1. Introduction & Scope
Welcome to Prozenai Automation Studio (“Prozenai”, “we”, “our”, or “us”). We engineer custom artificial intelligence workflows, autonomous conversational agents, document intelligence pipelines, and CRM integration systems for forward-thinking organizations worldwide.
This Privacy Policy describes our practices concerning data collection, transmission, storage, and processing when you:
- Visit our official website (https://prozenai.com) and digital interfaces.
- Submit project inquiries, technical specifications, or book consultations.
- Engage our studio to architect, build, host, or maintain custom AI automation systems (e.g., WhatsApp bots, Instagram automations, document parsers, CRM webhooks).
- Interact with automated endpoints and conversational bots deployed by Prozenai on behalf of our clients.
2. Data Controller Identification
Depending on your relationship with Prozenai, we may act as either a Data Controller or a Data Processor under global privacy laws (including the EU/UK General Data Protection Regulation and California Consumer Privacy Act):
Website Visitors & Inquiries
We determine the purposes and means of processing personal data directly submitted through our contact forms, consultations, analytics, and business billing records.
Client Automation Pipelines
When processing lead records, CRM objects, WhatsApp conversations, or internal documents on behalf of our enterprise clients, the client remains the Controller and Prozenai processes data strictly pursuant to their instructions and Statement of Work (SOW).
3. Information We Collect
We adhere strictly to the principle of data minimization. We only collect and store information necessary to provide high-reliability engineering services:
A. Information Provided Directly
When you submit an automation inquiry or communicate with our engineering team, we collect your full name, work email address, company name, phone or WhatsApp number, proposed automation use case, technical requirements, and communication history.
B. Consultation & Operational Records
Meeting agendas, architecture diagrams, process documentation, workflow specifications, and technical notes shared during scoping and discovery calls.
C. Automatically Collected Technical Data
Standard technical telemetry when accessing our web studio: IP address, user-agent string, operating system, referrer URL, interaction timestamps, and core web vital performance metrics.
4. Client Automation & Systems Data
To build and connect custom automations to your technology stack (e.g. WhatsApp Cloud API, HubSpot, Salesforce, Pipedrive, Google Workspace, PostgreSQL), we handle client system data under stringent security protocols:
- Authentication Secrets & API Tokens: Stored strictly in isolated, encrypted key vaults with least-privilege scoping. Tokens are never exposed in client bundles or public repositories.
- Webhook Payloads: Transient inbound messages, lead event notifications, and document processing queues. Payloads are processed in memory and purged according to retention limits.
- Knowledge Base Assets: FAQs, standard operating procedures (SOPs), product catalogs, and documents provided by clients for Retrieval-Augmented Generation (RAG).
5. Strict Zero-Training AI Model Guarantee
Prozenai guarantees that proprietary client data, end-customer conversations, document extractions, system prompts, and CRM data are NEVER used to train, retrain, fine-tune, or improve any public foundation AI models (including models provided by OpenAI, Anthropic, Google Gemini, or Meta).
We exclusively interface with commercial enterprise API tiers that provide contractual zero-data-retention and zero-model-training guarantees. Your operational data belongs strictly to you and remains isolated within your dedicated workflows.
6. How We Use Your Information
Information collected by Prozenai is utilized exclusively for genuine operational, technical, and contractual purposes:
System Engineering & Delivery
Architecting, testing, deploying, and maintaining your custom workflows, agent routines, and integrations.
Pipeline Execution & Monitoring
Processing real-time webhooks, routing conversational inquiries, tracking execution uptime, and detecting API anomalies.
Client Relationship & Support
Providing technical support, invoicing, milestone reporting, and scheduling operational reviews.
Security & Threat Mitigation
Preventing unauthorized access, validating webhook cryptographic signatures, and mitigating brute-force abuse.
We do NOT sell, lease, rent, trade, or monetize personal or commercial data under any circumstances.
7. AI Guardrails & Isolation Architecture
Every AI agent and workflow engineered by Prozenai is anchored in defense-in-depth principles:
- Deterministic Guardrails: Prompts are strictly bound to validated schemas. Models are restricted from executing destructive operations without human approval.
- Isolated Vector Stores: Knowledge embeddings and semantic indices for Retrieval-Augmented Generation (RAG) reside in isolated client namespaces with distinct encryption keys.
- Human-in-the-Loop Fallbacks: Edge cases and high-stakes inquiries trigger immediate automated handoffs to designated human staff.
8. Sub-Processors & Infrastructure Partners
To provide enterprise-grade reliability and low latency, Prozenai contracts with industry-leading cloud and infrastructure sub-processors:
| Partner / Service | Role / Processing Activity | Data Location | Security Standards |
|---|---|---|---|
| Cloudflare | Edge computing, DDoS protection & DNS routing | Global Edge Network | SOC 2 Type II, ISO 27001 |
| Supabase / AWS | Relational database storage, Auth & encrypted vaults | US / EU Regions | SOC 2 Type II, HIPAA, GDPR |
| OpenAI / Anthropic Enterprise | Enterprise LLM reasoning endpoints (zero retention) | United States | SOC 2 Type II, Zero-Training API |
| Meta (WhatsApp Cloud API) | Conversational messaging delivery & webhook gateway | Global / Regional | Meta Business Data Security Terms |
| Resend / Email Relay | Transactional notification and alert delivery | US East | SOC 2 Type II compliant |
9. Cryptographic & Operational Security
Security is engineered into our workflows from day one, not treated as an afterthought:
All communications with our web studio and automated webhook endpoints enforce TLS 1.3 encryption with strict HTTP Strict Transport Security (HSTS).
Database records, API tokens, and persistent system configuration files are secured using industry-standard AES-256 cryptographic standards.
Every incoming webhook payload (from WhatsApp, Stripe, or CRM) is cryptographically validated using HMAC SHA-256 signatures before triggering actions.
Internal access to production configurations is strictly compartmentalized. Two-factor authentication (2FA) is enforced across all engineering toolchains.
10. Data Retention & Automatic Purge Cycles
We retain personal information only for as long as strictly necessary to fulfill the purposes set out in this Privacy Policy:
- Website Inquiries: Contact form submissions and consultation notes are retained for 24 months to maintain commercial records, or until you request deletion.
- Automation Execution Logs: Ephemeral pipeline execution telemetry and raw payloads are retained for 30 to 90 days for operational debugging, after which they are permanently purged.
- Client Integration Tokens: Retained for the active duration of the client engagement and purged within 7 business days of contract conclusion or client revocation.
11. GDPR, CCPA & International Transfers
Prozenai serves enterprise clients globally and complies with international privacy frameworks:
European Union & United Kingdom (GDPR / UK GDPR)
Our legal basis for processing data includes: (i) performance of a contract (delivering automation systems), (ii) legitimate business interests (improving system reliability and defending against security threats), and (iii) explicit consent (for direct inquiries). Cross-border transfers rely on Standard Contractual Clauses (SCCs).
California Consumers (CCPA / CPRA)
We do not sell personal information or share personal data for cross-context behavioral advertising. California residents possess the right to know, delete, correct, and limit use of sensitive personal information without discriminatory treatment.
12. Your Statutory Privacy Rights
Regardless of your geographical location, Prozenai honors your fundamental privacy rights:
Request a machine-readable copy of the personal information we hold about you.
Request immediate correction of inaccurate or incomplete contact or technical records.
Request permanent deletion of your inquiry details, consultation notes, and associated records.
Object to our processing of your data based on legitimate business interests.
To exercise any of these rights, contact us at contact@prozenai.consulting. We fulfill verified requests within thirty (30) calendar days at zero charge.
14. Amendments & Policy Updates
As artificial intelligence technologies, regulatory standards, and our automation offerings evolve, we may update this Privacy Policy from time to time.
When material changes occur, we will update the “Last Updated” and “Version” dates at the top of this document. For active enterprise clients, we will provide direct notice via email or via the designated client communications channel prior to the changes taking effect.
15. Contact & Data Protection Officer
If you have questions, feedback, or concerns regarding our privacy governance or wish to execute a customized Data Processing Addendum (DPA), please contact our team:
Prozenai Automation Studio
Engineering Intelligence. Automating Business.
Questions about our legal framework?
Our compliance and engineering security teams are available to address your inquiries regarding data processing, model boundaries, or enterprise service terms.