Privacy Policy

Effective date: 14 October 2026 · Last updated: 13 October 2026

This policy explains what personal information pblc collects, why, who receives it, how long we keep it and what you can do about it. It applies to the pblc app (iOS and Android), to pblc.ai (public profiles, Explore and the website) and to any other service that links to this policy.

Cette politique est aussi offerte en français : pblc.ai/fr/privacy.

In short

• pblc is made by Studio PropelHaus Inc., a company in Montréal, Quebec, Canada.
• We don’t sell or rent personal information, we don’t show ads, and we don’t use your information for targeted advertising. We don’t train AI models on it, and our AI provider, OpenAI, doesn’t use it to train its models (section 5).
• Published profiles and Explore posts are public. Drafts and Sources aren’t published, but anyone who has a private preview link can see that preview, and the assistant can quote approved Sources in its answers.
• A conversation with an assistant is read by the profile’s owner and by the team members whose role includes conversations. Authorized pblc staff and our service providers can access it when needed to run, secure and support pblc.
• Messages to an assistant are sent to OpenAI to write the answers and to screen and sort the conversation.
• If an owner connects Instagram, its assistant answers the direct messages sent to that account; the first automatic reply says it’s automated (section 4.17).
• Around you rounds your location on your device, to about 100 m, before sending it, and we don’t save it.
• You can delete your account at any time: in the app (Settings → Danger zone → Delete account) or at pblc.ai/account/delete.
• Privacy questions and requests: hello@propelhaus.com.

1. Who we are

pblc is a product of Studio PropelHaus Inc. (“pblc”, “we”, “us”), 920-650 rue Wellington, Montréal (Québec) H3C 1T3, Canada. Telephone: +1 514 668 6688. Website: propelhaus.com.

Person in charge of the protection of personal information: Gabriel Labelle, President. You can reach him at hello@propelhaus.com, or by mail at the address above, to the attention of the person in charge of the protection of personal information.

2. Who this policy covers

• Owners: people with a pblc account who create and manage profiles.
• Team members: people an owner invites to work on a profile, as a manager, an editor or a representative.
• Visitors: anyone who views a profile, asks its assistant a question or browses Explore, on pblc.ai or in the app. Visitors don’t need an account.
• People who contact us or join the waitlist on our website.
• People and businesses for whom our team prepared a draft profile before they joined (section 4.12).
• People who send a direct message to an Instagram account that its owner connected to pblc (section 4.17).

Owners decide what they publish and how they use the messages and contact details visitors send them. pblc is responsible for its own handling of personal information, as described in this policy.

3. What we don’t do

• Sell or rent personal information.
• Show ads, or share personal information for targeted advertising.
• Train AI models on your information.
• Add your device’s location to your account or your profile.
• Publish a profile or an Explore post for its owner, with two exceptions: a connected calendar with auto-sync turned on adds its events to the live profile (section 4.4), and our staff can edit and publish a profile to help its owner or to apply our Terms, with the change recorded in the profile’s history (section 7).

4. What we collect, and why

4.1 Your account

What we collect: your email address, the dates you joined and last signed in, your settings (notifications, Explore defaults, places you watch), the profiles you work on and your role on each, the date you agreed to pblc’s use of AI (section 5), the versions of our Terms of Service you accepted and when, and any restriction placed on your account with its reason.

How you sign in. Depending on the version of the app, you sign in with Apple or Google (iPhone, iPad and Android), or with a one-time code we email to you, valid for 10 minutes.

• Sign in with Apple: Apple gives us an identifier for your Apple account and your email address. If you choose Hide My Email, it’s a private relay address that forwards to you. We keep a token from Apple, encrypted, so we can revoke pblc’s access to your Apple ID when you delete your account.
• Google: Google gives us the information shown on its consent screen: your email address, your name and an identifier for your Google account.
• If you sign in with Apple or Google using a verified email address that already has a pblc account, you sign in to that account, so each person has one account.
• Sessions: your sign-in session is kept in your device’s secure storage (the iOS Keychain or the Android Keystore) and on our servers. It lasts up to one year, unless you sign out or delete your account first.
• Face ID, Touch ID or fingerprint (when available): if you turn it on, the app keeps a sign-in token on your device, locked by your device’s biometrics and kept only on that device. Your face or fingerprint stays with your device’s own security system: pblc never receives it.

Why: to create and secure your account, sign you in and give you access to your profiles. We can’t provide an account without this information.

4.2 Your profile

What we collect: what you put on your profile: your name, handle, “What you do”, introduction, photo, links, events (with their dates, venues and addresses), city and neighbourhood, skills and interests, the type of profile and your theme (colours, font, background). We keep the draft you edit, the published version visitors see, and a history of changes: what changed, when, who made the change (including that person’s email address) and whether it came from the app, a connected service or our team.

Public once published. A published profile is public at pblc.ai and in the app. It can appear in Explore, in search engines, in link previews when someone shares it, and in pblc’s search by meaning. It shows your city and neighbourhood, and an exact address only if you publish one (for example a shop, a venue or an event’s location). A draft isn’t published or indexed by search engines. Our team can make a private preview link for a draft: anyone who has that link can see the draft and chat with its assistant. Profile photos are served from web addresses that are hard to guess but not password-protected.

Checked before it’s published. Before a profile or an Explore post is published, we check the text others will read (name, “What you do”, introduction, skills and interests, link titles, events and posts) with OpenAI’s moderation tool. If it flags something, we tell you what to change. If the check can’t run, publishing goes ahead, and reports (section 4.13) catch what it missed.

Help from AI. At your request, AI (section 5) helps draft your text and introduction, picks the type of profile that fits what you do, reads a look from a page or an image, and imports events from a link or text. When you publish, we turn your profile’s words into an embedding (a numerical representation of their meaning) so people can find it by meaning in Explore. Background pictures are generated by Cloudflare Workers AI from colours and a style only, never from your words or your photo.

Promotion. We ask for your permission before using your profile or your posts in pblc’s promotional material, such as store screenshots or ads. Publishing a profile isn’t that permission.

Why: to build and show your profile and to help people find it.

4.3 Setting up your profile, and Sources

What we collect: what you choose to bring in: the public pages you give us (your link-in-bio page or website), which we read; notes you paste (for example a summary written by ChatGPT, Claude or Gemini); your answers to setup questions; and Sources: documents you upload, web pages you import and text you write, so your assistant can answer from them.

How it’s handled:

• Uploaded documents are stored privately and converted to text by Cloudflare Workers AI.
• When a Source is added, OpenAI checks its text for hidden instructions aimed at AI. We may also suggest other pages from your own websites, with OpenAI’s help to rank them.
• A Source is used for answers only after you choose “Use for answers”. Its passages are then sent to OpenAI to create embeddings, so the assistant can find the relevant ones.
• Visitors can’t download your files, but the assistant can quote or summarize approved passages and show their title or web address. Pausing or deleting a Source stops its use from then on; it can’t take back answers already given.

Your responsibility: add only documents and pages you have the right to use. Don’t add other people’s personal information unless you’re allowed to, and don’t add sensitive information (health, financial, government ID numbers, passwords) about anyone.

Why: to prepare your profile and let your assistant answer accurately.

4.4 Connectors

When you connect a service in Settings → Connectors:

• Calendar feeds (Google Calendar, iCloud and other calendars that publish a feed): we keep the calendar’s address, encrypted (a secret address works like a password), and read its upcoming events about every six hours. Private and cancelled events are skipped. New events go to your draft, or straight to your live profile if you turn on auto-sync. To place an event, its address may be sent to Geoapify (section 7).
• Eventbrite (when available): you connect your organizer account through Eventbrite’s own permission screen. We keep the access token, encrypted, read your live upcoming events, and delete past events, as Eventbrite’s terms require.
• Booking pages (Calendly, Cal.com): we keep your booking page’s address so your assistant can offer “Book a time”.
• Players, posts and forms from other services (YouTube, Spotify, Instagram and others): we keep the link you add.
• Instagram (when available): you connect your Instagram professional account through Instagram’s own permission screen, so your assistant answers your direct messages (section 4.17).

Disconnecting stops the reading and deletes the stored address or token. Events already imported from a calendar stay on your profile as ordinary events, which you can edit or remove; Eventbrite events are removed. To also remove pblc’s access on Eventbrite’s side, use your Eventbrite account settings. Each connected service handles your information under its own terms and privacy policy.

Why: to keep your events and booking options up to date, at your request.

4.5 Conversations with an assistant

What we collect: your messages, the replies from the assistant and from the profile’s team, your answers to forms shown in the chat (which can include your name and email address), and the events or booking page shown to you. On pblc.ai you don’t need an account and we don’t ask who you are; a form in the chat may ask for your name and email so the owner can reply. In the app, you ask as one of your profiles, and the owner sees which one.

With each conversation started on pblc.ai, we also keep a keyed code made from your IP address (not the address itself), so the owner can block whoever wrote it (section 4.7), and a one-way code of the conversation’s key held by your browser.

Who can read it: the profile’s owner and the team members whose role includes conversations (managers and representatives). The chat says so before your first message, and says that AI answers and that your messages go to OpenAI. Authorized pblc staff and our service providers can access conversations when needed to run, secure and support pblc (section 7).

On your device: pblc.ai remembers the conversation in your browser for 24 hours (its identifier and a key, not the messages), so a reload continues it. Clearing your browser doesn’t delete the conversation from our servers. In the app, the conversations you start are in your Inbox, under “You asked”.

Bot check and limits: before a visitor’s first message, Cloudflare Turnstile checks that you’re a person, and we limit how many conversations and messages can come from one connection (section 4.15).

AI: your messages are sent to OpenAI to write the answers, screen and sort the conversation, suggest replies to the owner, match questions to the owner’s saved answers and group similar questions (section 5).

Why: to answer your question and pass the conversation to the owner.

4.6 Replies by email, and booking

If you choose to get the reply by email, or give your email address in a form in the chat, we keep it (and your name, if you give it) with the conversation. The owner and the team members with access to conversations can see it, including in their list of contacts. We email you when the owner replies, at most once every 10 minutes, with a link to continue the conversation (valid 30 days) and a link to stop these emails (valid one year). Stopping the emails doesn’t delete your address or the conversation; to have them deleted, write to us (section 11). We don’t use your address for marketing, and our Terms allow owners to use it only to answer your request.

If you open the owner’s booking page from the chat, it opens with your name and email address filled in when you gave them in the chat, so the booking service (Calendly or Cal.com) receives them.

4.7 Help with the Inbox, profiling and automated decisions

To help owners handle their messages, pblc uses AI to:

• Screen new messages for spam, abuse, attempts to manipulate the assistant and off-topic content.
• Sort each conversation: what the visitor wants (a question, a purchase, a booking, a collaboration, support), its topic, which link or page it’s about, and an estimate of how close the visitor seems to buying, booking or hiring (shown to the owner as a lead).
• Suggest replies the owner can edit. A suggested reply is never sent unless someone on the team sends it.
• Group questions visitors ask, so the owner can save answers.

The lead estimate is a form of profiling. It’s based only on the conversation, it’s shown to the profile’s team (not to the visitor), and it’s used to sort their Inbox and notifications. It doesn’t decide anything about you.

Automated decision. When screening finds that a message is spam or abuse, or after more than three crude or off-topic messages in a row, the conversation moves to the owner’s Spam folder and the chat ends: you see “Conversation has ended”. This decision is made automatically. You can ask us at hello@propelhaus.com what information was used, the reasons and main factors that led to it, to have that information corrected, and to have a person at pblc review the decision. The owner can also mark the conversation “Not spam”, which reopens it.

Blocking. The owner or a team member can block the person who wrote a conversation, which moves it to Spam. A person who asked from the app can’t ask that profile again until they’re unblocked. A pblc.ai visitor is blocked through the keyed code of their IP address, for 90 days. Someone who wrote on Instagram is blocked through a keyed code of their Instagram identifier, until they’re unblocked: pblc stops answering and listing their messages, but they can still write to the account on Instagram.

4.8 Profile statistics

When someone views a published profile or clicks one of its links, we record the profile, the link, the time and a broad traffic source (such as “instagram”, “google”, “chatgpt” or “direct”) worked out from the referring page. These records contain no IP address, device, browser or visitor identifier. To count a visit only once per 30 minutes, we use a keyed code made from the IP address, the profile and the link, kept only for that window (section 9). Known bots aren’t counted. We also record the country, region and city the visit came from, as worked out by our hosting provider from the connection (section 4.15), never the IP address. Owners see their views by country and by city for the period; a city with fewer than 3 visits in the period appears only as “Other cities”, so no one stands out. Owners also see how many conversations they had and the topics of the questions asked.

Why: so owners can see how their profile is doing.

4.9 Explore and Around you

• Search: what you type is used to find results. Questions can be read by OpenAI to understand them (in the app; on pblc.ai after a bot check and within a limit per connection), and every search is turned into an embedding by OpenAI to find profiles by meaning. We don’t keep a history of your searches. On pblc.ai, what you typed stays in the page’s web address so you can reload or share it, and it can therefore remain in your browser’s history. When you haven’t picked a place, the app sends your device’s country, and pblc.ai your browser’s language region, only to read place names in your search.
• Around you: only when you open it and allow location access. Your position is rounded on your device to three decimal places (about 100 m north to south, less east to west away from the equator) before it’s sent. It’s used to find what’s nearby and to draw the map, and we don’t save it. The map is drawn by Geoapify from our server: Geoapify receives the rounded point, not your IP address. The map image’s web address contains the rounded point, and the image can be kept by our content delivery network for up to a day.
• Places you watch and Explore defaults: the cities and neighbourhoods you follow and the defaults you save (when signed in; on pblc.ai, defaults stay in your browser). Owners see how many people watch a place, never who.
• Posts: what owners post in Explore is public.
• Blocking a profile: in the app, you can block a profile. It no longer appears in your Explore or Around you, and it can’t ask your profiles. You can undo it in Settings → Privacy & assistant.

Why: to show what’s happening where you’re looking.

4.10 Notifications

If you allow notifications in the app, we keep your device’s push token, its platform and the app version. Notifications go through Expo, then Apple (iPhone and iPad) or Google’s Firebase Cloud Messaging (Android). Notifications about conversations can include the first words a visitor wrote; you can turn previews off in Settings → Notifications. Signing out turns the device off; its record is deleted when you delete your account, or moves to the next person who signs in on that device.

4.11 Team members and invitations

When an owner invites someone by email, we create an account record for that address, so the invitation can wait for them, and email the invitation with the inviter’s address for replies. An invitation lasts 14 days, and the person accepts it in the app. A team member’s replies to visitors are signed with the profile’s name, or with their own name if they choose. An owner can remove a team member at any time.

4.12 Draft profiles we prepare before you join

To invite creators and businesses to pblc, our team sometimes prepares a draft profile from a public link-in-bio page (such as Linktree, Beacons or Stan) that we found or that was suggested to us. We use only pages anyone can see without signing in.

What we collect: the page’s address, your Instagram username when it’s on the list we work from, your name, bio, photo, links, colours and fonts, any email address published on the page, a region, and our notes about contacting you. OpenAI may draft a “What you do”, an introduction, skills, interests and suggested questions from your own words, and we may generate a background picture from your colours. Your photo is copied into our storage.

What happens to it:

• The draft is an unpublished profile held by our team’s account. It isn’t public: it isn’t published, isn’t in Explore and isn’t indexed by search engines. We may create a private preview link to send to you.
• We may write to you, one to one, at an email address you published, about your activity. Our messages say who we are and how to stop hearing from us.
• If you want the profile, we transfer it to the email address you give us, which creates your pblc account. You decide whether to publish it.
• If you don’t want it, or want us to stop contacting you, reply to our message or write to hello@propelhaus.com. We stop contacting you and delete the draft and what we collected: the profile is removed at once and permanently deleted within 30 days. You can also ask us where we got your information.

We keep these drafts until you ask us to delete them, or until we delete them.

4.13 Reports

Anyone can report a profile, an Explore post, an assistant’s answer or a conversation, in the app or on pblc.ai. We keep what was reported, a copy of what it said at the time, the reason, any details the person adds, and who reported it: their account if they’re signed in, or the email address a visitor chooses to give for an answer. Reports are emailed to our team and handled in our internal dashboard.

4.14 Feedback, support and the waitlist

What we collect: messages you send us (in the app, Settings → Feedback, or by email), with your email address, your name, the app version and the type of device; and, if you joined the waitlist on our website, your name, email address, what you do, your goal, a profile link, a handle you reserved and your answers. Feedback from the app is also emailed to our team.

Why: to answer you, fix problems and invite you when pblc is ready for you.

4.15 Security and technical information

• Connections: we process connection information, including IP addresses, to deliver pages, limit abuse and run bot checks. Our limits use keyed codes made from an IP address or an email address; the address itself isn’t stored in our database.
• Bot checks: before a waitlist sign-up, a visitor’s first message and questions read by AI in pblc.ai’s Explore, Cloudflare Turnstile checks in the background that you’re a person. Cloudflare receives your IP address and signals from your browser.
• Server logs: kept up to 30 days, for errors and performance. They’re designed to leave out message contents and visitors’ IP addresses.
• Error reports: when something breaks in the app, on pblc.ai’s pages or on our servers, an error report goes to Sentry. Before it’s sent, we remove request contents, cookies, sign-in headers and web address parameters. Reports from the app and our servers can include your account identifier, never your email address. Sentry receives the IP address of the device or server that sends a report, as with any connection, but we’ve set it not to store IP addresses with reports.
• Website analytics: pblc.ai’s home page and website use PostHog in cookieless mode, without session recordings. Analytics go to PostHog through our own address (pblc.ai/ingest), so PostHog never receives your IP address. It receives the pages and sections viewed, clicks, the page address and referrer, your device and browser type, and your approximate location (country, region and city) worked out by our hosting provider (see Approximate location below). In place of your IP address, PostHog receives a code that changes every day, made from your IP address with a key PostHog doesn’t have, so it can’t be turned back into the address; PostHog uses it only to count visitors and doesn’t keep it. Nothing is stored in your browser. The app, public profiles and Explore don’t use PostHog.
• Approximate location: Amazon CloudFront, the content delivery network of our hosting provider (Amazon Web Services), works out the country, region and city of each connection to pblc.ai and to our servers from its IP address, as part of delivering pages. We use only these names, never coordinates or a postal code, for profile statistics (section 4.8) and website analytics, and we never store them with an IP address.
• AI usage records: for each AI request, the feature, model, amount of text processed, cost, and the profile and account concerned. They contain no message or profile content.

Why: to keep pblc secure, available and working, and to understand how our website is used.

4.16 Device permissions

The app asks before using:

• Location: only for Around you, while you use the app (section 4.9).
• Camera and photos: only to set a profile photo.
• Microphone and speech recognition: only when you tap the microphone to dictate. Dictation uses your device’s speech recognition (Apple’s or Google’s), which may process the audio on their servers under their terms. pblc receives only the text.
• Notifications: section 4.10.
• Face ID or fingerprint (when available): only for biometric sign-in (section 4.1).

You can change these permissions at any time in your device’s settings. Declining one only turns off that feature.

4.17 Instagram messages

When an owner connects their Instagram professional account (Settings → Connectors → Instagram), the profile’s assistant answers the direct messages people send to that account, and the owner and their team can answer them from pblc.

What we keep: for the connected account, its Instagram identifier, its @username and its access token (encrypted). For people who write to it, their identifier for that account, their @username and name, their messages (with edits and reactions; when someone unsends a message, its text is erased and only the fact that a message was unsent remains), and the replies from the assistant and the owner’s team, including replies the owner writes in the Instagram app.

What we don’t keep: photos, videos, voice notes, files or story media. The Inbox only says what was sent (“Sent a photo”), and your profile picture isn’t stored.

How it’s used: only to answer you for the owner, at their request. Messages are screened, sorted and answered with OpenAI (section 5), within the 24 hours Instagram allows after your last message. We don’t estimate how close you are to buying (no lead score), and Instagram messages aren’t used for pblc’s own features or statistics. The owner and the team members whose role includes conversations read them, as in section 4.5.

Stop: write “stop” (or « arrête », “unsubscribe”) and the assistant stops answering you on that account for good; the owner can still answer you personally.

How long: until the owner deletes them, disconnects Instagram and deletes its conversations, or deletes the profile, or until a deletion request reaches us through Instagram (section 13).

5. How AI uses your information

pblc relies on third-party AI for several features. We don’t train AI models, and our providers don’t train theirs on what we send.

OpenAI (United States) writes the assistant’s answers; screens, sorts and groups messages and suggests replies (sections 4.5 and 4.7); checks text before it’s published (section 4.2); helps draft profiles, import events and read a look from a page; checks Sources for hidden instructions; understands searches; and creates the embeddings of profiles, Sources, searches and visitors’ questions. It also drafts the profiles our team prepares (section 4.12).

What we send: only what each task needs. For an answer, that’s the published profile (or a preview’s draft), the relevant passages of approved Sources, saved answers, upcoming events and the recent messages of the conversation. We don’t add the email address a visitor leaves for replies, but anything typed in a message or a form in the chat, including an email address, is part of the conversation that’s sent. When someone asks from the app, we send the name of the profile they ask as.

What OpenAI does with it: under OpenAI’s terms, data sent through its API isn’t used to train or improve its models unless the customer opts in, and pblc hasn’t opted in. We ask OpenAI not to store our answer requests. OpenAI keeps API data for abuse monitoring for up to 30 days, and longer only when the law requires it or when it’s reasonably necessary to protect its services or others from harm. See OpenAI’s data controls.

Cloudflare Workers AI converts uploaded documents to text and generates background pictures from colours and a style. Cloudflare says it doesn’t use this content to train AI models. See Cloudflare’s data usage.

Your choices:

• Before you use the app, it asks you to accept our Terms of Service (again when they change) and, separately, for your permission for pblc’s use of AI with your content and the messages you and your visitors write, and explains what goes to OpenAI. pblc’s main features rely on AI, so if you don’t agree, you can’t use the app; you can delete your account at any time.
• You can turn your assistant off (Settings → Privacy & assistant). It then stops answering, and visitors’ messages wait for you. Screening, sorting and the other AI features keep working.
• Visitors are told before their first message that AI answers, that their messages go to OpenAI and that the owner can read the conversation. On Instagram, the person writes first: the assistant’s first automatic reply says it’s an AI assistant, and says it again after 30 days without messages or when it takes over from the owner.
• AI can be wrong. Approving Sources can’t guarantee that every answer is accurate, or prevent every unintended disclosure. Owners can step in on any conversation.

6. Consent and legal grounds

Quebec and the rest of Canada. We tell you why we collect information when we collect it, and we ask for your consent where the law requires it. Permissions for optional features (location, notifications, reply emails) are separate from accepting our Terms, and you can withdraw them at any time: in your device’s settings, with the link in each email, or by writing to us. Withdrawing consent can stop a feature from working; we’ll tell you what changes.

European Union and United Kingdom. Where the GDPR or the UK GDPR applies, we rely on these legal grounds:

Where we rely on legitimate interests, you can object at any time (section 11).

7. Who receives information

Owners and their teams. A visitor’s messages, form answers and contact details go to the profile’s owner and to the team members whose role includes conversations. Owners must use them only to answer the visitor’s request, unless they have another lawful basis. If you want an owner to stop contacting you, tell them; you can also write to us.

The public. Everything an owner publishes (profile, events, Explore posts) is public.

pblc staff. A small number of authorized pblc staff use our internal dashboard, limited to company accounts, for support, security, moderation and running the service. It shows them account email addresses and dates, profiles, previews of recent conversations, reports, feedback and the waitlist. Staff can also edit a profile, and publish it when needed to help its owner or to apply our Terms; these changes are recorded in the profile’s history.

Service providers who process information for us:

Services your browser connects to. Some content on pblc.ai comes directly from other companies, which receive your IP address and act under their own privacy policies:

• Fonts: profiles with a custom theme load their font from Google Fonts, so Google receives your IP address.
• Embedded content: videos, music, posts, forms and booking pages an owner adds (YouTube, Vimeo, Spotify, Instagram, Calendly and others) load when you tap them, unless the owner chose to show a player with the profile, in which case it loads with the page, without playing. Once loaded, the provider may set its own cookies. We load YouTube from its privacy-enhanced domain and ask Vimeo and X not to track.
• Services you connect or open, such as a booking page (section 4.6) or a connected calendar (section 4.4).

Instagram. When an owner connects Instagram, messages and replies travel through Meta Platforms (Instagram), which handles them under its own terms and privacy policy.

Legal reasons. We may disclose information when the law requires or allows it, for example to answer a valid legal demand, or to protect the safety of people, our users or pblc. When the law allows, we tell the person concerned.

Business transfers. If Studio PropelHaus Inc. or pblc is merged, sold or reorganized, personal information may be communicated as part of that transaction, with the safeguards the law requires.

8. Where your information is processed

We’re in Quebec, Canada, but our main servers are in the United States and some providers work in other countries (section 7). Your information can therefore be processed outside Quebec and Canada, where the law is different and where courts and authorities may be able to access it under local law.

Before entrusting information to a provider outside Quebec, we assess whether it will be adequately protected, taking into account the provider’s commitments and the laws where it operates, and we rely on written agreements: the providers’ data protection terms, which limit their use of the information to providing their service to us.

For people in the European Union and the United Kingdom: Canada is recognized by the European Commission and the United Kingdom as providing adequate protection for commercial organizations. Our providers in the United States receive information under the EU-U.S. Data Privacy Framework (and its UK extension) where they’re certified, or under the standard contractual clauses in their data protection terms. Write to hello@propelhaus.com for details.

9. How long we keep information

When we no longer need personal information for the purpose we collected it for, we delete it or anonymize it as the law requires.

10. How we protect information

• Encrypted connections (HTTPS) everywhere, and encryption at rest by our hosting providers.
• Calendar addresses, access tokens and Apple tokens are encrypted separately and never sent back to the app.
• Uploaded documents are in private storage that only our servers can reach.
• Team members can do only what their role allows: managers manage everything but the profile’s ownership; editors edit the draft and see statistics; representatives handle conversations.
• Our internal dashboard is limited to company accounts and to the staff who need it.
• Error reports and logs are stripped of message contents and credentials.

No system is perfectly secure. If a confidentiality incident presents a risk of serious injury, we notify the people affected and the Commission d’accès à l’information, and any other authority the law requires, and we keep a register of confidentiality incidents.

11. Your rights

You can ask us to:

• Access the personal information we have about you, and learn how it’s used and who received it.
• Correct it if it’s inaccurate, incomplete or out of date. Owners can change most of it directly in the app.
• Delete it, or stop using or disseminating it, where the law allows.
• Get a copy in a structured, commonly used technological format, or have it sent to someone you designate (portability). There’s no export button yet: we prepare the copy by hand when you write to us.
• Withdraw your consent, for example to location, notifications or reply emails.
• Object to processing based on legitimate interests, including draft profiles (section 4.12).
• Get information about an automated decision and have it reviewed (section 4.7).

Quebec: you can also ask us to stop disseminating information about you, or to de-index a link attached to your name, where the law allows it. You can file a complaint with the Commission d’accès à l’information du Québec.

Elsewhere in Canada: you can complain to the Office of the Privacy Commissioner of Canada or to your provincial authority.

European Union and United Kingdom: you also have the right to restrict processing, and to complain to your data protection authority. The contact for residents of the European Union and the United Kingdom is hello@propelhaus.com.

United States: depending on your state, you may have rights to know, access, correct and delete your personal information, and to opt out of its sale, its sharing for targeted advertising or certain profiling. We don’t sell personal information or share it for targeted advertising. We won’t discriminate against you for using your rights.

How to ask: write to hello@propelhaus.com, ideally from the email address on your account. Visitors: tell us enough to find the conversation (the profile, the date and something you wrote). We may need to confirm who you are before answering; don’t send identity documents unless we ask. Someone authorized by law can act for you. We answer within 30 days. It’s free; if the law allows a reasonable fee (for example to transcribe or send a large copy), we tell you first.

Visitors: a conversation is shared with the profile’s owner and their team. We delete our copy on request; the owner may have kept the information they received (for example an email address), and you can ask them directly.

12. Cookies and storage in your browser and device

pblc.ai doesn’t use cookies of its own. It keeps a few items in your browser’s local storage:

Other services on pblc.ai: Cloudflare Turnstile’s bot check (section 4.15), fonts from Google and embedded content (section 7). Website analytics store nothing in your browser (section 4.15).

In the app, your sign-in session and some preferences (such as the profile you last used) are kept on your device, the session in its secure storage. Signing out removes the session. Deleting the app doesn’t delete your account or your data on our servers: use account deletion (section 13).

13. Deleting your account and your data

In the app: Settings → Danger zone → Delete account, then type your email address to confirm.

On the web: go to pblc.ai/account/delete, enter your account’s email address and open the link we send you (valid for 60 minutes) to confirm.

What happens:

• At once: you’re signed out everywhere and the app’s sign-in tokens stop working; your email address is removed from the account; your access to other people’s profiles ends; your watched places, Explore defaults and notification devices are deleted; the calendar addresses and access tokens of services connected to your profiles (such as Eventbrite and Instagram) are deleted; every profile you own is taken down.
• Within a day: the daily cleanup permanently deletes your profiles (there’s no 30-day restore when you delete your account), with their photos, files, conversations, Sources, statistics, posts, connections and team, then your account.
• What stays: messages you sent to other profiles stay in their owners’ Inbox, no longer linked to your account; replies you wrote as a team member stay in that profile’s conversations with the name they were signed with; changes you made to other people’s profiles stay in their history, with your email address; feedback you sent us, a separate waitlist sign-up, reports you made (no longer linked to your account) and AI usage records (without your account identifier) are kept as described in section 9. Backups are replaced as described in section 9.
• Sign in with Apple: if you used it, we revoke pblc’s access to your Apple ID.
• Subscriptions: deleting your account doesn’t cancel a subscription bought through the App Store or Google Play. Cancel it in your store account’s subscription settings.

Deleting just a profile: owners can delete a profile at the bottom of Settings (type its handle to confirm). It disappears at once, can be restored from Settings → Your profiles for 30 days, and is then permanently deleted.

Visitors can ask us to delete a conversation at hello@propelhaus.com (section 11).

Instagram: removing pblc from the apps connected to an Instagram account disconnects it. A data deletion request made through Instagram deletes the connection and every conversation from that account, and pblc.ai/meta/deletion shows what was deleted, with the code Instagram gives you. If you wrote to a connected account, ask us at hello@propelhaus.com to delete your conversation; we tell the owner.

14. Children

You must be 18 or older to create a pblc account, as an owner or a team member. pblc.ai and the app aren’t intended for children under 13, or under the age required to consent to online services where you live if it’s higher. The assistants on pblc.ai aren’t directed to minors.

We don’t knowingly collect personal information from children under 14 in Quebec without the consent of a parent or tutor, or from children under 13 elsewhere. If we learn that we did, we delete it. If you believe a child has given us personal information, write to hello@propelhaus.com.

15. Other sites and services

Profiles link to other websites and services. Their privacy practices are their own: read their policies before you give them information.

16. How we manage personal information

The person in charge of the protection of personal information (section 1) oversees how pblc protects personal information. We:

• assess privacy risks before launching or changing features that handle personal information, and before entrusting information to providers outside Quebec;
• give staff access only to what their work needs;
• keep a register of confidentiality incidents and notify as the law requires;
• keep this policy current with what pblc actually does.

To ask a question or make a complaint about how we handle personal information, write to hello@propelhaus.com. We acknowledge it, look into it and answer within 30 days. You can also contact the authorities listed in section 11 at any time.

17. Changes to this policy

We update this policy when pblc changes. We publish the new version here with its date and, before an important change takes effect, we tell you in the app or by email. If a change would use your information for a new purpose that needs your consent, we ask for it first.

18. Contact

• Privacy requests and questions: hello@propelhaus.com
• Support: support@propelhaus.com
• Mail: Studio PropelHaus Inc., attention: Person in charge of the protection of personal information, 920-650 rue Wellington, Montréal (Québec) H3C 1T3, Canada
• Telephone: +1 514 668 6688