1Who we are
Pugi Inc. ("Pugi", "we", "us"), 2810 North Church Street, STE 90978, Wilmington, DE 19802, USA, runs pugi.io, app.pugi.io, logo.pugi.io, the Pugi apps, extensions and tools, and the API. For the personal data described here, Pugi is the controller, except as explained under "Data in your apps".
The Pugi Prompt Enhancer browser extension has its own, more detailed policy at pugi.io/prompt-enhancer/privacy.
Words with a capital letter, such as Service, Brief, Output and Your App, have the meaning given in the Terms of Service.
2What we collect
- Account data
- your name, email address, password (stored only as a hash), the sign-in method you use (Google, GitHub or Apple, if you choose one), language, plan, and team membership.
- Briefs and project content
- what you write, say or upload for Pugi to work on, the code, designs, logos and documents we make for you, files in your projects, and connected repositories. Voice input is turned into text.
- Payment data
- your plan, payment status, invoices and billing country. The merchant of record (Link or Polar) and Stripe collect your card or other payment details; we do not see or store full card numbers.
- API and agent data
- API keys, the calls made with them, credit balance and spending limits. When an agent creates a key without an account, we record the key, its usage and the network address it came from to prevent abuse.
- Usage and device data
- pages and features you use, events such as "project created" or "app published", errors, IP address, browser and device type, and approximate location derived from the IP address.
- Support messages
- what you send us by email or chat and our replies.
- Referral data
- if you arrive through a partner's link and allow Marketing cookies, the partner's referral code and, if you later pay, the fact of the payment, so the partner can be credited.
- Advertising data
- if you allow Marketing cookies on pugi.io or logo.pugi.io: advertising identifiers, your IP address, browser details and the pages you visit, collected by the pixels of our advertising partners.
- Security check data
- the address or repository you ask us to check and the results.
3Why we use it, and our legal bases
Under the GDPR and UK GDPR we must give a legal basis for each use.
- To provide the Service (contract)
- creating your account, building, testing, checking and publishing your apps, making logos and brand kits, running your API calls, and supporting you.
- To take payment and keep records (contract and legal obligation)
- billing, receipts, tax and accounting records.
- To keep Pugi secure and fair (legitimate interests)
- preventing fraud, abuse and free-credit farming, screening briefs and catalogue entries against our Acceptable Use Policy, and investigating incidents.
- To understand and improve the product (legitimate interests, or consent for cookies)
- measuring which features are used and where people get stuck. On our websites, analytics cookies and session recordings run only after you accept them.
- To send account emails (contract and legitimate interests)
- sign-in links, receipts, failed payment notices, build and publish updates, and tips about getting started with your account. You can unsubscribe from non-essential emails at any time.
- To send product news (consent)
- newsletters and announcements, only if you sign up for them. You can unsubscribe from any of them with one click.
- To credit our partners (consent)
- recording that you came through a partner's referral link, only after you allow Marketing cookies.
- To measure and target our ads (consent)
- pixels from Meta, OpenAI (ChatGPT ads) and Reddit, only after you allow Marketing cookies.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated screening can hold a build or a catalogue entry, and a person reviews it if you ask.
4AI models and your content
To do your work, we send your Briefs and the relevant parts of your projects to AI models. We reach most models through a model routing provider, which passes each request to the company that runs the chosen model. The list of these companies is on pugi.io/subprocessors.
We do not use your Briefs, code or Output to train AI models. By default we tell the routing provider to use only model providers that do not keep request data for training. A few models are offered by a single provider; for those the request goes to that provider under its own data terms.
We keep records of AI requests, with personal data such as email addresses masked, to measure cost and quality and to investigate problems.
5Data in your apps
If Your App collects personal data from its own users, for example sign-ups or orders, you are the controller of that data and Pugi is your processor. We store and process it only to run Your App for you. You must give your users your own privacy notice and handle their requests. If one of your users contacts us, we will pass the request to you.
When Your App takes payments through Stripe Connect, Stripe processes your customers' payment data as your payment provider under its own terms. To connect your Stripe account we send Stripe your email address, your project name and identifiers that link the account to your project. Stripe collects the rest of the verification data it needs directly from you.
7International transfers
Pugi Inc. is a US company. Our servers are provided by our hosting provider Hostmarket Inc. and are located in a Hetzner Online GmbH data centre in Germany, in the EU. Several of our providers, including our analytics, email, AI model routing and payment providers, are in the United States. Your data may therefore be processed in the United States and in other countries where our providers or the AI model companies operate.
When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to countries without an adequacy decision, we rely on the provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions where it has one, or on the European Commission's Standard Contractual Clauses with the UK addendum.
8How long we keep it
- Account and project data
- while your account is open. When you delete a project, it is archived and then permanently deleted after a 30-day grace period. When you delete your account, your account data is deleted at once and the content of your projects is anonymised.
- Backups
- deleted data can remain in encrypted backups until they are rotated out, which takes up to six months.
- Billing records
- as long as tax and accounting law requires, usually up to seven years.
- Security and audit records
- a record that an account was deleted, holding only a one-way hash of the email address, so we can prove the deletion and prevent abuse.
- Free website check results
- held in memory for one hour unless you choose to share the result. Our logs record the checked host only as a one-way hash.
- Analytics, logs and AI request records
- only as long as needed to run, secure and improve the Service, after which they are deleted or made anonymous.
- Support messages
- as long as needed to help you and to keep a record of what we agreed.
9How we protect it
We encrypt data in transit, store passwords only as hashes, run your builds in isolated sandboxes, restrict staff access to what each role needs, and keep encrypted backups. No system is perfectly secure. If a breach of personal data is likely to put your rights at risk, we will tell you and the authorities without undue delay, as the law requires.
Found a security problem? See pugi.io/security/disclosure or email [email protected].
10Your choices
- Cookies
- allow or refuse analytics and marketing cookies separately in the banner on our websites, and change your choice at any time under Cookie settings. The Cookie Policy explains each cookie.
- Usage statistics in the apps
- the Pugi desktop app and extensions send usage statistics, never your code or briefs. Turn them off with the "Send usage statistics" or analytics setting. The command-line tool sends error reports without your code, and stops when you set DO_NOT_TRACK=1.
- Emails
- unsubscribe from product news and non-essential emails with the link in the email, or write to [email protected]. We still send emails you need, such as receipts and security notices.
- Export and delete
- delete your account from your account settings at any time, and export your data from your account or by writing to [email protected].
11Your rights
Depending on where you live, you may have the right to access your personal data, correct it, delete it, receive it in a portable format, restrict or object to how we use it, and withdraw consent at any time without affecting earlier use. In the EEA and the UK these rights come from the GDPR and UK GDPR.
If you live in California or another US state with a privacy law, you may have the right to know what personal information we collect and how we use and disclose it, to access, correct and delete it, and to opt out of its sale or sharing for targeted advertising. We share personal information in that sense only if you allow Marketing, and you can withdraw under Cookie settings. We will not treat you differently for using your rights. In the last 12 months we collected the categories listed in "What we collect" for the purposes in "Why we use it", and disclosed them only to the recipients in "Who we share it with".
To use a right, write to [email protected] from the email on your account. We may need to confirm your identity. We reply within one month, or within the time your local law sets, and tell you if we need longer. An authorised agent may make a request for you with your signed permission.
If you are unhappy with how we handled your data, you can complain to the data protection authority where you live or work. We would like the chance to fix it first.
12Children
Pugi is not meant for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, write to [email protected] and we will delete it.
13Changes to this policy
When we change this policy, we update the version and date at the top. If a change is significant, for example a new use of your data, we tell you by email or in the console before it takes effect.
14Contact
Privacy questions and requests: [email protected]. Post: Pugi Inc., 2810 North Church Street, STE 90978, Wilmington, DE 19802, USA.