Privacy Policy

1. Introduction

Promptority is committed to responsible data governance, user privacy, information security, and transparent use of artificial intelligence technologies.

This Privacy Policy explains how Promptority collects, receives, processes, stores, protects, uses, discloses, transfers, retains, and deletes information when individuals and organizations access or use the Promptority platform, applications, services, features, integrations, websites, and related technologies collectively referred to in this Privacy Policy as the “Promptority Services” or the “Services.”

Promptority is designed as an AI reasoning and work orchestration environment. Rather than treating user input as advertising inventory or behavioral surveillance data, the Services are designed to use information supplied by users primarily for the purpose of understanding their objectives, executing requested work, grounding AI-generated results, maintaining user-created assets, administering accounts, protecting the platform, and providing the functionality requested by users.

Because modern AI systems may depend on multiple infrastructure components and specialized third-party technologies, certain information may be processed through carefully controlled service providers when necessary to provide a requested feature. Promptority seeks to minimize unnecessary disclosure of user information and maintains technical, contractual, and administrative controls appropriate to the nature of the processing.

This Privacy Policy should be read together with Promptority’s applicable Terms of Service, subscription terms, enterprise agreements, data-processing agreements, and other contractual documents that may apply to a particular user or organization.

Where an enterprise agreement, data-processing agreement, or similar written agreement establishes additional or different privacy obligations, that agreement may control to the extent expressly stated in it.

2. Scope of This Privacy Policy

This Privacy Policy applies to information processed through the Promptority environment, including information submitted through:

1. Promptority websites and authenticated applications;
2. account-registration and authentication functionality;
3. guided objective-development and prompt-development tools;
4. AI-assisted reasoning, writing, research, analysis, and workflow tools;
5. Private Knowledge Spaces;
6. Retrieval-Augmented Generation functionality;
7. reusable workflow systems and Power Stacks;
8. artifact creation, storage, retrieval, and export functionality;
9. advanced orchestration and Chief of Staff functionality;
10. supported third-party integrations;
11. token authorization and transaction functionality;
12. administrative, security, diagnostic, and integrity tools; and
13. related APIs and platform interfaces.

This Privacy Policy does not necessarily govern independent third-party websites, services, applications, or platforms that a user chooses to connect to Promptority. Those third parties may maintain their own privacy policies and terms.

3. The Promptority Environment

Promptority uses a layered technology architecture designed to separate user-facing functionality, application intelligence, economic accounting, and external service integrations.

For privacy and security reasons, this Privacy Policy describes that architecture at a functional level rather than disclosing sensitive infrastructure configurations, vendor-routing logic, credentials, security controls, or other information that could create unnecessary operational risk.

3.1 User Application Layer

The Promptority application provides the user-facing environment in which authorized users may:

• establish objectives;
• answer guided questions;
• create and improve prompts;
• configure workflows;
• access Private Knowledge;
• execute AI-assisted work;
• review outputs;
• create persistent artifacts;
• manage integrations;
• approve certain external actions;
• monitor applicable usage information; and
• administer supported account settings.

Authentication and authorization controls are used to determine which functionality, data, workspaces, and resources a particular user is permitted to access.

3.2 Promptority Cloud

Promptority Cloud functions as the primary intelligence and execution environment supporting the Services.

Depending on the requested functionality, Promptority Cloud may perform activities such as:

• objective structuring;
• workflow orchestration;
• prompt compilation;
• request validation;
• context assembly;
• retrieval from authorized Private Knowledge;
• AI workload routing;
• output processing;
• response verification;
• artifact generation;
• access enforcement;
• usage authorization;
• security checks;
• audit-event creation; and
• communication with authorized third-party service providers.

Promptority Cloud is designed to centralize sensitive processing so that confidential infrastructure credentials and service-provider credentials do not need to be disclosed through the user’s browser or client application.

3.3 Economic and Usage Accounting

Promptority may integrate with a dedicated accounting or ledger service to manage token-based transactions, usage authorization, reservations, commitments, releases, adjustments, and associated economic records.

Where such a system is used, its function is to provide authoritative accounting for applicable Promptority transactions.

Promptority distinguishes between internal infrastructure consumption and the user-facing value assigned to particular work units, features, deliverables, or subscription benefits.

4. Our Data Governance Philosophy

Promptority is designed around an objective-first philosophy.

Users typically use Promptority because they want the system to perform a task, answer a question, evaluate information, generate a professional deliverable, organize knowledge, or coordinate a workflow.

Promptority therefore processes information in order to understand and execute that objective.

Our data-governance framework is based on several principles.

4.1 Purpose Limitation

We seek to process user information for legitimate and defined purposes connected with operating, securing, supporting, and improving the Services.

4.2 Data Minimization

We seek to avoid collecting or exposing information that is not reasonably necessary for the requested functionality, administration of the service, security, billing, compliance, or another disclosed operational purpose.

4.3 User Control

Where supported, users can manage stored artifacts, connected knowledge, integrations, exports, and account information through the Promptority environment.

4.4 Authorization Before Access

Possession of a technical reference, document identifier, similarity match, or data location does not by itself authorize access.

Promptority applies authorization controls designed to determine whether a particular user, tenant, account, or workflow is permitted to access a resource.

4.5 Human Authority

AI-generated content is intended to assist human judgment rather than automatically replace human responsibility.

Users remain responsible for reviewing outputs before relying upon them in consequential circumstances.

4.6 Security by Abstraction

Promptority may intentionally withhold or generalize internal information concerning infrastructure providers, routing arrangements, failover configurations, credentials, security mechanisms, internal prompts, detection logic, proprietary methods, and similar operational details.

This practice is intended to reduce security exposure while still providing users with meaningful information concerning how their data is handled.

5. Categories of Information We Process

The information Promptority processes depends on how a person uses the Services.

5.1 Objective and Instruction Information

Users may provide information describing what they want Promptority to accomplish.

This information may include:

• objectives;
• instructions;
• questions;
• prompts;
• business requirements;
• project descriptions;
• constraints;
• desired outcomes;
• preferences;
• formatting requirements;
• evaluation criteria;
• examples;
• reference material; and
• follow-up instructions.

Promptority uses this information to interpret the user’s requested work.

5.2 Context Information

Users may provide contextual information necessary to improve the usefulness of an AI-assisted result.

Context may include information concerning:

• a company;
• project;
• transaction;
• customer;
• industry;
• product;
• service;
• problem;
• document;
• workflow;
• policy;
• market;
• intended audience; or
• other subject relevant to the requested task.

Users should avoid submitting information they do not have authority to use or disclose.

5.3 Constraint Information

Users may specify limitations or requirements that Promptority should follow.

Examples may include:

• budget limitations;
• deadlines;
• prohibited topics;
• required sources;
• jurisdictional limitations;
• confidentiality requirements;
• output limits;
• tone requirements;
• preferred methods;
• excluded approaches; or
• other operational conditions.

5.4 Audience and Tone Information

Promptority may process information about the intended audience of a requested output and the style in which the output should be prepared.

For example, a user may request content suitable for executives, customers, investors, employees, technical teams, lawyers, students, or members of the public.

5.5 Output Specifications

Users may provide requirements concerning:

• document type;
• output format;
• length;
• structure;
• level of detail;
• citation preferences;
• file format;
• schema;
• presentation style; or
• other deliverable characteristics.

5.6 Account Information

When users create or administer accounts, Promptority may process information such as:

• name;
• username;
• email address;
• organization;
• account identifier;
• authentication information;
• subscription status;
• role;
• permissions;
• account preferences; and
• related administrative information.

Passwords, authentication secrets, and similar credentials should be handled using appropriate security protections and should not be exposed in normal diagnostic interfaces.

5.7 Private Knowledge

Authorized users may upload, connect, enter, or otherwise provide documents and information for use within a Private Knowledge Space.

Depending on the functionality used, Private Knowledge may include:

• documents;
• reports;
• presentations;
• spreadsheets;
• policies;
• manuals;
• research materials;
• internal business information;
• structured data;
• text;
• reference materials; and
• other user-authorized content.

5.8 Artifacts

Promptority may allow users to create and retain persistent work products referred to as “Artifacts.”

Artifacts may include, for example:

• reports;
• business plans;
• analyses;
• code;
• structured data;
• JSON;
• documents;
• templates;
• strategies;
• research outputs;
• workflow configurations; and
• other reusable professional materials.

5.9 Usage and Transaction Information

Promptority may process information regarding use of paid or metered functionality.

This may include:

• available usage balance;
• transaction identifier;
• work-unit category;
• authorization status;
• reservation status;
• completion status;
• release status;
• timestamp;
• applicable account;
• applicable subscription or entitlement; and
• information required to prevent duplicate or inconsistent accounting.

5.10 Technical and Security Information

Promptority may process technical information necessary to operate and protect the Services.

Depending on the circumstances, this may include:

• device or browser information;
• IP-derived network information;
• application events;
• timestamps;
• authentication events;
• error information;
• service-performance information;
• security alerts;
• suspicious activity indicators;
• request identifiers; and
• limited operational logs.

Promptority seeks to limit collection of technical information to what is reasonably appropriate for service operation, troubleshooting, fraud prevention, abuse prevention, security, reliability, and related purposes.

6. Anonymous and Authenticated Use

Promptority may provide different levels of functionality depending on whether a user has authenticated.

6.1 Anonymous Visitors

Certain introductory or educational functionality may be available without an authenticated account.

Where Promptority provides a local-only drafting experience, information entered into that functionality may remain within the user’s browser unless the user activates functionality requiring server-side processing.

The exact behavior of individual features may change over time. The user interface should therefore be considered the authoritative indicator of whether a feature requires authenticated or cloud-based processing.

Anonymous users generally will not have access to account-dependent functionality such as:

• persistent Private Knowledge;
• server-side artifact history;
• advanced workflow orchestration;
• authenticated economic transactions; or
• account-specific integrations.

6.2 Authenticated Users

When an authenticated user requests cloud-based functionality, relevant information may be securely transmitted to Promptority Cloud for processing.

Authenticated functionality may support:

• account-specific processing;
• persistent artifacts;
• Private Knowledge;
• advanced orchestration;
• usage accounting;
• integration management;
• collaboration or enterprise functionality; and
• other services requiring verified identity or authorization.

7. Promptority Readiness and Structured Intent Processing

Promptority may assist users in transforming an incomplete instruction into a more actionable specification.

This process may consider several dimensions, including:

1. Objective — what the user wants to accomplish;
2. Context — relevant background information;
3. Constraints — limitations or required conditions;
4. Tone — desired communication style;
5. Audience — the person or group for whom an output is intended; and
6. Output Specification — the requested form of the final result.

Promptority may analyze these dimensions to generate a readiness assessment or similar indicator.

A readiness assessment is intended to help determine whether a request contains sufficient context for useful execution.

It is not a representation that an output will be factually perfect, legally correct, commercially successful, or suitable for every purpose.

8. Private Knowledge Spaces

Private Knowledge Spaces are intended to allow users to ground AI-assisted work in information they control or are authorized to use.

8.1 Purpose of Private Knowledge

Private Knowledge may be used to:

• answer questions based on authorized materials;
• provide relevant context to a workflow;
• ground generated outputs;
• locate supporting information;
• reduce reliance on generalized model knowledge;
• assist with verification;
• improve consistency across work products; and
• support organization-specific reasoning.

8.2 Retrieval-Augmented Generation

Promptority may use retrieval techniques to identify portions of authorized Private Knowledge that appear relevant to a user’s request.

Relevant portions may then be incorporated into the processing context used for the requested task.

The retrieval process may involve technical transformations such as:

• text extraction;
• segmentation;
• indexing;
• metadata generation;
• semantic representations;
• vector representations; or
• other retrieval-enabling processing.

8.3 Tenant Isolation

Promptority is designed so that similarity or relevance alone does not authorize retrieval.

Retrieval requests are subject to access restrictions intended to ensure that information is searched and returned only within the scope authorized for the applicable user, workspace, organization, tenant, or workflow.

This is an important security principle because a technically similar document belonging to another customer should not become accessible merely because it resembles the user’s query.

8.4 Private Knowledge and Model Training

Promptority does not use customer Private Knowledge as a general-purpose dataset for training Promptority’s own public or global AI models.

Where third-party infrastructure is used to execute an authorized request, Promptority seeks to use service configurations and contractual arrangements appropriate for business processing and privacy protection.

The precise data-handling obligations applicable to a third-party processor may vary according to the service, contract, region, account type, and functionality used.

Enterprise customers requiring specific data-processing commitments should review the applicable contractual documentation.

8.5 Deletion of Private Knowledge

When a user validly deletes Private Knowledge through supported functionality, Promptority is designed to remove the active copies and derived retrieval data associated with that content from the applicable production knowledge environment.

Deletion may include removal of:

• the uploaded source document;
• extracted text;
• document segments or chunks;
• retrieval representations;
• related index entries; and
• associated metadata maintained for active retrieval.

Certain limited information may remain temporarily in backups, security logs, transaction records, disaster-recovery systems, or other systems where immediate deletion is technically impracticable or where retention is required for legitimate security, contractual, accounting, or legal purposes.

Such residual information is not intended to remain available through ordinary Private Knowledge retrieval.

9. Artificial Intelligence Processing

Promptority uses artificial intelligence and related computational technologies to perform user-requested work.

9.1 Approved AI Processing Services

Promptority may maintain relationships with one or more approved AI technology providers and infrastructure providers.

Promptority does not publicly disclose all underlying providers, models, routing configurations, infrastructure arrangements, service priorities, or redundancy strategies.

This abstraction is intentional.

It allows Promptority to:

• protect confidential infrastructure information;
• maintain operational flexibility;
• reduce dependency on a single technology source;
• support security;
• manage service continuity;
• select appropriate processing capabilities;
• respond to changes in service availability; and
• improve platform performance over time.

References in this Privacy Policy to an “AI Service Provider” mean an authorized third-party technology provider used by Promptority to perform some portion of an AI-assisted request.

9.2 Provider Abstraction

Promptority uses a provider-abstraction approach so that the platform can interact with approved processing infrastructure without requiring customers to manage the underlying provider relationship for each request.

The abstraction layer may perform activities including:

• workload classification;
• capability selection;
• policy enforcement;
• request validation;
• provider selection;
• availability assessment;
• error handling;
• failover;
• response normalization; and
• service monitoring.

The existence of provider abstraction does not mean that Promptority sends every request to multiple providers.

Processing depends on the requested functionality and the technical requirements of the applicable workflow.

9.3 Service Continuity and Alternate Processing

When technically appropriate, Promptority may use alternate approved processing infrastructure if the initially selected service cannot complete a request because of an eligible technical or availability condition.

Such continuity mechanisms are intended to improve reliability.

Promptority does not use alternate processing to circumvent:

• safety restrictions;
• legal requirements;
• platform policies;
• account restrictions;
• authorization failures;
• billing restrictions; or
• other substantive controls.

Promptority may distinguish between technical failures for which alternate processing is appropriate and request-specific conditions for which retrying through another service would be inappropriate.

For security reasons, Promptority does not publicly disclose the detailed decision rules, routing priorities, provider hierarchy, detection logic, or failover configuration used in making these determinations.

9.4 Multi-System Review and Verification

Certain Promptority workflows may use more than one computational process, reasoning stage, specialized worker, model, verifier, or quality-control mechanism.

For example, an initial output may be reviewed for:

• completeness;
• consistency;
• grounding;
• formatting;
• compliance with user instructions;
• unsupported claims;
• safety concerns;
• structural defects; or
• other quality characteristics.

The use of multiple processing stages does not guarantee that every error will be detected.

10. Prompt Injection and Knowledge-Security Controls

Documents and external content may contain text that appears to instruct an AI system to disregard its authorized task or disclose protected information.

Promptority therefore distinguishes between different sources of authority.

10.1 User Instructions

Authorized user instructions may define the objective of the requested workflow.

10.2 System and Platform Controls

Promptority maintains platform-level instructions, authorization rules, and security requirements intended to govern system behavior.

10.3 Retrieved Knowledge

Retrieved documents are generally treated as information to be analyzed rather than as automatically trusted instructions governing the platform.

This distinction helps reduce the risk that malicious, compromised, or accidentally adversarial content contained inside a document can override higher-priority security controls.

10.4 No Absolute Security Guarantee

Prompt injection defenses and other AI security controls reduce risk but cannot guarantee elimination of every possible adversarial technique.

Promptority may therefore implement layered protections including:

• access controls;
• context separation;
• content classification;
• instruction hierarchy;
• output controls;
• monitoring;
• human approval;
• administrative review; and
• other security mechanisms.

Specific detection rules and defensive implementations are confidential and may change without notice.

11. Token-Based Usage and Economic Records

Where Promptority functionality is purchased or consumed through a token-based model, Promptority may maintain an accounting lifecycle associated with requested work.

11.1 Authorization

Before executing certain paid functionality, Promptority may determine whether the applicable account has sufficient available entitlement, subscription capacity, credits, tokens, or other authorization to request the work.

11.2 Reservation

Promptority may temporarily reserve the expected usage amount before or during execution.

This helps reduce inconsistent charging in circumstances involving:

• network interruption;
• retries;
• concurrent requests;
• delayed responses;
• duplicate submissions; or
• distributed processing.

11.3 Completion

Upon successful completion of applicable work, a reserved amount may be finalized in accordance with the applicable pricing and usage rules.

11.4 Release

If qualifying work is not completed, a reservation may be released rather than finalized.

The exact treatment may depend on:

• the type of service;
• transaction state;
• reason for failure;
• applicable subscription;
• applicable pricing terms; and
• other operational conditions.

11.5 Transaction Integrity

Promptority may use unique transaction identifiers, idempotency controls, and related accounting protections to help prevent accidental duplicate charging.

For security and fraud-prevention reasons, the complete internal accounting implementation is not publicly disclosed.

12. Value-Based Work Units

Promptority may price functionality according to meaningful work units rather than exposing raw infrastructure consumption directly to users.

A work unit may represent a commercially useful activity or deliverable such as:

• a research workflow;
• professional analysis;
• document preparation;
• strategy development;
• knowledge processing;
• structured reasoning;
• artifact generation;
• workflow execution; or
• another defined service.

Internal infrastructure cost and customer-facing pricing are separate concepts.

The cost Promptority incurs to operate infrastructure does not necessarily determine the price assigned to a user-facing deliverable.

13. Artifact Management

Promptority is designed to allow users to convert useful AI-assisted work into persistent assets.

13.1 Types of Artifacts

Artifacts may include:

• written documents;
• reports;
• analyses;
• strategies;
• structured datasets;
• code;
• schemas;
• workflow definitions;
• templates;
• business materials;
• research materials;
• reusable prompts; and
• other generated or user-edited work products.

13.2 User Content Rights

As between Promptority and the user, users retain their rights in content they submit to Promptority, subject to applicable law, third-party rights, and the contractual terms governing the applicable account.

Promptority does not claim ownership merely because user content is processed through the Services.

13.3 License Required to Operate the Services

Users grant Promptority the limited rights reasonably necessary to:

• receive user content;
• host it;
• store it;
• copy it for technical processing;
• retrieve it;
• analyze it;
• transform it at the user’s direction;
• transmit it to authorized processors when required;
• create requested outputs; and
• otherwise provide and secure the Services.

This operational license does not grant Promptority an unrestricted right to commercialize confidential user content independently of the Services.

13.4 Promptority Intellectual Property

Promptority retains its rights in its own technology, intellectual property, platform architecture, methods, software, workflows, taxonomies, ontologies, orchestration mechanisms, interfaces, brands, documentation, and other proprietary systems.

This includes proprietary methodologies used to structure, organize, improve, route, evaluate, or execute AI-assisted work.

Use of Promptority does not transfer ownership of those underlying technologies to the user.

14. Third-Party Integrations

Promptority may allow users to connect external applications, workflow systems, repositories, productivity tools, automation platforms, databases, or other services.

14.1 User-Directed Connections

Where a user activates an integration, information may be transferred between Promptority and the selected third party as required to perform the requested action.

Users should review the privacy practices and security terms of third-party services they choose to connect.

Promptority cannot control how an independent third party handles information after that information has been validly transferred to the third party at the user’s direction.

14.2 Approval Gates

Where supported, potentially consequential external actions may be subject to an approval mechanism.

An approval gate may require an authorized user to approve an action before information is transmitted or an external operation is initiated.

This design is intended to reduce accidental or unauthorized external actions.

14.3 Audit Events

Promptority may record information concerning external actions and approvals for purposes including:

• accountability;
• security;
• troubleshooting;
• organizational governance;
• transaction verification; and
• compliance.

14.4 Integration Credentials

Credentials associated with integrations should be stored using appropriate security protections.

Promptority does not intentionally expose stored private integration credentials through ordinary user-facing diagnostics.

Sensitive authentication materials may also be filtered or redacted from support and troubleshooting exports.

15. Advanced Orchestration and Chief of Staff Workflows

Promptority may provide advanced orchestration functionality capable of coordinating multiple specialized processing stages or workers.

These processing components may perform different roles, such as:

• research;
• retrieval;
• analysis;
• synthesis;
• writing;
• verification;
• review;
• formatting;
• quality control; and
• publishing preparation.

15.1 Shared Workflow Context

Workers participating in the same authorized workflow may receive portions of the information reasonably necessary to perform their assigned role.

This does not mean every component automatically receives unrestricted access to every piece of customer information.

Promptority may restrict worker access according to:

• task requirements;
• authorization scope;
• workflow configuration;
• knowledge permissions;
• security policies; and
• platform controls.

15.2 Human Approval for External Actions

Where a workflow is configured to transmit, publish, post, deploy, send, or otherwise release information to an external destination, Promptority may require human approval before completing that action.

The availability and configuration of approval controls may depend on the applicable service, integration, workflow, and account settings.

Users should not assume that every workflow automatically includes human approval unless the interface or applicable agreement expressly provides it.

16. Diagnostics and Integrity Controls

Promptority may provide administrative and diagnostic tools designed to help authorized personnel identify service issues while limiting unnecessary disclosure of sensitive information.

16.1 Diagnostic Information

Diagnostic reports may include information such as:

• service status;
• request identifiers;
• software versions;
• system events;
• generalized error information;
• feature configuration;
• transaction state; and
• other troubleshooting information.

16.2 Redaction

Where supported, Promptority may automatically redact or exclude sensitive information from diagnostic exports.

Information intended for redaction may include:

• passwords;
• API credentials;
• authentication tokens;
• secret keys;
• raw private prompts;
• confidential knowledge content;
• protected configuration values; and
• similar sensitive information.

Automated redaction substantially reduces disclosure risk but should not be considered mathematically infallible.

Users should review diagnostic materials before voluntarily sending them outside their organization where the information is sensitive.

17. How Promptority Uses Information

Promptority may use information processed through the Services to:

1. provide requested AI functionality;
2. understand user objectives;
3. assemble appropriate context;
4. retrieve authorized knowledge;
5. generate requested outputs;
6. create and maintain artifacts;
7. execute authorized workflows;
8. manage accounts;
9. authenticate users;
10. enforce authorization;
11. operate subscriptions and usage accounting;
12. protect against fraud and abuse;
13. detect and investigate security events;
14. troubleshoot failures;
15. maintain service reliability;
16. provide customer support;
17. improve user experience;
18. evaluate service quality;
19. enforce applicable agreements;
20. comply with applicable legal obligations; and
21. protect the rights, security, property, and integrity of Promptority, its users, and others.

Promptority seeks to use information in a manner proportionate to the purpose for which it was collected or provided.

18. Service Improvement

Promptority may analyze operational information, user feedback, product interactions, system performance, and other appropriate data to maintain and improve the Services.

Where possible and appropriate, Promptority may use aggregated, statistical, de-identified, or otherwise minimized information for activities such as:

• reliability analysis;
• performance measurement;
• product planning;
• capacity planning;
• security improvement;
• error analysis; and
• feature optimization.

The handling of customer content for model improvement, if any, should be governed by applicable product settings, contractual commitments, privacy disclosures, and processor arrangements rather than assumed from ordinary use of the Services.

19. Data Disclosure

Promptority does not treat customer information as a product to be indiscriminately sold to third parties.

Information may nevertheless be disclosed in limited circumstances necessary to operate or protect the Services.

19.1 Service Providers

Promptority may disclose information to service providers that perform functions on its behalf.

These may include providers supporting:

• cloud infrastructure;
• AI processing;
• database infrastructure;
• authentication;
• security;
• communications;
• monitoring;
• customer support;
• billing;
• transaction accounting;
• analytics;
• document processing;
• storage;
• search or retrieval; and
• other necessary technical functions.

Promptority seeks to limit disclosure to information reasonably necessary for the applicable service.

19.2 User-Authorized Disclosure

Promptority may disclose information when an authorized user directs the Services to transmit information to another person, system, organization, integration, or destination.

19.3 Organizational Administrators

Where an account is controlled by an employer, enterprise, institution, or other organization, designated administrators may have access to account-related information as permitted by the applicable organizational configuration and agreement.

Users of organization-managed accounts should understand their organization’s policies regarding access to workplace information.

19.4 Legal and Security Requirements

Promptority may disclose information where reasonably necessary to:

• comply with applicable legal obligations;
• respond to valid legal process;
• protect users;
• investigate fraud;
• investigate abuse;
• respond to security incidents;
• protect Promptority’s rights;
• enforce contractual terms; or
• prevent substantial harm.

Where legally permitted and reasonably practicable, Promptority may take appropriate measures to evaluate the validity and scope of requests for customer information.

19.5 Corporate Transactions

If Promptority is involved in a merger, acquisition, financing, restructuring, sale of assets, reorganization, insolvency proceeding, or similar transaction, information may be transferred in connection with that transaction subject to applicable confidentiality and legal requirements.

20. Data Security

Promptority uses administrative, technical, and organizational safeguards intended to protect information against unauthorized access, alteration, destruction, loss, misuse, or disclosure.

Depending on the system and risk involved, controls may include:

• authentication mechanisms;
• role-based permissions;
• tenant authorization controls;
• access restrictions;
• encryption;
• credential-management controls;
• secure network communications;
• security logging;
• monitoring;
• audit mechanisms;
• environment separation;
• backup protections;
• secret redaction;
• approval gates;
• secure software-development practices; and
• incident-response procedures.

No Internet-connected system can provide an absolute guarantee of security.

Accordingly, Promptority does not represent that unauthorized access, cyberattack, software failure, human error, or other security incidents can never occur.

21. Data Retention

Promptority retains different categories of information for different periods according to the purpose for which the information is maintained.

Factors affecting retention may include:

• whether the user maintains an active account;
• whether an artifact remains saved;
• whether Private Knowledge remains connected;
• contractual commitments;
• applicable subscription requirements;
• security requirements;
• accounting requirements;
• fraud-prevention requirements;
• backup cycles;
• legal obligations;
• dispute-resolution needs; and
• legitimate operational requirements.

Promptority seeks not to retain identifiable information indefinitely where no legitimate purpose for continued retention exists.

Specific contractual retention commitments for enterprise customers may be documented separately.

22. Deletion

Users may be able to delete certain information directly through the Services.

Deletion may vary depending on the category of information involved.

For example, deletion of an artifact may be operationally different from deletion of:

• an entire account;
• a transaction record;
• Private Knowledge;
• an audit event;
• a security event; or
• information contained in a backup.

Where Promptority receives a valid deletion request, it will process the request subject to applicable law, contractual obligations, technical limitations, security requirements, and legitimate retention needs.

Deletion from an active system may occur before the same information expires from disaster-recovery or backup environments.

23. Data Portability and Exports

Promptority is designed around the principle that useful user-created work should remain usable outside the platform where reasonably practicable.

Depending on the applicable feature, users may be able to:

• download artifacts;
• copy content;
• export structured information;
• connect external systems;
• access information through APIs; or
• generate files in commonly used formats.

Supported formats may include formats such as:

• Markdown;
• JSON;
• CSV;
• text;
• document formats; and
• other formats supported by the applicable feature.

The availability of a particular export format may vary by product, account, or feature.

24. International Processing

Promptority and its authorized service providers may process information in more than one geographic location.

As a result, information may be transferred to or processed in a jurisdiction different from the user’s location.

Where required, Promptority may use appropriate contractual, organizational, or legal mechanisms designed to support lawful international data transfers.

The specific transfer mechanism applicable to an enterprise customer may depend on:

• the customer’s jurisdiction;
• Promptority’s contracting entity;
• the location of relevant infrastructure;
• the identity and location of authorized subprocessors; and
• applicable data-protection law.

Customers with regulated or jurisdiction-specific requirements should review the applicable enterprise agreement and data-processing documentation.

25. User Privacy Rights

Depending on where a user resides and applicable law, a user may have rights concerning personal information.

These rights may include the ability to request:

• access;
• correction;
• deletion;
• restriction;
• portability;
• objection to certain processing;
• information concerning processing; or
• other rights recognized by applicable law.

Not all rights apply in every jurisdiction or circumstance.

Certain requests may also be subject to identity verification, legal exceptions, organizational-account limitations, or record-retention obligations.

Promptority will evaluate valid privacy requests in accordance with applicable requirements.

26. Enterprise and Organization Accounts

When Promptority is provided through an organization, the organization may control the account, workspace, Private Knowledge environment, integration permissions, or other account functionality.

In these circumstances, the organization may determine:

• who receives access;
• which users are authorized;
• which knowledge sources may be connected;
• which integrations may be activated;
• how long certain information is retained;
• which administrators may review account activity; and
• other organizational controls.

Where Promptority processes personal information on behalf of an enterprise customer, the respective privacy responsibilities of Promptority and the customer may be governed by a separate data-processing agreement or similar contract.

27. Confidentiality of Internal Architecture

Promptority is committed to transparency regarding meaningful privacy practices.

However, transparency does not require publication of information that would expose confidential intellectual property, increase cybersecurity risk, reveal negotiation-sensitive vendor relationships, or enable circumvention of technical controls.

Accordingly, Promptority does not ordinarily disclose publicly:

• the complete identity of AI infrastructure providers;
• individual model names;
• provider-ranking rules;
• model-selection logic;
• internal routing logic;
• fallback order;
• detailed service thresholds;
• infrastructure credentials;
• API keys;
• secret values;
• private system instructions;
• internal security prompts;
• detection signatures;
• proprietary orchestration logic;
• detailed infrastructure topology;
• vulnerability information; or
• other confidential operational information.

Promptority may modify its providers, infrastructure, routing methods, models, security mechanisms, or technical architecture without updating this Privacy Policy when the change does not materially alter the privacy practices described here.

Where a change materially affects user privacy rights or the purposes for which personal information is processed, Promptority may update this Privacy Policy as appropriate.

28. Artificial Intelligence Limitations

Promptority provides tools intended to improve the structure, context, reasoning, retrieval, analysis, and usefulness of AI-assisted work.

Artificial intelligence systems nevertheless have inherent limitations.

AI-generated outputs may:

• contain inaccurate information;
• omit relevant information;
• misinterpret context;
• generate unsupported conclusions;
• incorrectly summarize source material;
• reflect ambiguity in user instructions;
• produce outdated information;
• contain computational errors; or
• otherwise fail to meet the user’s intended purpose.

Retrieval from Private Knowledge may improve grounding but does not eliminate these risks.

29. Human-in-the-Loop Responsibility

Users are responsible for reviewing AI-generated results before relying upon them where an error could have significant consequences.

Additional professional review may be appropriate for outputs involving matters such as:

• legal rights;
• contracts;
• financial decisions;
• investment decisions;
• tax matters;
• medical or healthcare matters;
• employment decisions;
• regulatory compliance;
• cybersecurity;
• public communications;
• safety-critical systems; or
• other consequential decisions.

Promptority’s generation or presentation of information should not be interpreted as a guarantee that the information is complete, correct, professionally approved, or appropriate for a particular regulated purpose.

30. Children’s Privacy

Promptority is intended for users who are legally permitted to use the Services under the applicable Terms of Service.

Promptority does not intentionally design the Services for unauthorized collection of personal information from children.

If Promptority becomes aware that personal information from a child has been collected in circumstances prohibited by applicable law, Promptority may take appropriate steps to remove the information.

Age requirements may vary according to jurisdiction and the nature of the applicable service.

31. Cookies and Similar Technologies

Promptority websites and applications may use cookies, local storage, session technologies, authentication mechanisms, or similar technologies where necessary to:

• maintain user sessions;
• remember preferences;
• secure accounts;
• enable functionality;
• prevent abuse;
• understand service performance; or
• support other disclosed operational purposes.

Where legally required, Promptority may provide additional notice or consent choices concerning non-essential technologies.

Certain browser-local functionality may store information on the user’s device without transmitting that information to Promptority until the user requests a server-dependent feature.

32. Automated Decision-Making

Promptority uses automated systems to provide AI-assisted functionality, but the ordinary generation of requested content does not necessarily constitute legally significant automated decision-making about the user.

Where Promptority or an enterprise customer deploys functionality that could produce legal or similarly significant effects concerning individuals, additional contractual, technical, organizational, or regulatory requirements may apply.

Organizations are responsible for evaluating the legal requirements applicable to their own use cases.

33. Incident Management

Promptority may maintain processes intended to identify, evaluate, contain, investigate, remediate, and document security incidents.

Where an incident involving personal information creates notification obligations under applicable law or contract, Promptority will address those obligations in accordance with the requirements applicable to the circumstances.

For security reasons, incident-response procedures and detection configurations are not publicly disclosed in detail.

34. Changes to This Privacy Policy

Promptority may revise this Privacy Policy from time to time.

Changes may be made to reflect:

• new functionality;
• changes to business operations;
• changes in processing practices;
• changes to applicable legal requirements;
• new security practices;
• changes to integrations;
• organizational changes; or
• improvements in privacy governance.

The updated Privacy Policy will identify its applicable effective date or last-updated date.

Where required by applicable law or contractual obligation, Promptority may provide additional notice of material changes.

35. Privacy Contact and Requests

Users who wish to submit questions or requests concerning privacy, data deletion, Private Knowledge, account information, tenant isolation, data portability, or other privacy matters may contact the Promptority Administrative Team through the secure contact functionality made available through the Promptority platform.

Promptority may require reasonable verification before processing requests involving account information or personal data.

Enterprise customers may also submit privacy or data-protection requests through the communication methods specified in their applicable agreement.

Privacy Contact: [Privacy Contact Email or Portal] Business Address: [Business Address, if applicable] Data Protection Contact: [Data Protection Contact, if applicable]

36. Summary of Promptority’s Privacy Commitments

Promptority’s approach to privacy is designed around several core commitments:

Purposeful Processing. User information is processed to provide, administer, protect, and improve the Services rather than to create an unrestricted surveillance profile of the user.

Private Knowledge Protection. Private Knowledge is intended to remain subject to account and tenant authorization boundaries.

No General Training on Private Knowledge. Customer Private Knowledge is not treated as a general public training corpus for Promptority’s global models.

Provider Confidentiality. Promptority may use multiple approved AI and infrastructure services without publicly identifying the complete provider configuration, model roster, routing methodology, or resilience strategy.

User Ownership. Users retain their rights in the content they provide, subject to applicable law and contractual terms.

Limited Operational License. Promptority receives only the rights reasonably necessary to operate the Services and perform user-requested processing.

Controlled External Actions. Where supported, consequential external transmissions and publishing actions may be subject to explicit authorization or human approval.

Tenant-Aware Retrieval. Similarity between documents does not itself establish access rights; retrieval is intended to remain subject to authorization boundaries.

Security-Conscious Diagnostics. Diagnostic and troubleshooting functionality is designed to minimize exposure of secrets and confidential content.

Portability. Promptority seeks to make user-created work reusable and exportable in commonly useful formats where supported.

Human Authority. AI output assists human decision-making but does not eliminate the need for appropriate review.

Security Through Responsible Disclosure. Promptority provides users with meaningful information about privacy practices without publishing confidential infrastructure, provider relationships, routing logic, security controls, or proprietary implementation details that could undermine the security or resilience of the Services.

37. Final Statement

Promptority is built to help individuals and organizations convert human objectives into structured, context-aware, AI-assisted work while maintaining meaningful control over the information used in that process.

Privacy in an AI environment requires more than a promise to keep data confidential. It requires deliberate decisions concerning authorization, data minimization, knowledge isolation, processor access, deletion, external actions, human oversight, security boundaries, and the amount of infrastructure information that should responsibly be made public.

Promptority’s goal is to provide sufficient transparency for users to understand how their information is handled without exposing confidential technologies, vendor relationships, security configurations, or internal methods that could weaken the platform or compromise its users.

As the Promptority platform develops, these principles will continue to guide its approach to data governance, artificial intelligence processing, user control, and information security.