.
Billing information, invoices, transaction references, and related financial records are retained for the period required under applicable accounting, tax, and financial reporting laws.
Technical logs, usage data, and security-related information may be retained for limited periods to ensure the security and integrity of the Service, monitor performance, investigate incidents, and prevent fraud or abuse.
User Content, including Inputs and Outputs, is retained for as long as necessary to provide the Service and in accordance with your account settings. Upon account termination, User Content may be deleted or anonymized, subject to technical constraints and legal or regulatory retention requirements.
Personal data collected through communications, customer support interactions, referrals or invitations, cookies, similar technologies, or received from third parties is retained only for as long as necessary to fulfil the purposes for which it was collected, to provide the relevant feature or interaction, or to comply with applicable legal or operational requirements.
9.3. Where personal data is no longer required for the purposes for which it was collected, and where no legal obligation requires further retention, such data will be deleted, anonymized, or otherwise securely disposed of in accordance with applicable data protection laws.
10.1. Subject to applicable data protection laws, you have certain rights in relation to the personal data we process about you, as described below. These rights may apply depending on your location and the circumstances of the processing.
You have the right to request confirmation as to whether we process personal data relating to you and, where that is the case, to request access to such personal data and certain information about how it is processed.
You have the right to request the correction or updating of inaccurate or incomplete personal data concerning you.
You have the right to request the deletion of your personal data where permitted by applicable law, including where the data is no longer necessary for the purposes for which it was collected, or where processing is based on consent that has been withdrawn and no other legal basis applies.
You have the right to request that we restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or object to the processing and verification is pending.
You have the right to object to the processing of your personal data where such processing is based on our legitimate interests. Where you object, we will stop processing your personal data unless we demonstrate compelling legitimate grounds for the processing or the processing is required for the establishment, exercise, or defence of legal claims. You also have the right to object at any time to the processing of your personal data for direct marketing purposes.
Where processing is based on your consent or on the performance of the Terms of Use and is carried out by automated means, you have the right to request to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to request that such data be transmitted to another controller where technically feasible.
Where we process personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.
Complaints relating to the processing of any personal data may be communicated electronically at privacy@pruvy.ai. Complaints may also be lodged before the supervisory authority responsible for the protection of personal data, in the country of your habitual residence, place of work, or place of the alleged infringement of your personal data. More information about how to contact the supervisory authorities across the EEA can be found on the European Data Protection Board’s website at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
10.10. You may exercise your rights by contacting us through the contact details provided in this Policy. We may request additional information to verify your identity before responding to a request. We will respond to your request within the timeframes required by applicable law. Where permitted by law, we may refuse or limit requests that are manifestly unfounded, excessive, or otherwise not required to be fulfilled.
11.1. We use cookies and similar technologies in accordance with applicable laws, including the EU ePrivacy Directive (Directive 2002/58/EC, as implemented in national law) and the GDPR. Strictly necessary cookies, which are required to operate the Service, are used without consent. For all other cookies and similar technologies that are not strictly necessary — such as analytics, functionality, and (where applicable) advertising cookies — we will obtain your prior consent through a cookie banner or consent management tool before they are placed on your device, where such consent is required by applicable law.
11.2. Where consent is required, you may give, decline, or withdraw your consent at any time, and withdraw or change your preferences through the cookie settings or consent management tool made available through the Service. Withdrawing consent does not affect the lawfulness of processing carried out before such withdrawal.
11.3. You can also manage cookies and similar tracking technologies through your browser settings. Most browsers allow you to control cookies, including blocking or deleting existing cookies, and to configure preferences for future cookie usage. Please note that disabling certain cookies may affect the functionality or availability of some features of the Service.
11.4. We honour recognised opt-out preference signals where required by applicable law, including the Global Privacy Control (GPC) signal, as further described in Section 14 (Your California Privacy Rights).
11.5. Further information about the types of cookies we use, their purposes, and how you can manage your preferences is provided in our Cookie Notice, which forms an integral part of this Policy.
We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures are intended to ensure a level of security appropriate to the risks associated with the processing of personal data, taking into account the nature of the data and the state of the art.
However, no system or method of transmission over the internet or electronic storage is completely secure. While we strive to protect personal data, we cannot guarantee its absolute security.
13.1. The Service is intended for business and professional users and is not directed to or intended for use by children. We do not knowingly collect or process personal data of children under the age of 18 without appropriate parental or legal guardian consent, where such consent is required by applicable law. We do not knowingly sell or share the personal information of consumers under 16 years of age.
13.2. Where applicable law sets a different minimum age for consent to the processing of personal data (for example, 13 years of age under certain laws such as the U.S. Children’s Online Privacy Protection Act, or up to 16 years of age under the GDPR and the LGPD), we will apply the age threshold required in the relevant jurisdiction.
13.3. If you are a parent or legal guardian and believe that a child has provided personal data to us without the required consent, please contact us using the details in Section 16. Upon becoming aware that personal data of a child has been collected in violation of applicable law, we will take reasonable steps to delete such data as soon as practicable.
14.1. This Section applies to residents of the State of California and supplements the other parts of this Policy. It is provided in accordance with the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), and the California Online Privacy Protection Act (“CalOPPA”). Terms such as “personal information”, “sell”, and “share” have the meanings given to them under the CCPA.
14.2. Categories of personal information. The categories of personal information we collect, the purposes for which we use them, and the categories of third parties with whom we share them are described in Sections 2, 3, and 7 of this Policy. We collect personal information such as identifiers and contact details, account and commercial information, internet and other electronic activity information, and the contents of User Content you submit.
14.3. No sale of personal information. We do not sell your personal information for money. We do not knowingly sell or share the personal information of consumers under 16 years of age. To the extent that the use of certain cookies, analytics, or advertising technologies may be considered “sharing” or a “sale” under the CCPA, you may opt out as described below.
14.4. Your California rights. Subject to the CCPA and verification of your identity, California residents have the right to: (a) know and access the categories and specific pieces of personal information we have collected about them; (b) request deletion of their personal information; (c) request correction of inaccurate personal information; (d) opt out of the “sale” or “sharing” of personal information and limit the use of sensitive personal information; and (e) not receive discriminatory treatment for exercising these rights.
14.5. How to exercise your rights and opt-out signals. You may exercise these rights by contacting us using the details in Section 16. We also recognise opt-out preference signals, including the Global Privacy Control (GPC), and will treat a valid GPC signal as a request to opt out of the “sale” or “sharing” of personal information for the relevant browser or device. You may use an authorised agent to submit requests on your behalf, subject to verification.
14.6. “Do Not Track” disclosure. Some browsers offer a “Do Not Track” (DNT) feature. Because there is no common industry standard for interpreting DNT signals, the Service does not currently respond to DNT signals; however, we honour the GPC signal as described above.
15.1. This Section applies to data subjects located in Brazil and supplements the other parts of this Policy. It is provided in accordance with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, Law No. 13.709/2018, the “LGPD”). Where the LGPD applies, PRUVY acts as the controller (controlador) of your personal data and processes it on the legal bases set out in Articles 7 and 11 of the LGPD, which correspond to the legal bases described in Section 4 of this Policy.
15.2. Your LGPD rights. Subject to the LGPD, you have the right to: (a) confirm the existence of processing; (b) access your personal data; (c) correct incomplete, inaccurate, or outdated data; (d) request the anonymization, blocking, or deletion of unnecessary or excessive data or data processed in non-compliance with the LGPD; (e) request the portability of your data to another service or product provider; (f) request the deletion of personal data processed on the basis of your consent; (g) obtain information about the public and private entities with which we have shared your data; (h) obtain information about the possibility of refusing consent and the consequences of such refusal; and (i) withdraw your consent at any time.
15.3. How to exercise your rights. You may exercise your LGPD rights by contacting us using the details in Section 16. We will respond within the timeframes required by the LGPD. You also have the right to lodge a complaint with the Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados, “ANPD”).
15.4. Data Protection Officer / point of contact. Requests, questions, and communications regarding the processing of personal data under the LGPD may be addressed to our point of contact at privacy@pruvy.ai.
If you have any questions, requests, or concerns regarding this Policy or the processing of personal data, you may contact us using the details below:
Email: privacy@pruvy.ai
Registered address: ________________