Privacy Policy

1. Who We Are

PriApps LLC ("PriApps," "we," "our," or "us") is a Texas limited liability company operating the PrintGuru platform, available at app.printguru.ai and printguru.ai (collectively, the "Service"). We are the data controller for data collected through the Service, except where we process data as a data processor on behalf of our Customers (organizations that deploy PrintGuru to their users).

Our principal place of business is in Austin, Texas, USA.

2. Scope of This Policy

This Privacy Policy applies to:

• IT administrators and workspace administrators who create and manage PrintGuru accounts ("IT Admins");
• End users who access PrintGuru through an organization's workspace ("End Users"); and
• Visitors to printguru.ai (marketing website).

This Policy does not cover third-party websites or services linked from the Service. If you are an End User, your organization (the Customer) is the data controller for your workspace data, and this Policy describes how PriApps processes that data as a data processor on the Customer's behalf.

3. Data We Collect

3.1 Account and Identity Data

When an IT Admin registers or authenticates, we collect:

• Name and work email address (from Google or Microsoft OAuth);
• Organization name and verified domain;
• Account role (IT admin or end user);
• Authentication tokens (stored securely; not accessible to other users).

3.2 Workspace Configuration Data

Data that IT Admins enter to configure their workspace, including:

• Workspace name, domain, and settings;
• Workspace Knowledge Base content (uploaded documents and indexed URLs);
• Subscription and billing information (processed by Stripe; PriApps does not store raw payment card data);
• Member lists and access control configurations.

3.3 Conversation Data

When users interact with the PrintGuru AI Companion, we collect and process:

• Query content — the text submitted by the user describing their print issue;
• AI Responses — the content generated by the PrintGuru AI;
• Conversation session identifiers (pseudonymized — see Section 3.5);
• Timestamps and session metadata.

3.4 Device and Context Data

To help the AI provide relevant, contextual answers, users may optionally provide:

• Printer model, manufacturer, and error codes;
• Operating system type (e.g., Windows, macOS);
• General description of the print or scan environment.

This context is provided voluntarily by the user within the query. We do not automatically collect device fingerprints, installed software lists, or network topology data.

3.5 Pseudonymization by Design

Conversation data is associated with a pseudonymous session token rather than a directly identifiable user account. End users are not registered Supabase Auth users; their identity within the platform is managed via a workspace-scoped session token that does not contain personally identifiable information. IT Admins can view conversation analytics aggregated at the workspace level but cannot directly link individual conversations to specific named end users without additional steps outside the platform.

3.6 Usage and Analytics Data

We collect aggregated usage data including:

• Query volume, resolution rates, and escalation events per workspace;
• Feature usage patterns (e.g., knowledge base uploads, settings changes);
• Error logs and performance metrics for platform stability.

3.7 Marketing Website Data

Visitors to printguru.ai may provide name, email, company, and other details via the contact and demo request form. We use this data solely to respond to the inquiry and, with consent, to send relevant product communications.

4. How We Use Your Data

Purpose	Data Used
Providing and operating the Service (account management, authentication, workspace configuration)	Account data, workspace data
Generating AI Responses to user queries (retrieval-augmented inference via PriApps AI)	Query content, device context, Knowledge Base content
Displaying analytics to IT Admins (query volume, resolution rates, top issues)	Aggregated, pseudonymized conversation data
Processing subscription payments and managing billing	Email, plan data (payment card data processed by Stripe)
Sending transactional emails (account confirmations, usage alerts, billing notices)	Email address
Security monitoring, fraud prevention, and abuse detection	Account data, usage logs, security events
Improving the Service (aggregate model performance analysis, not individual conversation review)	Aggregated, anonymized usage and conversation statistics
Responding to support and demo inquiries	Contact form data
Complying with legal obligations	As required by applicable law

We do not use conversation content to train AI models without your explicit consent. Aggregate statistics derived from pseudonymized conversation data (e.g., most common issue categories) may be used to improve the PrintGuru Global Knowledge Base and response quality.

5. Legal Basis for Processing (GDPR)

For individuals in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data on the following legal bases under the General Data Protection Regulation (GDPR) and applicable national laws:

• Contract performance (Article 6(1)(b)): Processing necessary to provide the Service under our Terms of Service — account registration, authentication, query processing, billing.
• Legitimate interests (Article 6(1)(f)): Security monitoring, fraud prevention, service improvement using aggregated and anonymized data, and direct marketing to existing Customers. Our Legitimate Interests Assessment (LIA) is available on request.
• Legal obligation (Article 6(1)(c)): Processing required to comply with applicable law, including tax and financial record-keeping obligations.
• Consent (Article 6(1)(a)): Marketing communications to prospective customers and non-essential cookies (where applicable). You may withdraw consent at any time.

6. Data Sharing

We do not sell your personal data. We do not share personal data with third parties for their own marketing purposes.

We share data in the following limited circumstances:

• Within your organization: IT Admins in your workspace can access aggregated analytics and, where the Customer's configuration permits, conversation logs associated with their workspace.
• Service providers (data processors): We share data with trusted third-party processors who help us operate the Service. See Section 7.
• AI inference providers: Query content and Knowledge Base context is transmitted to AI providers (OpenAI and/or Anthropic) to generate responses. These providers process data under data processing agreements and do not use your data to train their models.
• Legal compliance: We may disclose data if required by law, court order, or lawful government request, or to protect the rights, property, or safety of PriApps, our Customers, or others.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of our business, data may be transferred to the successor entity. We will notify you before such a transfer takes effect.

7. Third-Party Data Processors

We use the following categories of sub-processors to operate the Service:

Processor	Purpose	Location
Supabase	Database hosting, authentication infrastructure, vector storage (pgvector)	USA (AWS us-east-1)
Vercel	Application hosting and edge delivery	USA / Global CDN
OpenAI	AI language model inference (query responses)	USA
Anthropic	AI language model inference (Enterprise / BYO key workspaces)	USA
Stripe	Payment processing and subscription billing	USA / EU
Resend	Transactional email delivery	USA
Microsoft Azure	Microsoft identity provider integration (OAuth, Graph API for domain verification)	USA / Global
Google	Google identity provider integration (OAuth); Google Drive KB sync (where enabled)	USA / Global

All processors are contractually bound to process data only as instructed by PriApps and to maintain appropriate security standards. A current list of sub-processors is available on request at privacy@printguru.ai.

8. International Data Transfers

PriApps LLC is based in the United States. Our processors are primarily located in the USA. If you are located in the EEA, UK, or Switzerland, your personal data will be transferred to and processed in the USA.

We rely on the following transfer mechanisms where applicable:

• Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our data processing agreements with processors;
• Adequacy decisions for countries where applicable; and
• The UK International Data Transfer Agreement (IDTA) for transfers from the UK.

9. Data Retention

We retain data for as long as necessary to provide the Service and fulfill the purposes described in this Policy, subject to the following:

Data Category	Retention Period
Account and workspace configuration data	Duration of active subscription + 90 days after termination
Conversation data (queries and AI responses)	As configured by the Customer's Retention Policy (default: 90 days); minimum 1 day, maximum 365 days
Workspace Knowledge Base documents	Until deleted by IT Admin, or upon workspace termination + 30 days
Billing and transaction records	7 years (legal and tax compliance)
Security event logs	12 months
Marketing contact form submissions	Until you withdraw consent or request deletion

Upon subscription termination, workspace data is soft-deleted immediately and permanently purged within 90 days. Customers may request expedited deletion by contacting privacy@printguru.ai.

10. Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption in transit (TLS 1.2+) and at rest (AES-256) for all stored data;
• Row-level security (RLS) enforced at the database layer, ensuring strict workspace isolation;
• Pseudonymization of end-user conversation data by design;
• Authentication using industry-standard OAuth 2.0 with PKCE for IT Admin accounts;
• Rate limiting and abuse detection on all public-facing endpoints;
• File type validation and magic byte checking for uploaded Knowledge Base documents;
• Regular security reviews and access control audits.

No security measure is 100% effective. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected parties and relevant authorities as required by applicable law (within 72 hours for GDPR-covered breaches where feasible).

11. Your Rights Under GDPR

If you are located in the EEA, UK, or Switzerland, you have the following rights under the GDPR (and equivalent UK/Swiss law) regarding your personal data:

• Right of access (Article 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Article 16): You may request correction of inaccurate or incomplete data.
• Right to erasure (Article 17): You may request deletion of your data where there is no overriding legal basis for retention ("right to be forgotten").
• Right to restriction of processing (Article 18): You may request that we restrict processing in certain circumstances.
• Right to data portability (Article 20): Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
• Right to object (Article 21): You may object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise these rights, contact us at privacy@printguru.ai. We will respond within 30 days. We may need to verify your identity before fulfilling a request. If you are an End User, some requests may need to be directed to your organization (the Customer) as data controller.

You also have the right to lodge a complaint with your local data protection authority. For EEA residents, this is the supervisory authority in your EU member state. For UK residents, this is the Information Commissioner's Office (ICO).

12. Your Rights Under CCPA / CPRA

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know: You may request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collection, and the categories of third parties with whom we share it.
• Right to delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to correct: You may request correction of inaccurate personal information.
• Right to opt out of sale or sharing: We do not sell or share personal information for cross-context behavioral advertising purposes. No opt-out is required, but you may contact us to confirm.
• Right to limit use of sensitive personal information: We do not use or disclose sensitive personal information beyond what is necessary to provide the Service.
• Right to non-discrimination: We will not discriminate against you for exercising any of these rights.

To exercise these rights, contact us at privacy@printguru.ai or write to PriApps LLC, PO Box 1206, Austin, Texas 78716, USA. We will respond within 45 days (extendable by an additional 45 days with notice). We will verify your identity before processing your request.

13. Children's Privacy

The Service is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact privacy@printguru.ai and we will promptly delete it.

Organizations deploying PrintGuru in K–12 educational settings are responsible for ensuring appropriate consent and compliance with applicable laws such as COPPA (Children's Online Privacy Protection Act) and FERPA (Family Educational Rights and Privacy Act) within their own jurisdiction. End users in K–12 environments access the Service through their organization's workspace and do not create individual accounts.

14. Cookies and Tracking

The PrintGuru application at app.printguru.ai uses the following types of storage:

• Strictly necessary: A session access token stored in localStorage for IT Admin authentication. This is required for the Service to function and cannot be disabled.
• Functional: User interface preferences (e.g., sidebar state) stored in localStorage.

We do not currently use advertising, analytics, or tracking cookies in the application. The marketing website (printguru.ai) may use standard web analytics tools. We will update this Policy if that changes.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify IT Admins by email (to the address associated with their account) and/or by posting a prominent notice within the Service at least 14 days before the changes take effect. The "last updated" date at the top of this page will reflect the most recent revision.

Your continued use of the Service after the effective date of the revised Policy constitutes your acceptance of the changes. If you do not agree, you must stop using the Service.

16. Contact Us and Complaints

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

Privacy Inquiries — PriApps LLC
Email: privacy@printguru.ai
General support: legal@printguru.ai
Address: PriApps LLC, PO Box 1206, Austin, Texas 78716, USA
Website: printguru.ai

We aim to respond to all privacy inquiries within 10 business days.

If you are located in the EEA or UK and are not satisfied with our response to your complaint, you have the right to lodge a complaint with your local data protection supervisory authority.