Privacy Policy

Information you provide

• Account and identity data: name, email address, phone number, password or sign-in identifiers, business name and details.
• Content: text, images, logos, menus, prompts, survey and form responses, support requests, and anything else you submit or direct us to use in building and editing your sites.
• Communications: emails, chat messages, and text messages you exchange with us, including with our automated AI systems.
• Payment data: processed by our payment processors (such as Stripe); we receive transaction records and limited card metadata but not full card numbers.

Information collected automatically

• Usage and device data: IP address, browser and device type, operating system, pages viewed, referring URLs, timestamps, feature usage, build and edit activity, and approximate location derived from IP.
• Cookies and similar technologies: session cookies that keep you signed in, security and anti-abuse tools (including Cloudflare services such as Turnstile), preference storage, and analytics (see Section 6).
• Log and telemetry data generated as the Services run, including records of AI-assisted build and edit steps.

Information from other sources

• Sign-in providers: if you sign in with Google, we receive your name, email address, and profile identifiers.
• Publicly available business information: to provide and market the Services — for example to prepare a website preview for a business — we may collect information about businesses from public sources such as search engines, maps and business-listing services, directories, and public websites. If we have prepared materials about your business and you would like them removed, contact dev@prototypical.ai.
• Service providers and partners, such as fraud-prevention and communications providers.

We use information for the following purposes, and for other purposes we describe when we collect it or that are compatible with these:

• Providing and operating the Services, including generating, hosting, editing, and publishing sites and sending transactional messages.
• Processing payments, metering usage, and managing plans, trials, and entitlements.
• Developing, maintaining, and improving the Services and our systems — including training, fine-tuning, evaluating, and improving our software, workflows, and AI and automated systems, using de-identified or aggregated data where required by applicable law.
• Communicating with you about the Services, including service announcements, security alerts, and (with any legally required consent) marketing.
• Securing the Services: authentication, fraud and abuse prevention, rate limiting, debugging, and enforcing our terms and policies.
• Complying with law, responding to legal process, and protecting the rights, safety, and property of ProtoPal, our users, and others — including responding to content that suggests a risk of harm to any person.
• Creating aggregated or de-identified data, which is no longer subject to this Policy, and which we may use and retain for any lawful purpose.

AI processing: content you submit and content we generate for you may be processed by third-party AI model providers (for example, models hosted on Google Cloud) under agreements that restrict their use of the data to providing services to us.

We do not sell personal information, and we do not share personal information with third parties for cross-context behavioral advertising. We share information with:

• Service providers that process it on our behalf — hosting and infrastructure (Google Cloud), content delivery and security (Cloudflare), payments (Stripe), messaging carriers and providers (such as Twilio), email delivery (such as Resend), sign-in and business-data services (Google), analytics, and AI model providers.
• The public, when you publish a site or content through the Services — published sites are public by design.
• Professional advisors, and parties to a corporate transaction (merger, acquisition, financing, or sale of assets), in which case information may be transferred as a business asset.
• Law enforcement, regulators, and other parties when we believe disclosure is required by law or appropriate to protect rights, safety, or the integrity of the Services.

Text-messaging consent and phone numbers are never shared with third parties or affiliates for their own marketing or promotional purposes.

We retain information for as long as we consider it reasonably necessary for the purposes described in this Policy, which may include the life of your account and a period afterward. Factors we weigh include the nature of the data, our legal and contractual obligations, the need to resolve disputes and enforce agreements, security and fraud-prevention needs, and legitimate business purposes such as record-keeping, analytics, and improving the Services.

• We may retain records after account closure, including where needed for backups and archives, billing and tax records, audit trails, dispute resolution, abuse prevention, and legal compliance.
• Copies of information may persist in routine backups and logs for a period after deletion from live systems.
• We may retain aggregated or de-identified data indefinitely.
• We may also delete or anonymize information at any time (including after account closure or extended inactivity) without notice, and we have no obligation to store, return, or provide copies of content or data — export anything you need before closing your account.

• Access, correction, deletion. You can access and update account information in the product, and you may request access to, correction of, or deletion of your personal information by emailing dev@prototypical.ai. We will honor requests to the extent required by applicable law, subject to verification of your identity and to the retention grounds described in Section 4.
• Marketing. You can opt out of marketing email via the unsubscribe link in any message, and out of text messages by replying STOP (see the SMS Terms). We may still send transactional and account messages.
• Cookies. You can control cookies through your browser; blocking essential cookies may break sign-in and other features. We do not currently respond to “Do Not Track” signals.
• State and regional privacy laws. Where laws such as U.S. state privacy acts or the GDPR apply to you, you may have additional rights (for example portability, restriction, objection, or appeal of a refused request), which you can exercise via dev@prototypical.ai. We will not discriminate against you for exercising your rights. Where those laws apply, our processing rests on performance of contract, legitimate interests, consent, and legal obligation.
• Visitors to customer sites. Sites our customers publish are controlled by those customers. Requests about a customer’s site content should go to that business; we act as a service provider for the information they collect through their sites.

We use essential cookies (sign-in sessions, security, load balancing, anti-bot verification such as Cloudflare Turnstile), functional storage (preferences, saved form state), and analytics that help us understand how the Services are used and improve them. Analytics data is used in aggregate; we do not use third-party advertising cookies on our own sites. Third-party providers (for example Cloudflare and analytics vendors) may set cookies necessary to deliver their services to us.

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit, access controls, and isolation of private services. No system is completely secure, and we cannot guarantee the security of any information; you use the Services at your own risk and should protect your credentials and sign-in links.

The Services are for business use and are not directed to anyone under 18. We do not knowingly collect personal information from children under 13 (or the higher age required by local law). If you believe a child has provided us information, contact dev@prototypical.ai and we will delete it as required by law.

We are based in the United States and process information on servers in the United States. If you use the Services from elsewhere, you understand that your information will be transferred to and processed in the United States and other countries, which may have different data-protection rules than your jurisdiction.

We may update this Policy from time to time. The updated version takes effect when posted (or on a stated effective date). For material changes we will provide reasonable notice, such as by email or a notice in the Services. Your continued use after changes take effect means you accept the updated Policy.

Prototypical LLC (d/b/a ProtoPal), South Carolina, United States. Privacy questions and requests: dev@prototypical.ai.