Privacy policy

1. Our Approach

YOU ARE NOT OUR PRODUCT.

We collect the minimum data needed to run the Service, and we do not monetize your attention nor your information.

Specifically:

• No advertising. We show no ads and share no data with ad networks.
• No tracking. We run no analytics — not even anonymized — and no tracking pixels, web beacons, or fingerprinting. Our marketing site makes no third-party requests at all — even fonts are served from our own servers. The one exception is the video library in our docs, which connects to YouTube’s privacy-enhanced player only after you press play — until then, no connection to YouTube is made.
• No AI training. Your queries, saved items, chats, and anything else you create in the Service are never used to train AI models — ours or anyone else’s.
• No data mining. We do not analyze your behavior, build profiles of you, or derive anything from your data beyond serving it back to you.
• No sale of data. We do not sell, rent, or trade Personal Data, and we never will as long as this policy stands.
• Only essential cookies. The only cookies we set are the ones required to sign you in and operate the Service. See Section 6 for the complete list.

In this policy, Personal Data means any information relating to an identified or identifiable person, and Processing means any operation performed on Personal Data.

2. Data Boundaries

Start with the complete inventory: the only Personal Data the platform holds about you is what our sign-in provider, Clerk, passes us — your email address and a display name, mapped to internal account numbers. That is the whole list. Everything else in the Service is content you create, and the rest of this section describes exactly where it lives and who can see it.

• The tenant wall. Every record in the platform is scoped to a tenant. No tenant can see another tenant’s data — ever. This is not a permission setting that could be misconfigured; it is a property of how every query in the platform is built.
• Your private workspace. Everything you create in Workbench — Brave Search queries, The Sandbox, Perplexity AI queries, Custom RSS Feeds, and My Published Feed — and everything in your User Settings — Saved Articles, Saved Searches, My Engagements, Custom Presets, Notification Preferences, and The Last Baton — is stored to your identity. You control these items. All of them are private to you: no other tenant or user can see any of them.
• Team Chats. The one place sharing happens is the room you build for it. You own your chat: you may invite up to 50 users, and as owner you may remove or ban members at any time. The chat stream is visible only to the Team Members you have appointed — no tenant or user outside that cohort can see it.
• Our staff. PRMNews staff access production data only for operations and support, under access controls.

3. Information We Collect

3.1 Information You Provide

• Account registration: sign-in runs on Clerk (see Section 5). What we store is your email address and display name, mapped to internal account numbers; your password lives only with Clerk and never touches our systems.
• Billing: if you purchase a subscription, your payment card details are collected directly by Stripe, our payment processor. We never see or store full card numbers — we receive only what is needed to manage your subscription (such as plan, status, and the last digits of your card).
• Early-access and contact requests: if you submit our early-access form, we collect the fields you enter — name, email address, location/timezone, a short description of yourself, and any social profile links or notes you choose to include.
• Support correspondence: anything you include when you email us or open a support ticket, including any file attachments you add.

3.2 Information Collected Automatically

• Server logs: like nearly every website, our hosting infrastructure records standard request logs — IP address, timestamps, requested pages, and error reports — used for security and debugging, not profiling.

That is the full list. We do not collect browsing history, click paths, device fingerprints, or behavioral analytics, and we receive no data about you from data brokers or social platforms.

4. How We Use Your Information

1. Provide the Service: authenticate you, deliver features, and manage your subscription.
2. Transactional email: account notices, sign-in invitations, and billing confirmations.
3. Newsletters: occasional product and editorial email. You may opt out at any time via the unsubscribe link in every message, and opting out never affects your account.
4. Support: respond to your requests and troubleshoot problems.
5. Security & compliance: detect abuse, enforce our Terms of Service, and meet legal obligations.

5. Sharing & Service Providers

We share Personal Data only with the service providers required to operate the Service, each bound by contract to process it solely on our instructions:

• Vercel — hosting and infrastructure (serves the Service and keeps the server logs described in Section 3.2)
• Clerk — authentication and account management
• Resend — email delivery (transactional email and newsletters, including early-access requests)
• Stripe — payment processing for subscription checkout and billing, via Clerk Billing (your card details go directly to Stripe and never touch our servers)
• Convex — application database where support tickets, Team Chats, and file attachments are stored — each stored to your identity, inside the boundaries described in Section 2
• MongoDB Atlas — database hosting for the platform’s application data: the account mapping described in Section 2 (your email address and display name, keyed to internal account numbers) and the content you create, stored to your identity
• Brave Search and Perplexity AI — engaged only when you run a Workbench query against them. Queries go out under PRMNews’s own API credentials and contain only the query text — no account identifiers, no email, nothing that identifies you. To the provider, every query comes from PRMNews, not from you. Results are stored to your identity in our database, where the boundaries in Section 2 apply.

Beyond those providers, we disclose Personal Data only:

• For legal & safety reasons: when required by law or court order, or to protect rights, property, or safety
• In a corporate transaction: in the event of a merger, acquisition, or sale of assets, subject to this policy
• With your consent: to any other party you explicitly authorize

6. Cookies

We use no analytics cookies, advertising cookies, or tracking technologies of any kind. The only cookies the Service sets are strictly necessary ones — the kind required for the Service to function, which is why you will not see a cookie consent banner here. The complete list:

None of these cookies is used for analytics, advertising, or tracking. The prm_preview cookie is httpOnly and secure — unreadable by scripts and sent only over encrypted connections. The app’s sign-in cookies are set and managed by Clerk and carry only authentication state. The Stripe cookies appear only after you open the subscription checkout; they are set by Stripe to protect against payment fraud and carry no PRMNews account information. You can delete any of them in your browser settings at any time: deleting the app’s cookies signs you out, and deleting prm_preview re-gates the marketing site if you were browsing with a pre-launch preview link.

Note: when you read an article in the app, its images currently load directly from the publisher’s servers — so, as with any image on the web, the publisher sees a standard request from your browser (including your IP address), and some publishers attempt to set cookies on their own domains. Those are not our cookies; we neither read nor use them. Likewise, videos in our docs library play from YouTube’s privacy-enhanced player (youtube-nocookie.com): nothing loads from YouTube until you press play, and any storage the player uses after that belongs to YouTube, not to us.

7. Data Retention

We retain Personal Data only as long as necessary to:

• Provide the Service to you (account data lives as long as your account does)
• Comply with legal obligations (e.g., tax and accounting records for billing)
• Resolve disputes and enforce our agreements

When Personal Data is no longer needed — for example, when you delete your account or ask us to remove an early-access request — we delete or anonymize it.

8. Security

We protect Personal Data with safeguards that include:

• Encryption in transit (TLS) for all connections, and encryption at rest
• Delegating authentication and payment handling to specialized providers so credentials and card numbers never touch our servers
• Access controls limiting who can reach production data
• Cookies scoped to authentication and gate access only, never to tracking

No system is entirely foolproof. If you suspect unauthorized access to your account, contact us immediately at privacy@prm.news.

9. International Data Transfers

The Service is operated from the United States, and Personal Data is stored and processed there. Where the law of your jurisdiction requires safeguards for cross-border transfers (such as the EU’s standard contractual clauses), we rely on those mechanisms with our service providers.

10. Your Rights & Choices

Depending on your jurisdiction, you may have the right to:

• Access: obtain a copy of your Personal Data
• Correction: request updates or corrections
• Deletion: ask us to erase your Personal Data
• Portability: receive your data in a machine-readable format
• Restriction & objection: limit or object to certain processing
• Withdraw consent: where processing is based on consent

To exercise any of these rights, email privacy@prm.news. We honor these requests for everyone, not only where the law requires it, and we will respond within applicable legal timeframes.

11. Special Notices

11.1 GDPR (European Users)

Our legal bases for Processing are: performance of a contract (providing the Service you signed up for); our legitimate interests (securing and operating the Service); legal obligations; and your consent (newsletters and anything else you explicitly opt into). Your rights under Articles 15–22 of the GDPR are described in Section 10.

11.2 CCPA (California Residents)

You have the right to know, delete, and opt out of the sale or sharing of your Personal Data. We do not sell or share Personal Data as those terms are defined by the CCPA — we disclose it only to the service providers listed in Section 5. To submit a verified request, email privacy@prm.news.

11.3 Children’s Privacy

The Service is not directed to children under 16, and we do not knowingly collect Personal Data from minors. If you believe we have, please contact us to request deletion.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above, and for material changes we will notify you by email or an in-app notice before they take effect. If we ever propose a change that expands what we collect, we will say so plainly rather than bury it.

13. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or our privacy practices, please contact:

Thank you for trusting PRMNews with your data. Keeping that trust is why this policy is short.