1. Who we are
Pragmon AI Ltd is a private limited company registered in England and Wales under company number 17549923, with its registered office at 71-75 Shelton Street, London WC2H 9JQ. "We", "us" and "our" mean Pragmon AI Ltd.
This policy covers two things: the website at pragmon.ai, and the Pragmon AI platform (including Ask Pragmon AI) at app.pragmon.ai and review.pragmon.ai. It explains what personal data we collect, why, who we share it with, how long we keep it and what rights you have under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and, where it applies to you, the EU General Data Protection Regulation (EU GDPR).
Questions and requests go to contact@pragmon.ai.
2. Our two roles
We are the controller for personal data about:
- visitors to pragmon.ai;
- prospects and anyone who contacts us, books a call or signs up for our emails;
- people who use the platform, for their account data: name, work email, company, role, sign-in records, settings and how they use the platform.
We are a processor for the content our clients put into the platform or ask us to produce: files they upload, data from their systems, figures and answers they enter, their questions to Ask Pragmon AI, and the reports, briefs and decks we produce for them. Our client is the controller of that content. We handle it only on the client's instructions, under the Data Processing Agreement at pragmon.ai/legal/dpa. If you want to exercise your rights over content a client holds on the platform, contact that client. We will help them answer you.
3. What we collect on the website, and why
Forms. When you use our contact, start, founding partners or similar forms, we collect what you enter. That is usually your name, work email, company and message, and on some forms your role, LinkedIn profile, sector and annual revenue range. We also record when you sent it and how you found us (the referring site and campaign tags). We use this to reply, to arrange a call and to decide whether we can work together. Legal basis: taking steps at your request before a contract, and our legitimate interest in running and growing a business-to-business company.
Email sign-ups. If you sign up for Insights or for early access, we keep your email address (and first name if given) to send those emails. Legal basis: your consent. Every email has an unsubscribe link.
Booking a call. If you book through our Calendly calendar, Calendly collects your name, email and answers to its booking questions and shares them with us. Legal basis: steps at your request before a contract.
Analytics. Only if you accept analytics cookies, Google Analytics and Ahrefs Web Analytics measure which pages are read, where visitors come from, and which country and device they use. Legal basis: your consent. The Cookie Policy lists every cookie.
Cookieless measurement and site operation. Vercel Web Analytics and Vercel Speed Insights count page views and page speed without cookies or identifiers. Our host keeps short-lived server logs, and Sentry records technical errors with personal data removed. Legal basis: our legitimate interest in keeping the site working and secure.
Your cookie choice. We keep a record of each cookie choice: a random identifier, the time, the banner version, what you accepted and refused, and your browser, operating system and device type. It holds no IP address, name or email. We keep it to show we asked properly. Legal basis: our legal obligation to be able to prove consent.
4. What we collect on the platform, and why
As controller, we collect account details (name, work email, company, role, password stored in hashed form), sign-in and security records (time, IP address, browser), settings and notification choices, and records of how the platform is used. We use them to give you access, keep accounts secure, support you, bill our client and improve the service. Legal basis: performing our contract with your employer, and our legitimate interest in running a secure service. Product analytics on the platform run only after you accept them in the platform's own banner. Legal basis: your consent.
As processor, we handle client content as section 2 describes. We use AI models to produce reports and answers from it. We do not train AI models on client content. Our AI providers process it under their own commercial terms.
5. Automated decisions
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Ask Pragmon AI produces analysis and recommendations; people at our client decide what to do with them.
6. Who we share data with
We share personal data only with suppliers who need it to run the site or the platform, under written contracts that limit their use of it:
| Supplier | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the site and platform front end; storage of form submissions and cookie-choice records; cookieless analytics | United States and global network |
| Cloudflare, Inc. | Domain name service | United States and global network |
| Resend, Inc. | Sending emails; holding email sign-up lists | European Union (Ireland) |
| Apollo.io, Inc. | Customer relationship records for prospects | United States |
| Google (Google Ireland Ltd / Google LLC) | Google Analytics, after consent | Ireland and United States |
| Ahrefs Pte. Ltd. | Ahrefs Web Analytics, after consent | Singapore |
| Calendly LLC | Booking calls | United States |
| Functional Software, Inc. (Sentry) | Error monitoring | United States |
| Railway Corporation | Platform database, file storage and servers | Railway data centres, which may be outside the UK and the EU |
| Upstash, Inc. | Platform session and task cache | United States |
| Anthropic, OpenAI and Perplexity | AI models that produce platform reports and answers | United States |
| Firecrawl and NewsAPI.ai | Public web and news research for the platform; no client content intended | United States and other countries |
| PostHog, Inc. | Platform product analytics, after consent | European Union |
| Better Stack | Platform logs and uptime alerts | European Union |
| Slack Technologies | Internal operational alerts | United States |
The full list of platform sub-processors, which our clients rely on, is at pragmon.ai/legal/subprocessors. We may also share data with professional advisers, with a buyer of our business, or where the law requires it. We do not sell personal data, and we do not use it for third-party advertising.
7. International transfers
Some suppliers process data outside the UK and the European Economic Area, mostly in the United States. Where a destination has no UK or EU adequacy decision, we rely on the UK-US data bridge or the EU-US Data Privacy Framework where the supplier is certified, or on the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses. Data sent from the EU to us in the UK relies on the EU's adequacy decision for the UK. You can ask us for a copy of the safeguards that apply.
8. How long we keep data
| Data | How long |
|---|---|
| Form submissions and prospect records | While the conversation is commercially relevant; reviewed every year |
| Email sign-ups | Until you unsubscribe |
| Cookie-choice records | 18 months |
| Google Analytics event data | 2 months; its cookies last up to 13 months |
| Website server logs | The short period our hosting provider keeps them, then deleted |
| Platform account data | While the user has access, then deleted or anonymised on request or under our client's contract |
| Platform sign-in and security records | 13 months |
| Platform error traces | 30 to 90 days |
| Platform product analytics | 12 months |
| Client content | As set by our client's contract and the DPA |
We may keep data longer where the law requires it or to deal with a legal claim.
9. Security
We encrypt data in transit with TLS 1.2 or higher. Access to personal data is limited to people who need it. We choose suppliers with recognised security standards and review them regularly. If you find a security weakness, please report it to contact@pragmon.ai.
10. Breaches
If a breach of personal data is likely to put your rights at risk, we will tell the Information Commissioner's Office within 72 hours of becoming aware of it, and any EU authority the EU GDPR requires. If the risk to you is high, we will tell you without undue delay. Where we are processor, we will tell our client so it can act.
11. Your rights
You have the right to:
- see the personal data we hold about you;
- have it corrected;
- have it deleted;
- have its use restricted;
- receive it in a portable format;
- object to our use of it where we rely on legitimate interest, and at any time to direct marketing;
- withdraw consent at any time, without affecting what happened before. For cookies, use "Cookie settings" in the site footer. For emails, use the unsubscribe link.
Email contact@pragmon.ai to use any of these rights. We reply within one month, extendable by two months for complex requests. We may need to confirm who you are first.
12. Complaints
Please contact us first at contact@pragmon.ai. You may also complain to the Information Commissioner's Office, the UK regulator (ico.org.uk, 0303 123 1113). If you are in the EU, you may complain to the data protection authority in your country.
13. Children
The site and platform are for businesses. We do not knowingly collect data from anyone under 16. If you believe a child has sent us data, email contact@pragmon.ai and we will delete it.
14. Changes
We may update this policy. The date at the top shows the latest version. We will tell platform users and active contacts about material changes by email or a notice on the site.
15. Contact
Pragmon AI Ltd, 71-75 Shelton Street, London WC2H 9JQ. Email: contact@pragmon.ai.