Prozly
ende

Privacy Policy

Last updated: September 2, 2026

Prozly ("we", "us") provides a content automation platform that turns your expertise into ready-to-publish social media content. This policy explains what personal data we process, why, and what rights you have. It applies to our website (prozly.ai), the Prozly application, and the Prozly Chrome extension. The German version of this policy is available at /datenschutz; details of the data controller are in our Impressum.

1. Data we process

Account data

When you create an account we process your name, email address, and authentication credentials. Authentication is handled by Supabase; we never see or store your plaintext password. If you sign in with LinkedIn, we receive your basic profile (name, email, profile picture) from LinkedIn.

Workspace and content data

Content you add to Prozly — sources you connect (RSS feeds, websites, YouTube channels, LinkedIn pages), brain dumps, voice notes, drafts, brand voice settings, and uploaded brand knowledge — is stored to provide the service. It belongs to you.

Connected social accounts

If you connect LinkedIn or Instagram for publishing, we store OAuth access tokens (encrypted). We never store your social media passwords, and you can revoke access at any time from your account settings or the platform's own security settings.

Billing data

Payments are processed by Stripe. We do not store card numbers; we store your subscription status, plan, and usage records (e.g. AI credits used) needed for billing.

Usage and technical data

We process log data (IP address, browser type, timestamps) to operate and secure the service, and privacy-friendly, aggregated analytics on our marketing website (no cross-site tracking profiles).

2. AI processing

Prozly's core feature is AI-assisted content generation. To generate summaries, drafts, and images, relevant content from your workspace (e.g. a source article, your brain dump, your brand voice settings) is sent to our AI providers — OpenAI (text and images) and Google (Gemini, images). Under our API agreements with these providers, your data is not used to train their public models. We only send what is needed for the specific generation you request.

3. Purposes and legal bases (GDPR)

  • Providing the service (account, workspaces, content generation, publishing) — Art. 6(1)(b) GDPR (performance of a contract).
  • Billing and accounting — Art. 6(1)(b) and 6(1)(c) GDPR (legal obligations).
  • Security, abuse prevention, and service improvement — Art. 6(1)(f) GDPR (legitimate interest).
  • Product emails and marketing communications — Art. 6(1)(a) GDPR (consent, revocable at any time).

4. Processors and recipients

We use a small set of processors under data processing agreements:

  • Supabase — database, authentication, file storage
  • Vercel — application hosting and website analytics
  • OpenAI — AI text and image generation
  • Google — AI image generation (Gemini)
  • Stripe — payment processing
  • Microsoft Azure — transactional email delivery

When you publish to LinkedIn, Instagram, or other platforms, the content is transferred to the respective platform under your instruction and their terms apply.

5. International transfers

Some providers process data outside the EU/EEA (notably in the United States). Where that happens, transfers are protected by the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

6. Retention

We keep your data for as long as your account exists. When you delete your account, your workspace content is deleted; billing records are retained as long as commercial and tax law requires. Log data is kept for a short, rolling window for security purposes.

7. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (Art. 15),
  • correct inaccurate data (Art. 16),
  • have your data deleted (Art. 17),
  • restrict processing (Art. 18),
  • data portability (Art. 20),
  • object to processing based on legitimate interest (Art. 21), and
  • withdraw consent at any time with effect for the future (Art. 7(3)).

You also have the right to lodge a complaint with a data protection supervisory authority.

8. Cookies and analytics

Our marketing website uses Google Analytics only if you consent via the cookie banner; without consent, no analytics cookies are set, and you can change your choice at any time via the cookie settings. The Prozly application uses strictly necessary cookies for authentication. See our Cookie Policy for details.

9. Chrome browser extension

The optional Prozly Chrome extension connects your browser to your existing Prozly workspace. When you connect it, a one-time code is exchanged for an access token that is stored locally in your browser — never your password. The extension processes data only to provide its features: the title, URL, and selected text of pages you explicitly save to your workspace; the text of LinkedIn posts for which you request comment suggestions; and — only if you enable the optional Brand Feed Capture — high-engagement LinkedIn posts from your feed (limited to 30 per day), saved to your workspace as content inspiration.

All of this data is sent exclusively to your own workspace and processed as described in this policy (legal basis: Art. 6(1)(b) GDPR; Brand Feed Capture only after you switch it on, revocable at any time). The extension does not collect your browsing history, does not post, like, or message on LinkedIn on your behalf, and stops processing entirely when you disable capture, disconnect the workspace, or uninstall it.

10. Contact

For any privacy request or question, contact us at privacy@prozly.ai. We answer data subject requests within the statutory deadlines.

Privacy Policy — Prozly · Prozly