This Privacy Policy explains how Pronoa, Inc. (“Pronoa,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information in connection with our decision-intelligence platform and related websites and services (collectively, the “Services”). It applies to visitors to our websites, prospective customers who interact with us and, to a limited extent, individuals (and not businesses) who register for or use the Services.
Our role. This Privacy Policy applies to the personal information for which Pronoa itself acts as a business or controller. This applies to personal information of (1) website users or other individuals we may have personal information regarding prior to a business relationship (e.g. prospective customers), and (2) individual customers (and not businesses) solely with respect to such individual’s account, contact, billing, and website-usage information or such other personal information indicated below (such individuals under subsections (1) and/or (2) collectively, “Covered Individuals”). This Privacy Policy applies to personal information of Covered Individuals and does not apply to any personal information that is included in any Customer Data (as defined in our Terms of Service or Platform Agreement and by way of example includes any business documents and other inputs a customer submits into the Services (e.g. customer decision materials)), and in such case the customer is the controller of such personal information and Pronoa acts as a processor or service provider on the customer’s documented instructions, as described in the Terms of Service and the Platform Agreement (as may be applicable to you). Notwithstanding anything herein to the contrary, our Data Processing Addendum (https://pronoa.io/dpa) applies to all processing of personal information included in Customer Data (whether the customer submitting such Customer Data is an individual or a business). This Privacy Policy does not govern how a customer decides to use the Services, and it is not a substitute for the customer’s own privacy notices to its personnel if a customer is a business or controller.
Not for sensitive or regulated data. The Services are not designed to collect significant personal information and must not be used to submit sensitive information, protected health information, or payment card data into decision content. Please do not provide such information to the Services except as expressly described here.
1.Information we collect
We collect the following categories of personal information from Covered Individuals:
- Account and identity information. Name, business email address, and similar registration details and account information we require to create and maintain an Authorized User account, as required to use the Services as more fully set forth in our Terms of Service and Platform Agreement.
- Contact and communications information. Information you provide when you contact us, request a demonstration, correspond with support, or subscribe to communications, including your name, email, telephone number, and the contents of your messages.
- Billing information. Billing contact details and transaction records. Card and bank payment details are collected and processed by our payment processor; we do not store full payment card numbers.
- Usage and device information. Limited technical information necessary to operate, support and secure the Services, such as IP address, browser and device type, and requested pages, recorded in standard server and security logs by our hosting providers. We do not use analytics or advertising technologies, and we do not use this information to track or profile visitors. Where required by applicable law, IP addresses and similar identifiers are treated as personal information.
Notwithstanding the foregoing, if you are an employee or representative of a business, we process your personal information in accordance with our Data Processing Addendum as your employer or the company you are representing is the controller of such personal information and not us. This Privacy Policy does not apply in such situations. As described above, all personal information contained in Customer Data is processed in accordance with our Data Processing Addendum no matter the type of customer (it applies to both business and individual customers).
2.How we use personal information
We use personal information of Covered Individuals to: provide, maintain, and secure the Services; create and administer accounts and authenticate Authorized Users; process transactions and manage billing; respond to inquiries and provide support; communicate with you about the Services, including service and security notices; understand and improve how our websites and Services are used; and comply with legal obligations and enforce our agreements.
De-identified usage data. As described in our Terms of Service and Platform Agreement, we may derive de-identified, aggregated usage data for calibration, benchmarking, product improvement, analytics and other purposes as set forth therein. Such usage data is de-identified in accordance with applicable standards (including CCPA/CPRA and, where applicable, GDPR), is not reasonably linkable to any individual or customer, and never includes the content of customer decision materials or outputs.
3.Artificial-intelligence providers
Content and other inputs submitted to the Services are Customer Data. Any personal information they contain is processed under our Data Processing Addendum, which identifies our artificial-intelligence model provider and its zero-data-retention and no-training terms. We do not sell personal information of Covered Individuals, and we do not use it to train artificial-intelligence models.
5.Subprocessors
We engage the following categories of subprocessors to provide the Services. Each is engaged under terms requiring appropriate security and confidentiality:
| Subprocessor | Function |
|---|---|
| Supabase | Database, authentication, and storage; encryption at rest and tenant isolation. |
| Vercel | Application hosting and delivery. |
| Stripe | Payment processing and billing. |
| Sentry | Application error monitoring. |
| Resend | Transactional email delivery. |
| Langfuse | Model telemetry and observability; operational metadata only, not customer decision content. |
| Netlify | Marketing website hosting and website form submissions (prospect contact details). |
| Google Workspace | Email and business correspondence, including contact information you send to us. |
| DocSend | Sharing of sales and marketing materials; records the identity and engagement of people who open shared links. |
7.Data retention
For general personal information collected directly from you (such as account registration details, contact information, and billing profiles), we retain such data for as long as needed to provide the Services, maintain your account, comply with our legal obligations, resolve disputes, and enforce our agreements. When such account data or general personal information is no longer required for these purposes, we securely delete or anonymize it in accordance with standard data minimization practices. In addition the following practices apply to retention and deletion of personal information in the contexts noted:
Customer decision records. The decision log is designed to function as a permanent institutional record during a customer’s active subscription. On termination or expiration of your customer agreement, we return or delete customer data in accordance with the applicable agreement and applicable law.
Residual copies and third-party retention. Deletion applies to our active production systems. After deletion, residual copies may persist in our encrypted backups and replicas until they are expired in the ordinary course, and they remain subject to the same protections in the meantime. Separately, our subprocessors retain their own security and operational records, such as access and system logs, under their own retention practices, and certain subprocessors are legally required to retain transaction records (for example, payment records held by our payment processor) that a deletion request does not override. Those subprocessor records are limited to technical and transactional information, except that application error records may contain short fragments of text.
Mandatory Legal and Regulatory Retention. While we honor prompt deletion and data minimization requests in accordance with this Privacy Policy and applicable law, certain limited categories of data may be subject to mandatory retention periods under applicable law, requiring us to retain specific records (such as transactional metadata, billing records, tax documentation, and compliance records) beyond our standard deletion timelines to the extent required or permitted by legal, tax, or regulatory obligations, including preserving invoices and payment ledgers for federal and state tax audit windows, archiving records necessary to defend against potential legal claims or enforce our Terms of Service for the duration of the applicable statute of limitations, and maintaining compliance audit trails mandated by corporate governance frameworks, provided that any such retained information is used only for the purpose that requires its retention and is protected with security safeguards until the expiration of the mandatory holding period, at which point it is permanently deleted or securely anonymized.
8.How we protect personal information
We maintain administrative, technical, and organizational measures designed to protect personal information, including encryption in transit and at rest, tenant isolation, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9.Your privacy rights
United States (including California). Depending on your state of residence, you may have rights to know, access, correct, delete, or receive a portable copy of your personal information, and to be free from discrimination for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising. Where an individual’s personal information is contained in customer content, we will refer requests to the relevant customer as the controller.
EEA and United Kingdom. Where GDPR or UK GDPR applies, you may have rights to access, rectify, erase, restrict, or object to processing, and to data portability. Our legal bases include performance of a contract, our legitimate interests in operating and improving the Services, consent where required, and compliance with legal obligations.
To exercise any right, contact us using the details in Section 12. We will respond as required by applicable law and may need to verify your identity.
10.International data transfers
We are based in the United States, and we process personal information in the United States and in other countries where we or our subprocessors operate. The Services are provided from the United States. If you access or subscribe to the Services from the United Kingdom, the European Economic Area, or elsewhere outside the United States, your personal information will be transferred to, and processed in, the United States.
Where we transfer personal information that is subject to UK or EU data protection law to the United States, we rely on an appropriate transfer safeguard required by applicable law. Our Data Processing Addendum, which forms part of each customer agreement, incorporates the applicable Standard Contractual Clauses and, for the United Kingdom, the UK Addendum, or we rely on an applicable adequacy framework where available. It is published at pronoa.io/dpa.
11.Children
The Services are intended for business use by adults and are not directed to children. We do not knowingly collect personal information from anyone under the age of majority in their jurisdiction, and consistent with our agreements we do not collect information from children under 13.
12.How to contact us
For questions about this Privacy Policy or to exercise your rights, contact:
Pronoa, Inc.
privacy@pronoa.io
1500 N Grant St, Ste R, Denver, CO 80203, USA
13.Changes to this Policy
We may update this Privacy Policy from time to time. We will post the updated version with a revised “Last updated” date and, where required by law, provide additional notice. Your continued use of the Services after an update constitutes acceptance of the revised Policy to the extent permitted by law.
Previous version: 1 October 2026