Privacy
What Profusia stores, where it lives, how long it is kept, and how each data-protection right maps to something you can actually do in the product. The security half of this picture is at /trust.
What we store, where, and for how long
| Data | Where it lives | How long |
|---|---|---|
| Documents you publish, and every prior version of them | Cloudflare R2 (bytes) and D1 (metadata, plus a derived text index so search can read inside documents) | Kept until you delete them. Deleting moves them to your workspace trash; nothing is erased until you explicitly purge, or the workspace itself is deleted. The search index follows the document: it leaves search when the document is trashed and is erased when the document is erased. |
| Datasets behind live pages | Cloudflare D1 | Kept until you delete them (same trash-then-purge rule). |
| Accounts: email, optional name, salted password hash | Cloudflare D1 | Kept while the account has a workspace membership. Erasable on request by a workspace admin (see “Erasure” below). |
| Sign-in sessions, share links, access keys, connector tokens | Cloudflare D1 — stored only as hashes | Until they expire or are revoked. The secret itself is never stored. |
| Audit log (who did what, when) | Cloudflare D1 | 400 days, then swept by a daily job. |
| AI per-call ledger (who asked, which document, tokens, cost) | Cloudflare D1 | 90 days, then swept. Daily spend aggregates (no personal detail) are kept longer for billing honesty. |
| Page-view counts | Cloudflare D1 | Counted per document per day. Visitors are never identified — no IP addresses or identifiers are stored with views. |
| Portal visitors: the display name a visitor typed, and their session (as a hash) | Cloudflare D1 | Until the visitor or their portal is revoked, the session expires (90 days), or the workspace is erased. The name is self-reported and unverified; portal opens are counted per day with no IP address or fingerprint. |
| A deleted workspace | — | Deletion makes the workspace unreachable immediately, and is reversible by an owner for 30 days. After that, a daily job permanently erases its database rows and stored files. |
All of it is hosted on Cloudflare (Workers, R2, D1) — Cloudflare is our infrastructure subprocessor. We run no other datastore.
Subprocessors
- Cloudflare — all hosting, storage and delivery.
- AI model providers, only if your deployment has AI features switched on: Google (Gemini), Groq, Cerebras, OpenRouter, Mistral, Cloudflare Workers AI, Anthropic, OpenAI. When you ask a document a question, that document's text is sent to the answering provider. No conversation is stored by Profusia, the model is given no tools, and which providers are actually enabled is a deployment decision — none are enabled by default.
- Audio, if you ask a question out loud — the recording is sent to the answering provider (Google, for spoken questions) in the same request as the document, and is used only to answer it. Profusia does not store the recording, does not keep a transcript of it, and never records without you pressing the button: there is no wake word and no open microphone. The audit log notes that a question was spoken and how long the clip ran — never the audio or the words.
- A Google authorisation, only if you switch on Google Docs/Sheets sync. Profusia stores the authorisation Google issues, encrypted at rest under a key held outside the database. It is never shown back to you or anyone else, never included in an export, and erased with your workspace. It uses Google’s per-file scope, so it permits access only to the documents Profusia itself creates in your Drive — Google enforces that, not us, so the rest of your Drive stays unreadable to Profusia. Your plans and documents are copied into your own Google account; nothing is read out of it. Disconnect at any time; what is already in your Drive is yours and stays.
That is the whole list. Profusia runs no analytics or advertising service. The Google sync above is the only case in which Profusia authenticates to another platform at all, it happens only if you turn it on, and it only ever writes — Profusia never reads another platform’s data on your behalf.
Your rights, as product actions
- Access & portability — the console's “Take it with you” export: every document you can see, plus plans, datasets, collections, the site structure and the audit log, packaged in your own browser. No ticket, no waiting.
- Erasure — a workspace owner can delete the whole workspace (unreachable immediately, reversible for 30 days, then permanently erased), and a workspace admin can erase a person: their account, sessions and invitations are removed and their name comes off surviving documents.
- Rectification — documents, plans and profile details are directly editable in the product; fixing a record is using it.
Anything a product act doesn't cover: contact us at the address in /.well-known/security.txt — the same contact handles privacy requests until a dedicated privacy address exists, and we say so here rather than inventing one.
California (CCPA/CPRA)
Profusia does not sell personal information and does not share it for cross-context behavioural advertising. There is no “Do Not Sell or Share” mechanism because there is no sale or sharing to opt out of.
Cookies
There is no cookie banner because there is nothing a banner would be consenting to: Profusia sets first-party cookies only, and only to make the page in front of you work — signing you in, remembering where you were working, keeping a password-protected link open once you have answered it, and remembering which version of a shared document your browser last opened so the page can say what changed since. None of them identifies you. No third-party cookies, no trackers, no analytics beacons. Anonymous page views are counted as numbers per document per day; visitors are never identified.
Where processing happens
Cloudflare's network is global; data is stored in Cloudflare's R2 and D1 services under our account. We do not currently offer a regional-pinning guarantee, and this page will say so until we do rather than implying one.