Privacy Policy
1. Who we are
Prophait is browser-based project-scheduling software operated by Samuel Drescher, an individual in California, doing business as Prophait ("Prophait", "we", "us"). When ProphAIt LLC, a California limited liability company, is formed and takes over the Service, we will update this policy to name it. Mail: 21213 Hawthorne Blvd, STE B #1230, Torrance, CA 90503.
This policy explains what personal information the Service collects, why, who it is shared with, how long it is kept, and the choices you have. Questions and requests: support@prophait.com.
When a company uses Prophait, that company decides what goes into its workspace (schedules, resources, comments). We process that workspace content to provide the Service to the company.
2. Do not upload controlled data
Prophait's shared service is not designed or represented for Controlled Unclassified Information (CUI), ITAR-controlled technical data, export-controlled technology, or classified information. Do not store such data in Prophait, and do not send it to the AI assistant. The assistant transmits schedule content to a third party (see section 4). See Terms of Use §6.
3. What we collect and why
| Information | Where it comes from | Why we use it | Legal basis (where applicable) |
|---|---|---|---|
| Account data: email address, name, company name, and password. The password passes through our sign-in server when you set or enter it, and is stored only as a one-way hash that we cannot read. | You, at sign-up on auth.prophait.ai | Create and secure your account, sign you in, send verification and password-reset emails | Performance of contract |
| Multi-factor authentication, if you turn it on: the secret shared with your authenticator app, stored by our sign-in server | You | Secure your sign-in | Performance of contract |
| Workspace membership and role (admin, PM, contributor, viewer) | You and your workspace administrator | Control who can see and change what | Performance of contract |
| Workspace content: schedules, tasks, dates, notes, costs, resources (which may include people's names), baselines, comments, @mentions, folders, and anything imported from MS Project, Primavera P6 or Excel | You and your workspace members | Provide the Service | Performance of contract |
| Audit log: who made which change, and when | Generated by the Service | Accountability for your workspace administrators, security, troubleshooting | Legitimate interests; performance of contract |
| AI assistant transcripts | You, when you use the assistant | Show conversation history to project members, and give the assistant context | Performance of contract |
| Your AI provider API key, and your workspace's Jira credentials | You or your administrator, only if you choose to connect them | Call those services on your behalf | Performance of contract; your instruction |
| Support and feature requests (your email, subject, message) | You, through the in-app Help tab or by email | Respond to you and improve the Service | Legitimate interests |
| Phone calls: your phone number, the time and length of the call, and any voicemail you leave (with its automatic transcript) | You, if you call the phone number shown in our ads | Answer your call and respond to you | Legitimate interests |
| Controlled-data interest signups: email address, optional company name, and the option chosen (hosted, on-premises, or either) | You, through the "stay informed" form on prophait.ai | Contact you about Prophait's options for controlled data (CUI or export-controlled data), and count interest in each. Used for nothing else; not sold, and shared only with the providers in section 6 | Legitimate interests: answering your request to be contacted, and gauging demand |
| Server and access logs: IP address, browser user agent, requested URL, time, response status, including the page address and any campaign tags in it (Google click identifiers are removed before logging) | Your browser, automatically | Operate and secure the Service and investigate incidents | Legitimate interests |
| Signup campaign tags: the campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term) on the link you followed to reach us, and a yes/no flag for whether that link came from a Google Ads click. We do not keep Google's click identifier. | The link you clicked, for example one of our ads | Learn which ads and campaigns lead to new workspaces. Stored once, on the workspace record, when the workspace is created | Legitimate interests |
| Early-use milestones: whether, in a workspace's first 7 days, it imported a schedule, ran a DCMA check or applied an assistant edit | Generated by the Service | Understand whether new workspaces get value from the Service | Legitimate interests |
| Billing records (from the start of paid plans): plan, number of editors, subscription status, and Stripe customer and subscription identifiers. Your card details, billing name and address go directly to Stripe; we don't receive your card number. | You or your administrator, through Stripe Checkout | Charge for paid plans, keep tax and accounting records | Performance of contract; legal obligation |
| Activity timestamps (when a workspace was last used) | Generated by the Service | Apply the workspace inactivity policy (Terms §5) | Performance of contract |
We advertise Prophait on other websites, such as Google Search. We do not put advertising pixels, tags or cookies from Google, LinkedIn, Reddit or any other ad network on our sites, and we do not send ad networks information about you. If you call the phone number shown in one of our Google ads, Google may connect the call through a Google forwarding number and report the call's time, length and your area code to our ads account, so we can count calls per ad. We do not sell personal information or share it for cross-context behavioral advertising. We do not use your workspace content to train AI models.
4. The AI assistant
The assistant is optional and runs on your own AI provider API key. Each time you send it a message, the Service sends the following to the AI provider that issued your key, under that key:
- your message;
- content from the open schedule, including task names, dates, notes, costs and resources;
- the names of up to 20 other schedules you can access and, when the assistant looks them up to answer you, summaries and task details from those schedules;
- up to the 40 most recent prior messages in that project's assistant conversation.
Transcripts are stored per project and are visible to members of that project. They are deleted when the project is deleted or the conversation is cleared.
Because the requests are made under your own account with the AI provider, your agreement with that provider governs how it handles them, including how long it keeps them, whether it uses them to train models, and where it processes them, which may be outside the United States. Review the provider's terms and privacy policy before you connect a key. You can remove your stored API key at any time.
5. Integrations and sharing features
- Jira. Jira is connected only if a workspace administrator sets it up. Once connected, task data you choose to link (such as names, dates and status) is exchanged with your Atlassian site. Data from Jira (such as due dates and status) flows back into Prophait. The workspace's Jira credentials are stored encrypted.
- Share links. Members who can edit a schedule can create a view-only link to it. Anyone holding the link can view a reduced copy of the schedule without signing in. That copy excludes costs, rates, notes and resources. Links expire after 7 days and can be revoked earlier.
- Email. We send account emails (verification, password reset), notification emails (for example, when you are @mentioned or assigned), and inactivity warnings to workspace administrators. These emails can contain names, task names and comment text.
6. Who we share information with
We share personal information only with the service providers and other recipients below, with third parties you direct us to, or where the law requires it.
| Provider | What they do | Data involved | Location |
|---|---|---|---|
| Amazon Web Services (Lightsail, Lightsail object storage, SES) | Hosting, database, backups, outbound email | All Service data; email recipients and content | United States (us-west-2) |
| Your AI provider: directed by you, under your own API key | AI assistant | Assistant requests as described in section 4 | Set by your agreement with that provider |
| Atlassian: directed by your workspace administrator, only if Jira is connected | Jira integration | Linked task data | Per your Atlassian site |
| Google Workspace (Gmail) | Our support mailbox | Support requests and the email address you send from; notifications of controlled-data interest signups | Google's data centers, which may be outside the United States |
| Google Voice and Google Ads call reporting | Our business phone line | Your phone number, call time and length, voicemail and its transcript; for calls from an ad, the call's time, length and your area code | Google's data centers, which may be outside the United States |
| Google Fonts (fonts.gstatic.com) | Supplies a fallback font to the app's rendering engine | Your IP address and browser details, as part of an ordinary web request. No account or workspace data | Google's global network |
| Stripe, Inc., and Link, Stripe's affiliate that resells paid plans as merchant of record (Stripe Managed Payments), from the start of paid plans | Payments, subscriptions, sales tax | Workspace name and ID, plan and editor count; the billing name, email, address and payment details you give Stripe | United States |
Prophait's operator, who runs the servers, has administrative access to them. We access workspace content only to operate, secure, back up or support the Service, at your request, or where required by law. If Prophait is involved in a merger, acquisition, sale of assets or transfer to a successor entity (including ProphAIt LLC), personal information may transfer to the successor under this policy.
7. Cookies and browser storage
- prophait.ai (this site) sets no cookies and loads no third-party scripts, analytics, advertising pixels or trackers. If you arrive through a campaign link, it keeps that link's campaign tags in tab-only browser storage (cleared when you close the tab) and adds them to links into the app.
- auth.prophait.ai (sign-in) sets cookies that are strictly necessary to keep you signed in and complete sign-in. These include a "remember me" cookie if you choose that option.
- app.prophait.ai uses your browser's local storage to keep you signed in. It stores sign-in tokens, display preferences such as theme, zoom, column layout, filters and recently opened schedules, and short-lived sign-up details such as a pending invitation and the plan you picked. While you are signing in, it briefly uses tab-only storage for one-time sign-in values. If you arrived through a campaign link, it keeps those campaign tags in local storage and uses them for up to 30 days; they are removed when you create or join a workspace or sign out. Your AI provider API key is never stored in your browser.
- The app uses no analytics, advertising or tracking tools. Apart from the font request in section 6, it contacts only Prophait's own servers.
Signing out removes your sign-in tokens and campaign tags. Clearing your browser's site data for these sites removes everything listed above.
8. How long we keep information
| Data | Retention |
|---|---|
| Account data | Until you ask us to delete your account. Your account is separate from any workspace and is not deleted when a workspace is deleted. |
| Workspace content, audit log, comments, transcripts | Until deleted by your workspace (the audit log can't be edited or deleted, and is deleted only with the workspace), or until the workspace is deleted, including, for free Starter workspaces with no subscription, deletion under the inactivity policy: after 90 days with no member sign-in, following a warning at 60 days (Terms §5). Deleting a project deletes its assistant transcript. |
| Signup campaign tags and early-use milestones | Until the workspace is deleted |
| Billing records | As long as tax and accounting law requires, generally up to 7 years |
| Share-link records | A link stops working after 7 days or when revoked. The record is deleted with the project. |
| Support requests | 24 months after the request is closed |
| Phone call history and voicemails | 24 months after the call, or after the request it raised is closed, whichever is later. Call details in our Google Ads reports are kept as long as Google Ads keeps them. |
| Controlled-data interest signups | Up to 24 months after your latest signup, or until you ask us to remove it (support@prophait.com), whichever is sooner. The notification email we receive about your signup is deleted at the same time. Copies in database backups are gone within 30 days of deletion. |
| Web server and sign-in server logs | Rotated by size, not by date: up to 250 MB per service, then overwritten |
| Database backups | Taken nightly. Kept for 14 days on the server and 30 days in separate AWS object storage in the same region. Deleted data can therefore remain in backups for up to 30 days. |
9. Your choices and rights
These rights are available to everyone who uses Prophait, wherever you live.
- Access and correction. You can update your name and email in your account settings. You can export any schedule you can view (MS Project XML, Primavera XER, Excel).
- Deletion. You can delete schedules, comments and assistant conversations you have permission to delete, and remove your stored API key. To delete your account or a whole workspace, email support@prophait.com.
- Requests. You can ask us to access, correct, delete or provide a copy of the personal information we hold about you, or object to our use of it. We will verify your identity first, and we aim to respond within 30 days. If the information is workspace content controlled by a company, we may refer you to that company's administrator. You may use an authorized agent to make a request; we may ask for proof of the agent's authority.
- Users outside the United States. Prophait is intended for businesses in the United States, and paid plans are sold only to US billing addresses. Your information is stored and processed in the United States, so if you use Prophait from another country it is transferred there. If you are in the EEA or the UK, you also have the right to restrict processing and to complain to your local data protection authority.
We will not discriminate against you for exercising any of these rights.
10. California residents
CalOPPA. This policy describes the categories of personally identifiable information we collect (section 3), the third parties we share it with (section 6), how you can review and request changes to it (section 9), how we notify you of changes (section 13), and its effective date (above).
Do Not Track. Prophait does not track you across third-party websites, and does not allow third parties to collect information about your online activity across sites through the Service. We therefore do not change our practices in response to a browser's Do Not Track signal, because there is no cross-site tracking for it to turn off. Because we do not sell or share personal information, a Global Privacy Control signal has nothing to opt you out of. If that changes, we will treat GPC as a request to opt out of sale and sharing.
CCPA/CPRA. We extend the rights in section 9 to California residents whether or not the California Consumer Privacy Act applies to us. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that would trigger a right to limit.
Shine the Light. We do not disclose personal information to third parties for their own direct-marketing purposes.
11. Security
We protect information with measures appropriate to an early-stage service:
- connections to all public Prophait sites are encrypted with TLS;
- workspace data is isolated in the application and again by database row-level security;
- access inside a workspace is role-based, and invitations default to view-only access;
- stored API keys and Jira credentials are encrypted, and after you save a key only a masked hint of it is shown;
- the application cannot edit or individually delete audit-log entries; they are removed only when the workspace is deleted;
- passwords are stored only as a one-way hash that we cannot read, and must be at least 12 characters.
You can turn on multi-factor authentication with an authenticator app, and workspace administrators can require it for all members. Prophait is not certified or assessed under NIST SP 800-171, CMMC, FedRAMP, SOC 2 or ISO 27001. No system is completely secure, and we cannot guarantee the security of your information. If we learn of a breach affecting your personal information, we will notify you as required by law. To report a security issue, email support@prophait.com with "SECURITY" in the subject.
12. Children
Prophait is a business tool for adults; it is not intended for anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.
13. Changes to this policy
We may update this policy as the Service changes. We will change the effective date above. We will announce material changes on the site or by email before they take effect. If a change expands how we use information we already hold, we will ask for your consent where the law requires it.
14. Contact
Samuel Drescher, doing business as Prophait · 21213 Hawthorne Blvd, STE B #1230, Torrance, CA 90503 · support@prophait.com