Last updated 7 August 2026
Privacy Policy
probr watches companies, not people. This page sets out exactly what we hold, why we hold it, who else touches it, and how to get it back or get rid of it.
In short. We collect the account details you give us, the competitors you ask us to watch, and the public material we find about them. We set no cookies and run no advertising or analytics trackers. We never sell your data and never use it to train AI models. Deleting your account deletes it, and section 9 says exactly how.
1.Who we are
probr (“probr”, “we”, “us”) is operated by PHAM HOANG HUY, trading as probr. For everything described here we are the data controller, except where section 5 says otherwise.
Effective 25 July 2026. Privacy questions: privacy@probr.ai.
2.What we collect
Grouped by why it exists, not by how our database happens to be laid out.
| Data | What it is | Where it comes from |
|---|---|---|
| Founding places | If you ask for one of the free founding places from the home page, we store the email address you gave, the position you took in the queue, and which site sent you — the referring page, not a tracker. It is the one thing here we hold before you have an account. We use it to write to you when a place is yours and for nothing else, and asking us to remove it costs you the place and nothing more. | You, from the form on the home page |
| Account | Email address, display name and avatar if you set one, and a hash of your password. If you sign in with Google or Apple we store the account identifier they return, never your password. | You, at sign-up |
| Workspace | Workspace name and your role in it. | You |
| Competitors you track | The company names and website addresses you enter, plus the profile we build about each company: what it sells, where it publishes, and its public social profiles. | You, then our AI research step |
| Signals and briefs | Public material we find about those companies — announcements, changelogs, pricing changes, news coverage — and the summaries we generate from it. | Public sources on the open web |
| Delivery settings | Your Slack incoming webhook URL, and any email addresses you choose to send briefs to. | You |
| Devices | A push notification token for each mobile device you turn notifications on for. | Your device |
| Support | Messages you send us and the address to reply to. | You |
| Billing | Your Paddle customer and subscription identifiers and your renewal date. Card numbers are handled by Paddle and never reach our servers. | Paddle |
| Operational logs | Request method, route, status code and duration; error messages and stack traces; and the token count and cost of each AI call, attributed to a workspace. These records contain no IP addresses and no user identifiers. | Our own systems |
We do not ask for and do not want special-category data — health, biometrics, political opinions, religious beliefs or anything comparable. Please do not put it into a support message or a workspace name.
3.Information about other people
Two parts of probr can involve people who never signed up, so we are explicit about both.
- Recipients you add.When you enter someone’s email address to receive briefs, we process it only to deliver those briefs. For that address you are the controller and we act on your instructions — only add people who expect to hear from you, and tell them where the mail comes from.
- Named individuals in signals. Competitor news sometimes names people — a new CEO, a departure, a lawsuit. Where that happens we process published information about identifiable people on the basis of our and our customers’ legitimate interestin understanding a market. We take it only from public sources, never build profiles of individuals, and will remove a person’s details on request under section 9.
4.What we use it for
- Writing to you when a founding place you asked for is available, if you asked for one.
- Running your account: signing you in, keeping you signed in, and showing you your workspace.
- Doing the job you hired us for: finding and classifying public material about the competitors you chose, and writing the briefs you read.
- Delivering those briefs to the channels you configured — email, Slack, and push notifications.
- Keeping your plan in sync with the payment Paddle took on our behalf.
- Keeping the service up: measuring latency and errors, and tracking what our AI usage costs so we can budget for it.
- Answering your support messages.
- Meeting legal obligations, and defending legal claims where we have to.
We do not use your data for advertising, we do not profile you, and we do not make automated decisions that produce legal effects about you. We do not send marketing email unless you ask us to.
5.Legal basis
If you are in the EU, UK or another jurisdiction with an equivalent regime, we rely on:
- Contract — for everything needed to give you the service you signed up for: your account, your competitors, your briefs, your delivery settings, and billing.
- Legitimate interest — for keeping the service secure and available, for the operational logs in section 2, and for gathering public information about companies and the people who speak for them.
- Consent — for push notifications on a device, which you turn on and can turn off at any time, and for asking us to hold a founding place, which is a form you chose to submit and can ask us to undo.
- Legal obligation — for records we are required to keep, such as tax records for payments.
6.Who else touches your data
We use a small number of service providers. Each processes data only on our instructions and only for the purpose below. We do not sell your data, and we do not share it for anyone else’s advertising.
| Provider | What it does for us | What it sees |
|---|---|---|
| Google (Gemini API) | Researches competitor profiles, classifies public material into signals, and writes briefs. | Competitor names, their public material, and the prompts we build from it. Not your password, not your billing details. |
| Paddle | Sells the subscription as merchant of record, takes payment, and hosts the checkout and billing portal. | Your email, your card and billing details (directly — they never reach us), and your subscription. |
| Vercel | Hosts the web app. | Standard web request data for pages you load. |
| Cloudflare | Carries traffic between the internet and our API. | Network-level request data in transit. |
| Expo | Delivers push notifications. | Your device push token and the notification text. |
| Email provider | Sends briefs and account mail. | Recipient addresses and the content of the brief. |
| Slack | Receives briefs — only if you configure a webhook. | The brief content you chose to post. |
Our database and job queue run on infrastructure we operate ourselves. We may also disclose data where the law requires it, or to establish or defend legal claims. If the business is ever sold or merged, your data may transfer with it, and we will tell you before that takes effect.
7.Where your data goes
Our providers operate internationally, so your data may be processed outside your country — including in the United States. Where required, transfers out of the EEA or UK rely on the European Commission’s Standard Contractual Clauses or an adequacy decision. Confirm the exact mechanism and the location of your own database before publishing.
8.How long we keep it
| Data | Kept for |
|---|---|
| Account, workspace, competitors, signals and briefs | As long as your account exists |
| Founding place requests | Until the founding round closes and every place has been offered, then deleted. Sooner if you ask us to. |
| Request logs (method, route, status, duration) | 7 days, then deleted automatically |
| Error records and AI cost records | 30 days, then deleted automatically |
| Sign-in refresh tokens | Until they expire or you sign out |
| Billing records | As required by tax and accounting law in our jurisdiction |
The 7-day and 30-day windows are enforced by a scheduled job, not by hand. When you delete your account, section 9 applies immediately rather than at the end of any window.
9.Your rights
Wherever you are, you can ask us to give you a copy of your data, correct it, delete it, or export it. Depending on where you live you may also have the right to object to or restrict processing, to withdraw consent, and to complain to your data protection authority.
- Delete your probr account, yourself. On the web, open Settings → Account and choose Delete account. In the iOS and Android apps, open the Settings tab and choose Delete account. You will be asked to type your email address to confirm, because it cannot be undone.
What that deletes: your user record, your name and email address, your sign-in identities and registered devices, and — where you were the only member — your workspace along with its competitors, signals, briefs, reports and delivery settings. It happens immediately, not at the end of any retention window.What is kept, and for how long: request logs for 7 days and error records for 30 days, both deleted automatically by a scheduled job; and billing records for as long as tax and accounting law in our jurisdiction requires. Nothing in either set is used to rebuild an account. - Anything else. Email privacy@probr.ai. We answer within 30 days and will not charge you or treat you differently for asking.
10.Cookies and tracking
probr sets no cookies. There are no advertising cookies, no analytics cookies and no third-party trackers on this site.
The web app stores three things in your browser’s local storage: your sign-in token, your refresh token, and whether you keep the sidebar open. These stay on your device, are never sent to anyone but us, and clearing your browser data removes them. Because none of this is used for tracking, there is nothing to consent to and no cookie banner to dismiss.
Read the full detail on the cookie page.
11.Security
- Traffic is encrypted in transit with TLS.
- Passwords are stored only as hashes; we cannot read them. Refresh tokens are stored hashed as well.
- Our database and job queue are not exposed to the internet — they are reachable only from our own services.
- Card details are handled by Paddle and never reach our servers.
- Access to production is limited to people who need it, and administrative actions are recorded.
No system is perfectly secure. If a breach affects your personal data we will notify the relevant supervisory authority within 72 hours of becoming aware of it, as the GDPR requires, and will tell you directly where the breach is likely to put your rights at high risk.
12.Children
probr is a business tool and is not directed at children. You must be at least 16 in the EEA, or 13 elsewhere, to hold an account. We do not knowingly collect data from children; if we learn that we have, we will delete it.
13.Changes to this policy
When we change this policy we update the date at the top. If a change materially affects your rights we will tell you by email or in the app at least 30 days before it takes effect, so you can close your account if you disagree.
14.Contact
PHAM HOANG HUY, trading as probr
Privacy: privacy@probr.ai
You also have the right to complain to your local data protection authority if you think we have got something wrong. We would rather you told us first.