Privacy Policy

1. Information We Collect

We collect information you provide directly: name, email, organization name, and social media account connections. We also collect usage data: feature usage, login times, and browser information.

2. How We Use Your Data

We use your data to: provide the Service, improve AI features, send product updates (with opt-out), process payments, and ensure platform security. We do not sell your data to third parties.

3. Data Security

All social media credentials and API tokens are encrypted using AES-256-GCM. Our core infrastructure — application servers, databases, and file storage — is self-hosted on dedicated servers and is not run on hyperscale public clouds. Some features do send data to third parties: AI processing to Anthropic and OpenAI, publishing to the social platforms you connect (for example, YouTube and Google Business Profile via Google's APIs), and the email we send you, which goes out through Zoho's India mail servers. JWT tokens use short expiry (15 minutes) with secure HTTP-only refresh tokens.

4. AI and Your Content

AI features (content generation, sentiment analysis, and reply suggestions) are processed using third-party AI providers — currently Anthropic (Claude) and OpenAI — whose services run on infrastructure in the United States. This means the text you submit for AI processing, and for community-reply features the name or handle and the message of the person who contacted you, is transmitted to these providers. We do not anonymise this content before sending it. We do not use your content to train our own AI models; the providers process it under their own API terms.

A separate purpose, not generation: when you upload a source image for an image-to-video or image-edit feature, and when we generate an image or video on your behalf, that image or video is sent to Google for automated processing — to check whether a real human face is present (so we can ask for likeness consent before proceeding) and to screen the generated output for unsafe content before it is delivered to you. Google does not identify who is in the image; it answers a narrow yes/no question and reads visible text, and nothing else. This is content moderation, and it is separate from the image and video generation described in section 8 — the same provider is used for both, for a different reason each time.

5. Data Retention

We retain your data for as long as your account is active. Upon account deletion, your personal data is removed within 30 days. Aggregated, anonymized analytics data may be retained indefinitely.

This 30-day removal does not apply to an organisation's financial and tax records. If the account you deleted owned an organisation that holds financial records (invoices, payments), that organisation is not purged — it is tombstoned: your personal contact details on it are anonymised and removed, but its invoices and GST particulars are retained for 72 months, as required under Indian tax law (CGST Section 36) and permitted under GDPR Article 17(3)(b). Those retained records are never displayed, never actively used, and exist only to meet this legal retention requirement.

6. Your Rights

You have the right to: access your data, correct inaccurate data, request deletion of your data, export your data in a portable format, and object to data processing. Contact privacy@propelusai.com to exercise these rights.

7. Cookies

We use essential cookies for authentication (HTTP-only, secure). These are required to keep you signed in and cannot be turned off while you are using Soul. We do not use advertising cookies, and we do not sell or share what we measure.

We would also like to measure which pages people find useful, using Google Analytics through Google Tag Manager. That is optional. No Google script is loaded and no analytics cookie is set until you choose “Yes, that is fine” on the banner. Choosing “No thanks”, or simply never answering, loads nothing at all — the code has no branch that measures a visitor who has not agreed. Soul works identically either way, and your choice is stored in your own browser rather than sent to us.

8. International Users

PropelusAI is operated from India. Your data at rest is currently stored on dedicated servers located in Germany (EU). By using the Service, you consent to processing in these locations. Some data is also transferred to the United States when AI features are used (Anthropic and OpenAI for text, Google for image and video generation, and separately, Google for face-detection and content-moderation screening of source images and generated media — see section 4) and to the social platforms you connect when you publish. We comply with applicable data protection regulations, including the GDPR for EU users.

9. Contact

For privacy inquiries, contact us at privacy@propelusai.com or write to PropelusAI, Kolkata, West Bengal, India.