Privacy Policy

Last updated: October 16, 2026

Prozly ("we", "us") provides a content automation platform that turns your expertise into ready-to-publish social media content. This policy explains what personal data we process, why, and what rights you have. It applies to our website (prozly.ai), our help pages (docs.prozly.ai), the Prozly application, and the Prozly Chrome extension. The German version of this policy is available at /datenschutz; details of the data controller are in our Impressum.

1. Data we process

Account data

When you create an account we process your name, email address, and authentication credentials. Authentication is handled by Supabase; we never see or store your plaintext password. If you sign in with Google, we receive your basic profile (name, email, profile picture) from Google.

Workspace and content data

Content you add to Prozly is stored to provide the service: sources you connect (RSS feeds, websites, YouTube channels, LinkedIn pages), brain dumps, voice notes, drafts, brand voice settings, and uploaded brand knowledge. It belongs to you.

Connected social accounts

If you connect LinkedIn or Instagram for publishing, we store OAuth access tokens (encrypted). We never store your social media passwords, and you can revoke access at any time from your account settings or the platform's own security settings.

Billing data and free trial

Payments are processed by Stripe. We do not store card numbers; we store your subscription status, plan, and usage records (e.g. AI credits used) needed for billing. To offer the free trial once per person, we keep a record of trials started: a hash of the email address formed with a secret key (not the address itself), the Stripe customer reference and the card fingerprint Stripe provides. This record is kept after an account is deleted, so that it can serve its purpose, and is deleted 24 months after the respective trial started. It cannot be turned back into an email address and is used only to prevent repeated trials (legitimate interest, Art. 6(1)(f) GDPR).

Usage and technical data

We process log data (IP address, browser type, timestamps) to operate and secure the service. We record errors in the application with Sentry (details in Section 10). On our marketing website we use cookieless, aggregated audience measurement (Vercel Analytics) and, only with your consent, Google Analytics.

Waitlist

If you join the waitlist on prozly.ai, we store your email address, your language, and the page you signed up from, and send you an email with a confirmation link. You are only on the waitlist after you confirm. We use the address only to inform you about your access to Prozly (consent, Art. 6(1)(a) GDPR, revocable at any time by email to privacy@prozly.ai).

2. Data of people our customers involve

Some features process data of people who are not Prozly customers themselves. In these cases the respective customer is the controller and we process the data as its processor (Art. 28 GDPR) under our Data Processing Agreement. Please direct requests about this data to the customer; requests sent to us are forwarded to the customer without undue delay.

Interview links (guests)

Customers can invite colleagues, clients or experts by link to an AI-led interview. We process the guest's name and email address where the customer enters them, the topic, and the guest's answers. At the customer's request we send the invitation by email (via Microsoft Azure) and at most one reminder after 3 days; replies to these emails go to the inviting person. The link is valid for 14 days. Guests can type or speak their answers: voice recordings are sent to OpenAI to be turned into text and are not stored by us as audio files; only the text is stored, which the guest can review and edit before sending. So that an interrupted interview can be resumed, we store a session identifier in the localStorage of the guest's browser. The answers are available to the inviting customer in its workspace and are deleted when the customer deletes them or its contract ends.

Download forms and visit counts on customer blogs

Customers can run a blog with Prozly. If readers enter their email address there to receive a download, we store the email address, the time, the post and the requested download for the blog's publisher; the form states that the address goes to the publisher. Whether and how the publisher contacts you afterwards is governed by the publisher's own privacy policy. For the blogs' visit counts we set no cookies and store neither IP address nor browser identifier: a hash is formed from them with a secret key that changes daily, which only links visits of the same day and is deleted after 2 days. Daily counts per post and source (e.g. Google, LinkedIn) are stored.

Photos of people for "With you" images

Customers can add photos of people under Settings → People to create images featuring that person. Before uploading, the user confirms that they are the person shown or have that person's permission to use their photos in content, including AI-generated images of their likeness. We store this statement per person with its wording, the user and the time. The photos are kept in non-public storage in the EU. On upload, our own server code determines the position of the face in the image (a rectangle) so the photo can be cropped and placed correctly. No biometric template is created or stored, and no person is identified or recognized; only the photo and the rectangle's coordinates are stored. For an image, we send up to two photos of the person to OpenAI as references, from which OpenAI generates the image. Photos and the consent record are deleted when the customer removes the person or the photo, at the latest when the contract ends.

Web research for articles

For thoroughly researched blog articles we send search queries derived from the article topic to the Brave Search API and retrieve the public pages found, in order to cite sources. The queries usually contain no personal data unless the topic names a person.

3. AI processing

Prozly's core feature is AI-assisted content generation. To generate summaries, drafts, transcripts, and images, relevant content from your workspace (e.g. a source article, your brain dump, your brand voice settings) is sent to our AI providers: OpenAI (text, transcription, and images) and Google (Gemini, images). Under our API agreements with these providers, your data is not used to train their public models. We only send what is needed for the specific generation you request.

4. Purposes and legal bases (GDPR)

• Providing the service (account, workspaces, content generation, publishing): Art. 6(1)(b) GDPR (performance of a contract).
• Product and transactional emails (e.g. account confirmation, security notices, invoices and payment notices, team invitations, notifications and digests you have set up): Art. 6(1)(b) GDPR (performance of a contract).
• Billing and accounting: Art. 6(1)(b) and 6(1)(c) GDPR (legal obligations).
• Security, error diagnostics, abuse prevention (including the trial record), and service improvement: Art. 6(1)(f) GDPR (legitimate interest).
• Marketing emails (e.g. newsletters): only with your consent, Art. 6(1)(a) GDPR, revocable at any time with effect for the future, e.g. by email to privacy@prozly.ai.
• Google Analytics on the marketing website: only with your consent, § 25 (1) TDDDG and Art. 6(1)(a) GDPR, revocable at any time.

5. Processors and recipients

We use a small set of processors under data processing agreements:

• Supabase: database, authentication, file storage (data stored in the EU, Frankfurt)
• Vercel: application hosting, server compute (including face position detection in uploaded photos), and cookieless website audience measurement
• OpenAI: AI text and image generation, transcription of voice notes and of interview guests' spoken answers, images based on stored photos of people
• Google: AI image generation (Gemini) and, for YouTube sources you configure, retrieval of channel and video data via the YouTube Data API
• Google Analytics (Google Ireland Limited): audience analysis of the marketing website, only with your consent
• Stripe: payment processing, invoices, and VAT calculation
• Microsoft Azure: transactional email delivery, including invitations and one reminder to interview guests
• Sentry: error monitoring and performance diagnostics in the application (error reports, request metadata, workspace identifiers; session recordings with text masked and media blocked, see Section 10)
• Brave Search API: news and web search used for source discovery, brand assessment, and research for blog articles (search queries derived from your workspace settings or the article topic, e.g. brand, competitor, or topic names)
• Telegram: optional messaging channel for creating drafts by sending text or voice notes to the Prozly bot, engaged only if you connect it (your Telegram user ID and name, the messages and voice notes you send, and the bot's replies)
• Mintlify: hosting of our help pages at docs.prozly.ai (visitor log data)

When you publish to LinkedIn, Instagram, or other platforms, the content is transferred to the respective platform under your instruction and their terms apply. The list of sub-processors that process Customer Data is at /subprocessors.

6. International transfers

Some providers process data outside the EU/EEA (notably in the United States). Where that happens, transfers are protected by the EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

7. Retention

We keep your data for as long as your account exists. When you delete your account, your workspace content is deleted; billing records are retained as long as commercial and tax law requires. Log data is kept for a short, rolling window for security purposes. In addition:

• Trial record: 24 months after the respective trial started.
• Interview answers, download requests on customer blogs, and photos of people: until the customer deletes them, at the latest 30 days after the contract ends. Voice recordings are not stored.
• Daily hashes of the blog visit count: 2 days.
• Error reports and session recordings in Sentry: at most 90 days.
• Google Analytics data (only after consent): at most 14 months.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• correct inaccurate data (Art. 16),
• have your data deleted (Art. 17),
• restrict processing (Art. 18),
• data portability (Art. 20),
• object to processing (Art. 21, see Section 9), and
• withdraw consent at any time with effect for the future (Art. 7(3)).

You also have the right to lodge a complaint with a data protection supervisory authority.

9. Your right to object under Art. 21 GDPR

10. Cookies, analytics, and error diagnostics

Our marketing website uses Google Analytics only if you consent via the cookie banner; without consent, no analytics cookies are set, and you can change your choice at any time via the cookie settings. The Prozly application uses strictly necessary cookies for sign-in and no analytics or advertising cookies.

We use Sentry for error diagnostics in the application. When an error occurs, we receive an error report with technical details (e.g. browser, page visited, workspace identifier). In addition, Sentry records the course of interaction only in sessions in which an error occurs. In these recordings all text and input is masked and all images and media are blocked, so content cannot be read. For this, Sentry stores a session identifier in your browser's sessionStorage. The legal basis is our legitimate interest in a stable and secure service (Art. 6(1)(f) GDPR); you can object under Section 9. See our Cookie Policy for details.

11. Chrome browser extension

The optional Prozly Chrome extension connects your browser to your existing Prozly workspace. When you connect it, a one-time code is exchanged for an access token that is stored locally in your browser, never your password. The extension processes data only to provide its features: the title, URL, and selected text of pages you explicitly save to your workspace; the text of LinkedIn posts for which you request comment suggestions; and, only if you enable the optional Brand Feed Capture, high-engagement LinkedIn posts from your feed (limited to 30 per day), saved to your workspace as content inspiration.

All of this data is sent exclusively to your own workspace and processed as described in this policy (legal basis: Art. 6(1)(b) GDPR; Brand Feed Capture only after you switch it on, revocable at any time). The extension does not collect your browsing history, does not post, like, or message on LinkedIn on your behalf, and stops processing entirely when you disable capture, disconnect the workspace, or uninstall it.

12. AI assistants (Claude, ChatGPT and other MCP clients)

You can connect Prozly to an AI assistant such as Claude or ChatGPT (via the Model Context Protocol). You start the connection in the assistant, sign in to Prozly, and choose which workspaces the assistant may use and whether it may only read or also create and schedule content. Prozly never sees your password for the assistant, and the assistant never sees your Prozly password.

When you ask the assistant to do something in Prozly, it calls Prozly on your behalf. Prozly then returns data from the workspaces you approved, for example content ideas, drafts, content packs, your brand summary, schedules, and post analytics, and, if the workspace setting "Show file previews to AI assistants" is on, short-lived preview links to images and PDFs. Prozly receives the instructions and content the assistant sends (e.g. a topic, a link, a draft text, a publishing time) and processes them as described in this policy. Prozly does not receive your conversation with the assistant, only these tool calls.

The assistant's provider (e.g. Anthropic for Claude, OpenAI for ChatGPT) processes the data Prozly returns under its own terms and privacy policy, as a separate controller you chose; it is not our processor. Legal basis: Art. 6(1)(b) GDPR (performance of the contract at your request).

We store the connection (assistant name, approved workspaces, access level, the time of last use) and an audit entry for actions that create or schedule content. Access tokens are stored only as a hash and expire after one hour; the connection lapses after 60 days without use. You can disconnect an assistant at any time in Prozly under Channels → AI assistants, which ends its access immediately; workspace owners and admins can remove any member's connection from their workspace.

13. Contact

For any privacy request or question, contact us at privacy@prozly.ai. We answer data subject requests within the statutory deadlines.