Try it for your company
Privacy

Privacy policy

Effective · Last updated

Who we are

The pragmon.ai marketing website is operated by Pragmon AI, which is the data controller for personal data processed through this site. Postal address: 1111B S Governors Ave, Ste 39989, Dover, DE 19904, United States. References to "we," "us," or "our" mean Pragmon AI.

Scope of this policy

This policy covers the Pragmon AI marketing website at pragmon.ai — the public site you are reading right now. The Pragmon AI product platform (the authenticated application behind the login) is governed by a separate product privacy notice delivered inside the application and in the Master Services Agreement for that product. If you are a product customer looking for the platform privacy terms, request them from your account contact or at contact@pragmon.ai.

On the marketing website we only process personal data that you provide directly via a contact, demo, careers, or related form, plus consent-gated analytics and cookies as documented below.

What we collect and why

We collect two categories of personal data from marketing-site visitors, each with a specific purpose and legal basis:

1. Form submissions

When you submit a contact, demo, careers, or newsletter form, we collect the fields you provide (typically name, work email, company, and message), the submission timestamp, and the attribution context (page, referral source, UTM parameters) for that submission.

Purpose: responding to your enquiry, evaluating a potential commercial relationship, and for careers submissions, assessing your application. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering a contract) for demo and contact enquiries; Art. 6(1)(f) GDPR (legitimate interest in operating a B2B business and recruiting) for general contact and careers, balanced against your reasonable expectations when submitting a B2B form; and Art. 6(1)(a) GDPR (consent) for the newsletter.

2. Analytics, session replay, and reverse-IP identification

If you accept analytics cookies, we collect page views, navigation paths, session duration, device and country (aggregate), and session replay data. If you accept marketing cookies, we additionally enable reverse-IP company identification via Apollo, which associates your IP address with a likely employer to help us understand which companies are exploring the site.

Purpose: understanding how visitors use the site so we can improve it; for reverse-IP, identifying prospective business customers. Legal basis: Art. 6(1)(a) GDPR and Art. 5(3) of the ePrivacy Directive (2002/58/EC) — your explicit consent via the cookie banner. We do not rely on legitimate interest for analytics or marketing tracking.

We do not collect personal data from marketing-site visitors via any other channel. We do not build visitor profiles independently of the tools documented below.

Cookies and consent

The full cookie inventory — names, providers, purposes, and durations — is on our Cookie policy page. This section summarises the consent model.

Consent-first architecture. No cookie or request from Google Analytics, PostHog, Apollo or Calendly happens until you choose. Google Consent Mode v2 starts in the denied state for all four signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) through a short inline script that contacts no server. The Google Analytics script (gtag.js) is loaded only after you accept Analytics. PostHog follows the same gate. If your browser sends the Global Privacy Control signal, Marketing stays off unless you switch it on yourself.

No signal before consent. Until you accept Analytics, no request goes to Google and no cookieless ping is sent.

Proof of consent. We record each cookie choice you make (a random identifier, the time, the banner version, the categories accepted and refused, and your browser and device type, with no IP address) so that we can demonstrate compliance with Art. 7(1) GDPR if asked. Records are kept in a private store for 18 months, which is the six-month life of your choice plus 12 months.

Withdrawing consent. You can withdraw your consent at any time by clicking "Cookie settings" in the footer of any page. Withdrawal takes effect immediately: cookies for the withdrawn category are cleared from your device and no further data is sent. Withdrawal does not affect processing that already occurred while consent was in effect. You can also block Google Analytics entirely through your browser settings or the official Google Analytics opt-out browser add-on.

Recipients and sub-processors

This section lists the third-party service providers ("sub-processors") Pragmon AI engages to operate the pragmon.ai marketing website. It is maintained as an operational reference for data subjects, procurement teams running vendor diligence, and regulators. It supports our disclosure obligations under GDPR Art. 28(2) and Quebec Law 25 §17.

Each sub-processor below operates under a signed Data Processing Agreement (DPA) that limits processing to the documented purpose and requires equivalent security and privacy safeguards. Links to each sub-processor's public DPA are provided where available.

Our commitment to transparency

We give at least 30 days' advance notice before adding a new sub-processor that will process personal data you have shared with us via a form submission. Notice is sent to the email address you used when submitting the form. If you object to a new sub-processor, you may withdraw the personal data you shared with us by contacting our Privacy Officer at contact@pragmon.ai.

We review this list at least once a year, and whenever our stack materially changes. The Last updated date at the top of this page reflects the most recent review.

Core infrastructure

Sub-processor: Vercel Inc.

Purpose: hosting for pragmon.ai, edge runtime, request logs, Speed Insights (Core Web Vitals telemetry), Vercel Blob (hosting for blog hero images).

Data categories: request metadata (URL, user agent, country-level IP), Web Vitals beacons (page load time, device type), blob content (currently blog hero images only).

Location: United States (global edge network).

Adequacy basis: EU-US Data Privacy Framework (Vercel is DPF-certified), with Standard Contractual Clauses as fallback. Verify current DPF certification at dataprivacyframework.gov.

DPA: vercel.com/legal/dpa

Sub-processor: Cloudflare, Inc.

Purpose: DNS resolution for the pragmon.ai domain.

Data categories: DNS query metadata only. Cloudflare does not see request bodies because pragmon.ai does not use Cloudflare as a proxy, WAF, or CDN.

Location: United States (global anycast).

Adequacy basis: EU-US Data Privacy Framework (Cloudflare is DPF-certified), with SCCs as fallback.

DPA: cloudflare.com/cloudflare-customer-dpa

Analytics (consent-gated)

The following analytics sub-processors process data only after you grant explicit consent via the cookie banner on your first visit. See our Cookie Policy for the consent categories and withdrawal procedure.

Sub-processor: Google LLC / Google Ireland Limited

Purpose: Google Analytics 4 — aggregated site analytics for acquisition sources, pageviews, and Core Web Vitals field data.

Data categories: consent-gated event data, IP anonymised at the Google server, no cross-site tracking. Event retention set to 2 months (the GA4 minimum) per our Cookie Policy.

Location: United States and Ireland.

Adequacy basis: EU-US Data Privacy Framework (Google LLC is DPF-certified), with SCCs as fallback.

DPA: accepted in the GA4 Admin console per Google's Data Processing Terms.

Sub-processor: Ahrefs Pte. Ltd.

Purpose: Ahrefs Web Analytics — aggregate traffic measurement (pageviews, referrers, country-level geography) to inform SEO and content decisions.

Data categories: consent-gated. URL, referrer, user agent, anonymised/truncated IP used only to derive country. No cookies, no localStorage, no browser fingerprinting, no persistent cross-session identifier.

Location: Singapore (Ahrefs Pte. Ltd. is headquartered in Singapore).

Adequacy basis: Standard Contractual Clauses for transfers outside the EEA, UK, and Quebec. Singapore's PDPA provides a comparable protection baseline.

DPA: ahrefs.com/dpa

Opt-out: refuse or withdraw the Analytics category in Cookie settings.

CRM and communications

Sub-processor: Apollo.io, Inc.

Purpose (dual role):

  1. CRM (form submissions): stores the canonical record of contact, demo, careers, and other form submissions you send through pragmon.ai. No consent banner needed because the data is provided by you directly.
  2. Website visitor identification (marketing consent only): Apollo's website tracker identifies your company (not you personally) via reverse-IP lookup if you accept the "marketing" consent category. Feeds internal sales prioritisation; we do not use this data for unsolicited individual outreach.

Data categories (CRM): contact name, email address, company name, form message content, first-touch attribution metadata.

Data categories (tracker): IP address (used for reverse lookup then discarded), company name derived from IP, page path, user agent. No individual identifiers.

Location: United States.

Adequacy basis: Standard Contractual Clauses, with EU-US DPF where Apollo is certified (verify at dataprivacyframework.gov).

DPA: Apollo's standard DPA is available on request via their sales team.

Withdrawal (tracker only): Apollo does not provide a way to fully unload its tracker script once loaded. If you revoke marketing consent mid-session, our banner clears Apollo cookies immediately, but the already-loaded tracker script keeps running in memory until you reload the page.

Sub-processor: Resend, Inc.

Purpose: transactional email. When you submit a form, Resend delivers a notification email to the Pragmon AI cofounders so we can respond.

Data categories: contact email address, notification email body (which reflects the form you submitted).

Location: European Union (Frankfurt region selected at sign-up).

Adequacy basis: data is processed and stored in the European Union. No cross-border transfer.

DPA: resend.com/legal/dpa

Booking (consent-gated, separate category)

Sub-processor: Calendly LLC

Purpose: books first calls with a founder. On the start page the Calendly calendar is embedded only after you grant the "booking" consent category; without it, a plain link opens the calendar on Calendly.

Data categories: a prospect's name, email and booking answers; cookies set by the embedded widget, only after consent.

Location: [region]Confirm: Thomas

Adequacy basis: [transfer mechanism and DPA reference]Confirm: Thomas

Product analytics (consent-gated, separate category)

Sub-processor: PostHog, Inc.

Purpose: product analytics and session replay for user experience diagnostics. We use PostHog to understand navigation patterns, identify UX friction, and debug specific user issues.

Data categories: consent-gated event data, super-properties (attribution metadata), and — only if you grant the separate "session recording" consent — anonymised session recordings. All form inputs are masked by default.

Location: European Union (PostHog EU Cloud — AWS eu-central-1, Frankfurt). Event data and recordings stay in the EU.

Adequacy basis (event data): processed and stored in the European Union. No cross-border transfer for event data or recordings.

Residual US touches: PostHog Inc. is a Delaware corporation. While event data and recordings stay in Frankfurt, billing and support metadata transit US systems under Standard Contractual Clauses. Compliant under post-Schrems II SCC rules. Disclosed here rather than claiming "zero US transfer" because accurate disclosure matters.

DPA: posthog.com/dpa

How we categorise processing

We group our sub-processors into four functional categories that reflect how they relate to your interactions with pragmon.ai:

  • Core infrastructure — required for the site to function (Vercel, Cloudflare). Technical metadata only.
  • Analytics (consent-gated) — processed only after you accept the analytics consent category (Google Analytics 4, Ahrefs Web Analytics).
  • CRM and communications — processes data you proactively submit via forms (Apollo CRM, Resend).
  • Booking (separate consent) — the embedded booking calendar loads only after you grant the booking consent category (Calendly).
  • Product analytics (separate consent) — processed only after you grant the session-recording consent category (PostHog).

Each category has a distinct legal basis and retention policy, described in our Privacy Policy.

Your rights and contact

If you have questions about any sub-processor on this list, want to request access to or deletion of your personal data, or believe we have processed your data outside the documented purposes, contact our Privacy Officer at contact@pragmon.ai. Full rights detail is in the Privacy Policy.

You also have the right to lodge a complaint with your supervisory authority. For EU data subjects, the list of national DPAs is at edpb.europa.eu/about-edpb/about-edpb/members_en. For Quebec: Commission d'accès à l'information du Québec. For the UK: Information Commissioner's Office.

How long we keep data

  • Form submissions (name, email, company, message): retained in Apollo as CRM records for as long as the contact is commercially relevant, reviewed annually. Email-delivery logs in Resend: 30 days.
  • Google Analytics event data: 2 months server-side (default retention). GA cookies on your device: up to 2 years.
  • PostHog session replays: 30 days.
  • Consent logs: lifetime of the consent plus 12 months (required to demonstrate compliance).
  • Server logs (Vercel): 30 days, retained for security and abuse investigation.

You can request earlier deletion at any time — see Your rights.

International transfers

Most of our sub-processors are US-based. Personal data you submit may therefore be transferred outside the EEA, the UK, and Quebec.

Transfer mechanisms. Transfers to Google LLC and other US-based recipients rely on the European Commission's adequacy decision of 10 July 2023 under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795). Google LLC is self-certified under the DPF; you can verify active certification at dataprivacyframework.gov. In the event the DPF is suspended or invalidated, transfers continue under the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) with supplementary technical and organisational measures. PostHog EU Cloud data stays in the EU and does not require a transfer mechanism.

Quebec Law 25 cross-border transfer notice. Quebec Law 25 §17 requires a Privacy Impact Assessment for every transfer of personal information outside Quebec. We maintain a PIA covering every sub-processor in our stack. Summary: we transfer personal information you provide on the marketing site to US-based sub-processors (Vercel, Google LLC, Apollo.io, Resend, Cloudflare) under the EU-US DPF adequacy decision and SCCs, to Singapore-based Ahrefs Pte. Ltd. (consent-gated cookieless analytics, no personal identifiers) under SCCs, and to EU-based sub-processors (PostHog EU Cloud) where no transfer mechanism is required. Each transfer has a signed Data Processing Agreement, data-minimisation safeguards, and a documented retention period. We assess residual risk as acceptable for the non-sensitive contact data we process, and our Privacy Officer reviews this assessment annually. The full PIA is available on request.

Quebec data subjects have the right to object to cross-border transfer of their personal data. To object, contact contact@pragmon.ai. Upon a valid objection, we will stop processing your data in the objected-to sub-processor (typically resulting in deletion of your contact record) and confirm in writing within 30 days.

Security of your data

In accordance with Art. 32 GDPR and Quebec Law 25 §10, we maintain technical and organisational measures appropriate to the risk of the processing:

  • Encryption in transit (TLS 1.2+) for every page and every form submission.
  • Encryption at rest for data stored with our sub-processors (Vercel, Apollo, Resend, PostHog, Google all encrypt at rest by default).
  • Principle-of-least-privilege access controls: only employees with a documented need can access CRM records, and all access is logged.
  • Sub-processor vetting: each sub-processor is reviewed for SOC 2 Type II, ISO 27001, or equivalent certification before onboarding.
  • Annual review of access, retention, and vendor security posture by the Privacy Officer.

No security control is perfect. If you believe you have discovered a vulnerability, please report it to contact@pragmon.ai; we commit to acknowledge within 2 business days and will not pursue legal action against good-faith researchers.

Data breach notifications

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify:

  • Supervisory authorities within 72 hours of becoming aware, per Art. 33 GDPR and the equivalent timing requirements in UK GDPR and Quebec Law 25 §3.5.
  • Affected data subjects without undue delay where the breach is likely to result in a high risk to your rights and freedoms, per Art. 34 GDPR.

Notifications will describe the nature of the breach, the categories and approximate number of records involved, likely consequences, and the measures taken or proposed to address it.

Automated decisions and profiling

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing on this marketing website, within the meaning of Art. 22 GDPR. Analytics segmentation and reverse-IP company identification are used in aggregate to understand site traffic and prospect interest; they do not determine pricing, access, or any outcome that materially affects you. The Pragmon AI product platform has its own automated-processing disclosure in its product privacy notice.

Children's data

Pragmon AI is a B2B service aimed at enterprise decision-makers. The marketing site is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has submitted personal data to us, please email contact@pragmon.ai and we will delete it promptly.

Do Not Sell or Share (California)

We do not sell personal information for money, and we do not share personal information for cross-context behavioural advertising as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA). We do not operate retargeting pixels on this site. Consent-gated analytics and reverse-IP company identification are used for our own product and commercial purposes only, not to resell or syndicate data to third parties.

California residents may still exercise the rights listed below, including the right to limit the use of sensitive personal information (we do not process sensitive personal information on the marketing site) and the right to opt out of future changes should our practices ever change.

Your rights

Under GDPR, UK GDPR, Quebec Law 25, and CPRA, you have the right to:

  • Access: receive a copy of the personal data we hold about you.
  • Rectification: correct any inaccurate data.
  • Erasure: request deletion of your personal data (the "right to be forgotten").
  • Portability: receive your data in a structured, machine-readable format.
  • Restriction: pause processing while we investigate a concern.
  • Objection: object to specific processing activities, including cross-border transfers and processing based on legitimate interest.
  • Withdraw consent: at any time via the Cookie settings link in the footer; withdrawal does not affect processing that already occurred.
  • Non-discrimination: California residents will not receive different service for exercising these rights.

To exercise any of these rights, email the Privacy Officer at contact@pragmon.ai. We acknowledge every request within 5 business days and respond substantively within the statutory deadline — 30 days under GDPR and UK GDPR (extendable by 2 months for complex requests), 30 days under Quebec Law 25, and 45 days under CPRA (extendable by 45 days). We may need to verify your identity before acting on a request; we will only use the information you provide to verify the request and will delete it afterwards.

How to complain

If you believe we have processed your personal data incorrectly, you have the right to complain. The fastest path is to email our Privacy Officer at contact@pragmon.ai. We aim to resolve every complaint within 30 days or provide a written explanation and expected resolution date if more time is required.

You may also complain directly to your supervisory authority:

Changes to this policy

We may update this policy from time to time to reflect changes in our practices, new sub-processors, or new legal requirements. The "Last updated" date at the top of this page reflects the most recent change. For material changes, we will take reasonable steps to notify affected contacts directly — for example, by email to active CRM contacts, or via a prominent notice on the site. Continued use of the site after an update constitutes acceptance of the updated policy to the extent permitted by law.

Prior versions of this policy are available on request from the Privacy Officer.

Privacy Officer and contact

Pragmon AI has designated a Privacy Officer under Quebec Law 25 §3.1 (the "Person in Charge of Personal Information"). For privacy-related questions, data subject requests, complaints, security reports, and vulnerability disclosures, contact the Privacy Officer at contact@pragmon.ai. The shared inbox is monitored by the cofounder team.

Postal address: Pragmon AI, 1111B S Governors Ave, Ste 39989, Dover, DE 19904, United States.