Profinetic

1. Who this policy covers

This Privacy Policy explains how Profinetic, LLC ("Profinetic") collects, uses and protects personal information in connection with the Profinetic online service (the "Service"). It covers three kinds of information:

information about the people who use the Service or deal with Profinetic directly, which Profinetic handles for its own purposes and is responsible for;
the business records that customers provide to the Service, which Profinetic processes only on each customer's behalf, as described in Section 4; and
the data the Service reads from the third-party services a customer connects, described in Section 5.

2. Information about people who use the Service

Account information: name, work email address, role and access level, the business the account belongs to, a hashed password, two-factor settings (whose secret is encrypted), and account status.
Sign-in and session information: for each session, the IP address, a description of the browser and device, and when it began and was last used; failed sign-in attempts, including wrong two-factor codes; wrong passwords or codes entered to confirm a change while signed in; and, for rate limiting, keyed hashes of the email address, IP address or account identifiers involved in recent attempts.
Activity records: a log of actions taken in an account, such as sign-ins, invitations, changes to access, exports and imports, and the creation of records and key changes to them, with who acted, where a person acted, and when.
Acceptance records: which version of the Terms of Service and the Data Processing Addendum a person accepted, that they were shown this Privacy Policy, in what way, and when.
Communications: messages sent to Profinetic support, and Profinetic's replies.
Business contact information: names, titles and contact details of people at customers and prospective customers, and what they tell Profinetic, to manage the business relationship.

Profinetic does not keep a record of the pages a person views, other than the recent pages included in an error report where error monitoring is turned on, and the Service uses no analytics, ad or cross-site tracking tools. Profinetic's hosting provider keeps short-lived request logs, including IP address, the address requested and browser type, to run and protect its platform.

3. How Profinetic uses that information

To provide, run and support the Service, and to sign people in.
To keep the Service secure: rate limiting, locking an account after repeated wrong passwords or two-factor codes, detecting misuse, and keeping the activity log.
To send the emails an account needs, such as invitations, password resets, email verification and security notices.
To manage its relationship with customers, including contracts and billing.
To maintain and improve the Service, using technical information internally.
To comply with law, enforce its agreements, and establish or defend legal claims.

Profinetic does not sell personal information, does not share it for targeted ads, and does not use it to make automated decisions that have legal or similarly significant effects on a person. If Profinetic sends promotional email to business contacts, every message will include a way to opt out.

4. Business records Profinetic processes for customers

Customers provide business records to the Service, or have it retrieve them from third-party services they choose. These records can include personal information about a customer's own customers and prospective customers, its personnel, and other people, such as names, phone numbers, email addresses, records of their dealings with the customer, and employment-related information. They can also include entries the customer's people make from phones and other devices, such as logs of work done and time worked, and location and usage information from vehicles and equipment the customer connects.

The Service does not ask a phone or computer for its location. Where a customer connects vehicles or equipment that report their location, Profinetic keeps the location coordinates from them in the Service for 30 days and then removes them. Copies in backups are kept as Section 10 describes.

Profinetic processes this information as the customer's service provider (processor), only to provide the Service to that customer and on its instructions, under the Data Processing Addendum. Profinetic does not sell it, does not use it for its own purposes, and does not combine one customer's records with another's. The customer is responsible for telling the people concerned about it in its own privacy notice, and for any notice or consent the law requires before their information is collected. A person whose information is in a customer's records should contact that customer to exercise their rights; if they contact Profinetic, Profinetic will pass the request on to the customer.

5. Information from connected services

A customer can connect the Service to accounts it holds with other providers. A person the customer authorizes signs in to the provider and grants access. The Service reads the names of the accounts, properties or sites that access covers, so that person can choose among them, and then reads data from the ones they choose. The Service only reads: it does not create, change or delete anything in these services. The services that can be connected today, the access each asks for, and what the Service reads, are:

Google Analytics (Google LLC), read-only access to Analytics data: daily totals of visits and key events, by channel, for the properties chosen.
Google Ads (Google LLC), the one level of access Google offers for its programming interface, which could also make changes; the Service uses it only to read campaign names, and daily totals of cost, clicks, impressions and conversions, for the ad accounts chosen.
Google Search Console (Google LLC), read-only access: daily totals of clicks and impressions, and average position, in Google Search for the sites chosen.
Meta (Meta Platforms, Inc.), read-only access to advertising accounts: campaign names, and daily totals of spend, clicks, impressions and actions, for the ad accounts chosen.
QuickBooks Online (Intuit Inc.), the accounting access Intuit offers, which could also make changes; the Service uses it only to read the accounting records of the company chosen, such as invoices, bills, payments, purchases, credit memos, vendors and purchase orders, and its profit and loss report.
CallRail (CallRail, Inc.), with an API key the customer provides: for each call to the customer's tracked numbers, the caller's phone number, the time, how long it lasted, its direction, its source and whether it was answered.

How it is used. Profinetic uses this data only to provide the customer, in its own Profinetic account, the reporting and other features of the Service it connected the service for. Profinetic does not sell it; does not use or transfer it for advertising, including retargeting and personalized or interest-based advertising; does not use it to decide anyone's creditworthiness or for lending; does not transfer it to data brokers or information resellers; and does not use it to develop, improve or train generalized AI or machine-learning models. Information derived from it can be part of what a request to the AI model provider sends for that customer (Section 6), on terms that do not allow the provider to train its models on it.

Who can see it. The data is stored in the customer's account, with the same protections as the customer's other records, and only that customer's authorized users see it. Profinetic's staff do not read it unless the customer asks them to for a specific support request, it is needed for security purposes such as investigating a bug or abuse, it is needed to comply with law, or it has been aggregated and is used only for the Service's internal operations as the law allows. Profinetic transfers it only to the subprocessors that provide the Service (Section 8), as the law requires, for security purposes, or, with the customer's prior consent, as part of a merger, acquisition or sale of Profinetic's assets.

Google's Limited Use requirements. Profinetic's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. A person with permission to manage the customer's connections can disconnect a service at any time in the Service. When they do, Profinetic deletes the stored access tokens or key for it at once and, for a service connected by signing in to it, asks the provider to revoke Profinetic's access, unless another connection in the Service may still use the same sign-in. Copies of the access tokens or key in backups are kept as Section 10 describes; if a backup is ever restored, the service is disconnected again. An API key the customer created can be deleted at that provider. Access can also be removed from the account's settings at the provider. For a Google or Meta connection, the Service also stores the identifier the provider gives the account that granted access, so that it can tell whether another connection uses the same sign-in. That identifier, and data the Service has already read, stay in the customer's account until the customer asks for them to be deleted or the customer's agreement ends.

Asking for deletion. To have the data read from a connected service deleted, including data received from Meta, anyone who uses the customer's Profinetic account, or whose account at the provider was used to connect the service, can email support@fxintelhq.com, naming the business and the service. Profinetic first confirms that the person uses the account or that their provider account was used to connect the service, for example from the email address on their Profinetic account or the connection's activity record. It then tells the customer's account Owners, deletes that data from the Service within 30 days, and replies to say when it has been done. Profinetic also deletes data received from a provider when that provider asks it to. Copies may remain in backups, as Section 10 describes; they are not used, and the data is deleted again if a backup is ever restored. When a customer's agreement ends, the data is deleted with the rest of its records, on the schedule in Section 12 of the Data Processing Addendum.

6. AI processing

Some features of the Service use a third-party AI model provider, currently Anthropic, PBC. The features that work from a customer's business records are off until one of that customer's account Owners turns them on in the Service, and an Owner can turn them off again at any time. For each request, Profinetic sends the provider only the information that request needs, which can include personal information within a customer's business records; the line that names a member of the customer's staff is left out. The provider processes it as Profinetic's subprocessor, on terms that do not allow it to train its models on it. Profinetic does not use customers' business records, or data from the services they connect, to train AI models. Separately, whether or not those features are on, Profinetic and its staff use the same provider's tools to run and support the Service, and those tools receive the information a support or maintenance task needs, as Annex 3 of the Data Processing Addendum describes.

7. How information is shared

With the customer whose account a person uses: that customer's account Owners, and the people they authorize, can see the person's account details and activity records.
With Profinetic's subprocessors, listed in Section 8, to provide the Service.
With third-party services a customer connects, as that customer directs.
Where the law requires it, or to protect the rights, property or safety of Profinetic, its customers or others.
With a buyer or successor in a merger, acquisition or sale of assets, which must keep protecting the information as this policy describes. Data from connected services is transferred this way only with the customer's prior consent.
With a person's consent.

8. Subprocessors

The current list of the companies Profinetic uses to provide the Service, what each does and where it processes information, is in Annex 3 of the Data Processing Addendum. Customers get notice before a new one is added.

9. Cookies and similar technologies

The Service uses only the cookies it needs to work. It uses no analytics, ad or cross-site tracking cookies.

Sign-in session: keeps a person signed in. Only the server can read it. It expires 12 hours after it was last renewed, and the session ends no later than 14 days after sign-in, or sooner when the person signs out or the session is ended.
Sign-in security: the sign-in system may set cookies that protect sign-in from cross-site request forgery and remember where to return after signing in. These last until the browser is closed.
Third-party authorization: one cookie that protects the handshake when an authorized user links a third-party service to an account. It expires after 10 minutes.
Appearance: a person's choice of light or dark appearance, kept in the browser's local storage and never sent to Profinetic.
Entries waiting to be sent: when a person records work on a phone or other device that has no connection, the entry waits in that browser's storage until it can be sent, and is removed once it is sent. An entry not sent within seven days is deleted the next time the person who recorded it opens the page that sends it, for the same business, on that device. Signing out does not remove waiting entries, so a device that several people share should be kept secure.
Notices: which notices a person has dismissed, kept in the browser's local storage.

Because Profinetic does not sell or share personal information, or use it for targeted ads, browser signals such as Global Privacy Control do not change how it handles information. Where the law requires, Profinetic treats such a signal as a request to opt out.

10. How long information is kept

Account, session and activity information is kept while the customer's account is active. Deactivating a person keeps their history, so past activity stays attributable. After a customer's agreement ends, this information is deleted with the customer's other data on the schedule in Section 12 of the Data Processing Addendum.
Data from connected services is kept as Section 5 describes, and location coordinates from connected vehicles and equipment as Section 4 describes.
Rate-limiting entries are kept for up to a day.
Entries waiting on a device to be sent are kept there until they are sent; one not sent within seven days is deleted the next time the person who recorded it opens the page that sends it, for the same business, on that device.
Acceptance records, contracts and billing records are kept as long as needed for legal, tax and accounting obligations and to establish or defend legal claims.
Support communications are kept as long as needed to answer them and keep a record.
Backups: the database provider's automatic backups expire within 35 days. Snapshots taken before maintenance have no set end date and are kept until Profinetic removes them. Data in a backup is not used except to recover the Service or lost data. If a backup is ever restored, Profinetic deletes again the data it had deleted at a person's, a customer's or a provider's request, when a service was disconnected, or when a customer's agreement ended.
A record of each deletion Profinetic carries out is kept outside the database, for as long as any backup it applies to is kept, so that the deletion can be applied again after a restore. It holds when the deletion was made and by whom, identifiers, counts and, where an email address was erased, a hash of that address, but not the deleted information itself. Someone who already has that email address could match it to the hash, so the record is not anonymous.

11. Security

Profinetic protects information with the measures described in Annex 2 of the Data Processing Addendum, including hashed passwords, encryption of stored credentials, two-factor sign-in available to every user, and access checks on the server. No system is perfectly secure, and Profinetic cannot promise that information will never be accessed without authorization. Profinetic notifies customers of security incidents as the Data Processing Addendum describes, and individuals as the law requires.

12. Your choices and rights

In the Service, a person can update their name and email address, change their password, turn two-factor sign-in on or off, and review and end their sessions.
Depending on where they live, a person may ask Profinetic to tell them what personal information it holds about them, give them a copy, correct it or delete it, by writing to the address in Section 17. Profinetic will verify the request, for example by asking the person to confirm it from the email address on their account. An authorized agent may make a request with the person's written permission.
Profinetic answers within 45 days, and may extend that once by another 45 days, with notice, where the law allows. If Profinetic declines a request, the person may appeal by replying within 45 days, and Profinetic will answer the appeal within 45 days. If the appeal is denied, the person may contact their state attorney general.
Because a customer controls its account, including its users' accounts, Profinetic may refer a request about information in that account to the customer, or act on the customer's instructions.
Profinetic will not discriminate against anyone for exercising these rights.

13. Notice for California residents

In the past 12 months, Profinetic has collected these categories of personal information about people who use the Service and business contacts, from those people, from the customer they work for, and from their browsers:

identifiers, such as name, email address, IP address and account identifiers;
the personal information described in Cal. Civ. Code § 1798.80, such as name and contact details;
internet or other electronic network activity, such as session, sign-in and activity records;
professional or employment-related information, such as employer, title and role; and
sensitive personal information: account sign-in credentials, used only to sign people in and keep accounts secure, and never to infer anything about a person.

Profinetic uses these for the purposes in Section 3, keeps them as Section 10 describes, and discloses them for business purposes only to its subprocessors and to the customer whose account a person uses. It has not sold or shared personal information in the past 12 months. California residents have the rights in Section 12, and the right to limit the use of sensitive personal information, which Profinetic already uses only as the law allows.

14. Children

The Service is for businesses and is not directed to children. Profinetic does not knowingly collect personal information from children under 16 for its own purposes. A customer's business records may include information about minors; the customer is responsible for it, and the Terms of Service prohibit submitting information collected directly from a child under 13.

15. Where information is processed

Profinetic hosts the Service and stores information in the United States, and offers the Service to businesses in the United States. Some subprocessors, listed in Annex 3 of the Data Processing Addendum, may process information in other countries.

16. Changes to this policy

Profinetic will post any update to this policy here with a new date, and will give customers' account Owners at least 30 days' notice of a material change before it takes effect. Profinetic will not use data from a connected service in a new way without first telling the customer and, where the provider's rules require it, asking the person who connected it to agree.

17. Contact

Questions and requests about this Privacy Policy can be sent to support@fxintelhq.com. Written requests can also be sent by mail to the principal address of Profinetic, LLC shown in its public record with the Florida Division of Corporations.