Skip to main content

Privacy Policy

This policy explains what personal data we process when you visit the site or use Pranory, what we use it for, who we share it with and how you can exercise your rights. It is governed by Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Who is the controller

  • Controller: Adrià Colomer Serra
  • Tax ID (NIF): 33956328W
  • Address: C/ Mallol 35, 2n 2a, 08512 Sant Hipòlit de Voltregà (Barcelona)
  • Privacy email: hello@pranory.app

This applies to your account, billing and browsing data. For the business and contact data you work with inside Pranory, you (or your company) are the controller and we act as processor: see below.

What data we process

  • Account: name, email and password (stored hashed).
  • Workspace: name, members, roles and settings.
  • Provider keys: the Google Maps and AI keys you connect. They are stored encrypted and only used to make the calls you trigger.
  • Connected mailboxes: SMTP/IMAP server, username and password (encrypted), the emails you send from Pranory and the replies you receive in that mailbox.
  • Businesses and contacts: the business data you find on Google Maps, what enrichment adds (website, phone, contact emails, social profiles) and anything you import. This is mostly company data, but it can include people's names and emails.
  • Sending activity: opens (through a tracking pixel in the emails you send), replies and unsubscribes.
  • Usage: actions in the application (territories, searches, enrichments, sends) to calculate your plan usage and improve the product.
  • Billing: handled by Stripe. We keep the customer reference and subscription status, never full card details.
  • Forms: what you send us through the contact, demo or "Ask for help" forms.
  • Browsing: IP address, browser and pages visited, in technical logs and, if you accept them, in analytics cookies.

What we use it for

  • Providing the service: finding businesses, enriching and prioritising them, sending your emails and reading the replies.
  • Managing your account: access, permissions, billing, plan limits and support.
  • Keeping the service secure: detecting abuse, errors and unauthorised access.
  • Improving the product: aggregated usage analytics.
  • Contacting you: necessary emails about your account, billing or security. Marketing emails only if you opt in, and you can unsubscribe at any time.
  • Performance of a contract (art. 6(1)(b) GDPR): everything needed to provide the service you sign up for.
  • Legitimate interest (art. 6(1)(f) GDPR): security, fraud prevention and aggregated product analytics.
  • Consent (art. 6(1)(a) GDPR): marketing emails and analytics cookies. You can withdraw it at any time.
  • Legal obligation (art. 6(1)(c) GDPR): tax and accounting obligations.

Pranory as processor

The businesses and contacts you search, import or contact from Pranory are processed by you, under your own legal basis. We process them only on your behalf and following your instructions, as a processor (art. 28 GDPR).

This means you decide who you write to, and you are the one who must comply with data protection and electronic marketing law (GDPR and LSSI-CE) towards those people. The terms of that processing are in the "Data processing" annex of the Terms of Service and are accepted when you accept the terms.

Providers and international transfers

We use external providers to run the service (hosting, payments, error logging, analytics with consent, bot protection and fonts). All of them are contractually bound to protect the data. The full list, with each provider's purpose, location and privacy policy, is in Subprocessors.

On top of that, Pranory calls the providers you connect using your own key: Google Maps Platform to find businesses, and OpenAI, Anthropic, Google Gemini or OpenRouter for AI enrichment. The data sent in those calls is processed by that provider under your contract with them. Emails go out from your own mailbox, through your email provider.

When a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision (such as the EU-US Data Privacy Framework) or on the European Commission's standard contractual clauses.

How long we keep it

  • Active account: for as long as the account exists.
  • Deleted account: personal data is deleted within 30 days. We may keep anonymised usage data.
  • Billing: as long as tax and commercial law requires (generally up to 6 years).
  • Contact forms: as long as needed to handle your request and at most 12 months.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time, and withdraw any consent you have given.

Write to hello@pranory.app. We reply within one month at the latest.

If you think we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

If you are a business or contact that a Pranory customer has written to, please contact the sender first: they are the controller of that data. If you write to us, we will forward your request to them.

Security

We encrypt provider keys and mailbox credentials, use encrypted connections (HTTPS) and limit internal access to what is strictly necessary. Each workspace is kept separate from the others. More details in Security and data protection.

Cookies

We use cookies to keep you signed in and, if you accept them, for analytics. Details are in the Cookie Policy.

Changes to this policy

If we make material changes, we will email you at least 14 days before they take effect. The date of the last update is shown at the top of this page.