Your privacy.

Who is responsible

Propfessor LLC, of 30 N Gould St, Ste N, Sheridan, WY 82801, USA, is the controller of the personal data described here, which means we decide why and how it is used. Write to admin@propfessor.com about anything in this policy. A person reads every message.

Optional campaign measurement

If you arrive through a recognised campaign link, account entry offers a separate, unticked choice to measure that campaign. If you opt in and create a new account, we record the campaign code, your account user identifier, consent version and consent time. We use this link in our own aggregate report to count new accounts, first questions, first delivered non-refusal answers and active subscriptions during the first thirty days after account creation. This does not measure whether an answer was useful or prove that the advert caused a purchase.

This choice is independent of public website analytics and the question-improvement log. Nothing is sent to LinkedIn or another advertising platform. No advertising click identifier, question text, screenshot or email is added to the campaign record. Declining has no effect on access. Do Not Track and Global Privacy Control prevent recording the choice when they are present at signup.

For provider sign-in only, choosing this option sets the signed, httpOnly __Host-pf_campaign cookie for up to thirty minutes to carry your choice through authentication. It is cleared after successful sign-in. Normal email-code sign-in uses no campaign cookie. A recognised campaign code may travel in links before consent; it identifies the campaign, not a person, and creates no measurement record by itself.

Consent is the basis for this processing. The account link is excluded from reports after ninety days and deleted automatically as the service is used. It is also deleted with your account. You can withdraw campaign measurement and remove the link immediately. Returning sign-ins do not recreate it. No existing public-analytics consent is reused for this purpose.

Optional public-website measurement

The English public website offers a separate, optional choice to help us understand which pages people visit and whether they click a link to sign up. If you choose Allow, Vercel Web Analytics processes the public page address, referring website, time, approximate location (country, region and city) and device and browser information. It uses information from the request to distinguish visits within a day; its visitor session is discarded after 24 hours. The reports we use are aggregate counts. A signup click does not tell us whether someone created an account or paid.

This measurement does not use analytics cookies. Analytics event data contains no account identifier, email, question, answer, form content, page-address query string or fragment. It is not installed in the signed-in workspace, sign-in, account setup or checkout. The translated website is not included. We skip measurement when a referring address could disclose a private path or query, so these reports are not a count of everyone who visits.

Consent is the basis for this optional measurement. No thanks leaves it off and does not affect access to the website or service. You can change your choice, including withdrawing permission for future measurement, in the public website measurement section of the English Privacy page. We also keep measurement off when your browser sends Do Not Track or Global Privacy Control. Your choice is stored in this browser as pf_public_analytics_v1 until you change it or clear your browser storage. Withdrawing does not undo earlier processing. Vercel explains its handling in its Web Analytics privacy documentation.

What we collect, and where it comes from

When you create an account and set it up. Your email address, because it is how you sign in. Setup then asks for your name, the company you work for, the kind of work you do, roughly how far into your career you are, and the modules you work in, and you cannot use the trainer until you have answered. If you describe your work in your own words, we keep what you type. We also keep the domain of your work address, read from that address, and the language you read answers in.

When you use the trainer on our website. Your threads, meaning the questions you ask and the answers you are given, so they are there when you come back and on your other devices. If you attach a screenshot or use Share screen, a snapshot is sent to the AI model provider to be read and is not stored by us; the words read from it are stored as part of your question. Screen sharing captures a snapshot when you ask or choose to capture one; it does not continuously upload video or screen audio. You choose the shared tab, window or screen and can stop sharing at any time.

When you use voice on our website. With microphone permission, each spoken question is sent through Propfessor to OpenAI for transcription and answering. Dictation places the transcript in the message box for you to review and send. Talk live sends a question when you pause and plays the spoken answer. OpenAI also generates speech from answer text when you use Read aloud. Software questions and answers are saved in your conversation. Propfessor does not store microphone recordings or generated audio. OpenAI's applicable processing and retention terms apply. Mute pauses microphone input; End closes the call and screen sharing.

When you sign in. A session record so you stay signed in, and the date it was last used. A sign-in code, stored only as a hash. If you use Microsoft, Google or Apple, the identifier that provider gives your account there. The version of our terms you accepted, and the date you first accepted each version.

When you start a free trial. To keep to one free trial per person, we record your name in a normalised form, the network address the request came from, and your email domain. A trial is refused if the same name has already claimed one from the same address.

When you pay. Creem sells the subscription as merchant of record. We send it your email, your name, your account number and the module you are buying, and it collects your payment details under its own privacy policy. Card details never reach us. We keep the status of your subscription and the identifier it gives you.

When you send a question to a practitioner. The question, with email addresses and long numbers removed, the module, and your account, so the answer can be matched to it.

If we change or suspend your account. When a member of our staff suspends or restores your account, signs you out on every device, grants or removes your access to a module, or leaves your account out of our follow-up lists at your request or includes it again, we record what changed, when, the reason they gave, and which of our staff made the change. A suspended account cannot sign in until it is restored. Our staff may also write notes about your account, such as the terms of a pilot or what we discussed with you, to look after it; a note records who wrote it and when, and is not changed afterwards.

If we invite you. When a member of our staff invites you to Propfessor, we hold your email address, the name the invitation greets you by, the Companion module and how long the access runs, any note they write to you, and which of our staff wrote, sent or revoked it. We use them to send the invitation and to apply the access when you sign up with that address. No account exists until you sign up. An invitation stays open until the day its email names, 30 days after it was sent; it is sent at most three times, and never more than once a day to one address. If you reply asking us not to invite you again, or ask us to delete your data, we delete any invitation you had not accepted and keep only a hash of your address, and of its mailbox, so that we do not invite it again.

If you turn on the question log. See the section on it below.

When you visit the site. The network address a request comes from; when you ask for a sign-in code, a hash of the email address it is for, rather than the address itself; and when you ask a question while signed in, your account. These are kept in short-lived counters that stop sign-in attempts and questions being made faster than a person could, and that count the new accounts opened from each network address in a day. The cookies and browser storage listed under Cookies. Our hosting provider also records requests in its own logs.

When you connect Propfessor to ChatGPT

Connecting is optional and uses a separate authorization step. The connection lets ChatGPT read your display name and stable account-linked profile identifier, read which modules are included in your current Propfessor subscriptions, check access to the module you select, send a software question with relevant context and receive authored guidance. It does not give Propfessor access to your entire ChatGPT account or let us operate your desktop software.

ChatGPT handles the conversation and any attachments you provide there. Our companion interface accepts text questions, not raw image or file uploads. Relevant text or visible observations from an attachment may be included in the question ChatGPT sends us. We use that question to search our authored material, including sending the text to Voyage AI when semantic search is available, and return relevant guidance to ChatGPT for its answer. We do not save these companion questions or answers as website threads or add them to the optional question-improvement log. OpenAI handles your ChatGPT conversation under its own terms, policies and your ChatGPT account or workspace settings.

We keep authorization requests, code and token hashes, the connected user and account, the originating website session, client, scope and expiry information, and account-level usage counts to secure and limit the connection. These records do not contain the companion question text. You can remove the connection in ChatGPT. Signing out of the originating Propfessor session also disables its connection credentials. Deleting your Propfessor account removes its authorization requests, codes and tokens. Account-level usage counts remain until the two-day cleanup threshold described below.

The question log, which is optional and off unless you turn it on

We ask whether we may keep the questions you ask, so we can decide what this trainer learns next. That only happens if you tick the box. If you do, each question is stored with no name, no account and no identifier of any kind, after email addresses and long numbers are removed. It is stored together with the module, whether it was answered, how confident the answer was, and which of our records it cited. The answers themselves are not kept in that log.

A logged question is not linked to your account, but while the thread it came from still exists, the two could be matched by their text. So we treat logged questions as personal data while that is possible. You can turn the log off at any time from your account menu, and nothing further is logged from then on. When you do, or when your account is deleted, we also delete the logged questions that match your threads. Questions from threads you had already deleted can no longer be matched to anyone, and so cannot be found or removed. A question logged before 17 September 2026 is matched only where its thread identifies it with certainty, and one that cannot be matched is not deleted.

Separately, and whatever you choose, we count how many questions are asked in each module each day. That count contains nothing about anybody.

Why we use it, and our legal basis

Where the law asks us to name a legal basis, as the GDPR and UK GDPR do, these are ours:

• To provide the service you signed up for (performance of our contract with you): your account, name, company and modules; sign-in; answers scoped to your modules; your threads; trials; subscriptions; and practitioner questions.
• To keep the service secure and fair (our legitimate interests in protecting the service and its material): rate limits, the one-trial check, and records of sign-in and terms acceptance.
• To understand and improve the service (our legitimate interests in running a useful product): the setup answers about your work and career, and how accounts use the service. That includes which firms use it together and which modules are asked about. We do not build advertising profiles.
• To invite you (our legitimate interests in offering the service to people we choose to invite): an invitation our staff decided to send you, and the access it gives when you sign up. Nothing is sent to you without a member of our staff choosing to send it.
• To look after your account (our legitimate interests in serving our customers well): our staff see lists of accounts in these situations: the free questions are used up or the free period has ended, setup is not finished, nothing has been asked since setup, a subscription is not being used, a card payment is failing, a subscription has been cancelled, or complimentary access is ending. A person uses them to decide whether to write to you. Nothing is sent automatically.
• The question log (your consent, which you can withdraw).
• To meet legal obligations and defend legal claims (legal obligation and legitimate interests): for example records of what terms you accepted.

Where we rely on legitimate interests, you have the right to object at any time, on grounds relating to your situation, by writing to admin@propfessor.com. You can also ask us, at any time and without giving a reason, to leave your account out of the lists described above, and we will.

Decisions made automatically

Four decisions are made without a person. A free trial is refused if the one-trial check matches. A request is refused for a while if too many come from one account or one network address, or ask for sign-in codes for one email address. A new account is not opened if too many have already been opened from the same network address that day. A question is refused if your account has no access to that module or has used its free question allowance. None of these has a legal effect on you or a similarly significant effect. If you think one got it wrong, write to admin@propfessor.com and a person will look at it.

How the AI processing works

To answer a question asked on our website, we send the question, the earlier turns of the thread, any screenshot you attach and the relevant passages of our own material to an AI model. We send the request either directly to OpenAI or through OpenRouter. OpenAI does not use API requests to train its models, and keeps them for up to 30 days to check for abuse; its applicable processing and retention terms apply. OpenRouter passes a request to a company that hosts the model, and is told to use only hosts that do not keep prompts to train models. If we set the service to call Anthropic directly, the request goes to Anthropic instead. To find the relevant passages, the text of your question is also sent to Voyage AI. We do not add your name, email address or network address from your account records to these website answer or search requests. Details you type may be included in your question. The separate ChatGPT connection and its profile data are described above.

When a practitioner answers a question sent to them, the answer may become part of the material the trainer is taught from, so nobody has to ask it again. The question and your account do not.

Who receives it

• Neon, part of Databricks, hosts our database, in Frankfurt, Germany.
• Vercel hosts the website and the service, keeps request logs, and processes the optional public-website measurement described above.
• OpenAI processes website questions we send directly, transcribes spoken questions and generates voice answers and read-aloud audio. If you connect the ChatGPT companion, it also receives the profile and authored-guidance responses described above.
• OpenRouter, and the company that hosts the model, process the questions we send through OpenRouter.
• Anthropic processes questions only if we set the service to call it directly.
• Voyage AI processes the text of questions to search our material.
• Resend delivers sign-in emails and invitations, and receives your email address and the code or the invitation.
• Creem sells subscriptions as merchant of record and is responsible for your payment data itself.
• Microsoft, Google and Apple, only if you choose to sign in with them. They tell us your email address, your name and their identifier for you.
• People at Propfessor LLC who operate the service. They can see accounts, their activity and practitioner questions, through a console only an operator can reach. The console never displays a network address.

The providers above act on our instructions, apart from Creem for payments and the sign-in providers for their own accounts, which are responsible for what they do. OpenAI is also responsible for your separate ChatGPT account and conversation under its own terms and policies. We also disclose personal data where the law requires it, to protect our rights or other people’s safety, and to a buyer or successor if the business is sold or reorganised, in which case this policy continues to apply to it.

International transfers

Several of the providers above are in the United States, and we are a company formed there. Personal data from the United Kingdom, the European Economic Area or Switzerland may be transferred to a country without an adequacy decision. When it is, we rely on the standard contractual clauses, or the UK addendum to them, in each provider’s data processing terms, or on the provider’s certification under the EU-US Data Privacy Framework where it has one. You can ask us for more detail at admin@propfessor.com.

How long we keep it

• Your account, setup answers and threads: until you delete a thread in the product, or ask us to delete the account.
• Practitioner questions: with your account, until you ask us to delete them or the account.
• Records of changes our staff made to your account, and notes they wrote about it: with your account, included in a copy of your data, and deleted when the account is deleted.
• An invitation nobody accepted: deleted 90 days after it closes, or at once if it was never sent and our staff discard it, or sooner if you ask. An accepted invitation: with your account, and deleted with it.
• A request not to be invited again, or a deletion: only a hash of your email address and of its mailbox, kept so that we do not invite that address again. Any invitation you had not accepted is deleted at the same time.
• Sessions: they stop working after ninety days, and the record is deleted 30 days after that.
• Sign-in codes and pending sign-ins: they stop working after ten and fifteen minutes, and are deleted about a day after that.
• Rate limit counters, including the count of new accounts opened from each network address: two days. A record that a daily limit was passed: ninety days.
• The one-trial check: 24 months, including after the account is deleted, so deleting an account cannot restart a free trial.
• Terms acceptance records: with your account, and afterwards, as evidence for the terms that outlive it, only a hash of your email address with the version and date, for 6 years.
• The question log: indefinitely, except that the logged questions matching your threads are deleted when you turn the log off or your account is deleted.
• The consent record for the question log: with your account, as a dated record of what you chose. Consent records made before 17 September 2026 carry only a browser token, are not linked to anyone, and no longer allow anything to be logged.
• The account record: after the account is deleted, it is kept with no name, because the one-trial check refers to it.
• The optional signup-to-campaign link: ninety days, removed automatically as the service is used; you may remove it sooner through the campaign measurement choice.
• Our hosting provider’s request logs: for the short period its own retention sets, which we do not extend.
• ChatGPT connection requests and authorization codes: removed one day after expiry. Token records: removed one day after their fixed refresh lifetime ends; rotated token hashes remain until then to detect replay. Connection usage counts: two days. Removal happens automatically as the service is used, so these are cleanup thresholds rather than an exact deletion time.

Deletion by time happens automatically as the service is used, not on a fixed schedule, so a record can outlive its period by a short while.

How we protect it

Every connection to the service and to our database is encrypted. Session tokens and sign-in codes are stored only as hashes, and the code hash is keyed with a secret held outside the database, so a copy of the database would not let anyone sign in. There are no passwords to leak. A sign-in code works for ten minutes and allows five attempts, and one email address is sent at most ten codes a day. Cookies that sign you in cannot be read by scripts on the page. Only an operator can reach the console, and it never shows a network address. No system is perfectly secure. If a breach puts you at risk, we will tell you and the relevant authorities as the law requires.

Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy of it;
• correct anything that is wrong;
• delete your account and your personal data;
• give you the data you gave us in a format a machine can read;
• stop or limit a use of your data, or object to a use based on our legitimate interests;
• withdraw a consent you gave, without affecting what was done before;
• have a person review a decision made automatically.

If you are in the United Kingdom, the European Economic Area or Switzerland, these are your rights under data protection law, and you can also complain to your data protection authority, such as the Information Commissioner’s Office in the United Kingdom.

How to use your rights

Write to admin@propfessor.com from the email address on your account, so we know the request is yours. If you write from another address, we will ask you to confirm it from that one. Someone you authorise can make a request for you if they show us your authorisation. It is free unless a request is manifestly unfounded or excessive. We answer within one month, or tell you within that month why we need up to two more.

When we delete an account, we delete your sessions, your threads, the logged questions that match them, the consent records linked to your account, your sign-in records, linked sign-in providers, module interest, terms acceptance records, invitations to your address, and your user record, and keep a hash of your address and of its mailbox so that we do not invite it again. If you were the account’s only member, we also delete its practitioner questions and subscription records, and remove its name. We keep only what the retention list above says survives a deletion. If we refuse any part of a request, we tell you why, and you can ask us to reconsider by replying.

If you live in the United States

In the last twelve months we have collected four categories of personal information. The first is identifiers, such as your email address, name and network address. The second is commercial information, meaning your trial and subscription. The third is internet activity with our service, meaning your questions, threads and sign-in records. The fourth is professional information, meaning your company, the kind of work you do and your career stage. We collect them from you, from the sign-in provider you choose, from your use of the service, and, if we invite you, from the invitation our staff write, for the purposes described above.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information to infer anything about you. Because we neither sell nor share it, a Global Privacy Control signal has nothing to switch off. You have the rights listed above, and we will not treat you differently for using them. If we refuse a request, you can appeal by replying to our answer. If you are not satisfied with the appeal, you can contact your state attorney general.

Cookies and browser storage

• pf_session keeps you signed in, for ninety days.
• __Host-pf_oauth_state and __Host-pf_oauth_verifier protect a Microsoft, Google or Apple sign-in, for ten minutes.
• __Host-pf_pending_identity finishes linking a sign-in provider whose email address we must confirm, for fifteen minutes.
• pf_offer remembers your selected module, billing period and pricing-page language while you sign in, for up to thirty minutes. It is cleared when the selection is restored.
• pf_participant records your question log choice in this browser, for a year.
• pf_site_lang remembers the language you chose for the site, for a year.

The tab’s session storage uses keys beginning with pf_submission_ to recognise retries of the same submission. These hold a hash of the submission and a random identifier, not its question or image content. The entry is removed after a successful response or when the tab closes; the product keeps at most one hundred pending entries in a running tab.

In your browser’s own storage, the product remembers the module and release you last chose, your preferred voice, your course sample progress and whether you prefer the dark theme. All of these are needed for the service to work as you asked, so they need no consent. None of them tracks you across other sites. The only optional campaign-measurement cookie is __Host-pf_campaign, described above. There are no third-party advertising cookies.

Children

Propfessor is a professional tool and is not intended for anyone under 18. If we learn that we hold personal data about someone under 18, we delete it.

Changes to this policy

If this policy changes, the date at the top changes. If a change is material, we will tell everyone with an account by email at least thirty days before it takes effect, as the terms promise for their own changes.

Contact and complaints

Every request and every question about this policy goes to admin@propfessor.com, and a person reads it. The same terms of language apply here as in our terms: this policy is written in English, and the English version prevails over any translation.