Effective date: 1 September 2026
This Privacy Policy explains how POSIMYTH INC (“we”, “us”, “our”), registered at 251 Little Falls Drive, Wilmington, DE 19808, United States, collects and uses personal data when you use Protuno at protuno.com and its subdomains.
We are the data controller for the personal data described here. For questions or to exercise your rights, contact [email protected].
1. What we collect
Account data. Your name, email address, company name if you give one, and your password in hashed form. Collected when you create an account.
Billing data. Your plan, subscription status, invoices and transaction identifiers. We do not collect or store your card details. Payment is processed by Paddle, which acts as Merchant of Record and as an independent controller for payment data. See section 5.
Connected site data. For each website you connect: the domain, the WordPress username you supply, the application password you issue to us (stored encrypted), the WordPress and PHP versions, the installed plugins and themes and their versions, and the results of the checks our agents run. Where a check inspects content, we store the finding, not a copy of your site’s content, unless storing an excerpt is necessary to show you what was found.
Usage data. Pages viewed in the app, features used, agent runs triggered, credits consumed, and error and diagnostic logs.
Technical data. IP address, browser and device type, and timestamps, collected automatically when you use the site or the app.
Support data. The content of emails and support requests you send us.
Free scan data. If you run a scan without an account, we collect the domain you submitted, the scan results, and, at the verification step, the email address you supply.
2. Why we use it, and on what legal basis
- Create and run your account — to provide the Service you signed up for. Performance of a contract.
- Connect sites and run agent checks — the core function of the Service. Performance of a contract.
- Take payment, issue invoices, handle refunds — to complete your purchase. Performance of a contract; legal obligation.
- Send service emails (scan results, alerts, billing notices, security notices) — so you know what happened on your sites. Performance of a contract.
- Support you when you contact us — to answer your request. Performance of a contract; legitimate interests.
- Diagnose faults, monitor security, prevent abuse — to keep the Service working and safe. Legitimate interests.
- Improve the product using aggregated usage patterns — to make the Service better. Legitimate interests.
- Send marketing emails about Protuno — to tell you about the product. Consent, which you can withdraw at any time.
- Keep accounting and tax records — required by law. Legal obligation.
Where we rely on legitimate interests, we have considered your rights and we do not use your data in ways you would not reasonably expect. You can object at any time using the contact address above.
3. Automated processing and AI
Protuno uses a third-party AI model provider, Anthropic, to turn the raw findings from a site check into a readable report and into suggested actions. What is sent is the technical finding: versions, configuration values, check results, and where necessary a short excerpt of the page or setting that triggered the finding.
We do not send your customer records, your site’s user list, or your WordPress application password to any model provider. Our agreement with the provider prohibits using your data to train their models.
No decision that produces a legal or similarly significant effect on you is made by automated processing alone. Where an agent is set to apply a change rather than only report it, that is a permission you granted and can withdraw, and you can require approval before any change is applied.
4. Cookies
We use cookies that are strictly necessary to run the app: session, authentication and security. These cannot be switched off without breaking the Service.
We use analytics cookies (PostHog) to understand how the product is used. These are set only with your consent, and you can change or withdraw that consent at any time from the cookie banner.
The public marketing pages at protuno.com set no cookies until you consent to analytics or sign in.
5. Payments and Paddle
Our order process is conducted by our online reseller Paddle.com, which is the Merchant of Record for all our orders.
When you buy a subscription, Paddle collects and processes your payment details directly. We never see or store your full card number. Paddle processes that data as an independent controller under its own privacy policy, available at paddle.com/legal/privacy. Paddle shares with us only what we need to run your account: your name, email, country, plan, transaction identifier and subscription status.
6. Who else we share it with
We do not sell personal data, and we do not share it for third-party advertising.
We share data with service providers who process it on our behalf, under contract, only on our instructions, and only for the purposes above. We also disclose data where we are legally required to, or where it is necessary to establish, exercise or defend legal claims, or to protect the rights and safety of our users.
If POSIMYTH is involved in a merger, acquisition or asset sale, personal data may transfer to the acquiring entity. We will notify you before that happens and before your data becomes subject to a different privacy policy.
Using Protuno in ChatGPT
If you connect Protuno to ChatGPT, ChatGPT sends Protuno the requests you make there, such as a website address to audit or an instruction to scan or fix one of your sites. Protuno returns what ChatGPT needs to answer: site names and addresses, health scores, issues, fix plans and run history. OpenAI handles that information under its own privacy policy.
You connect by signing in on protuno.com and approving the permissions shown. ChatGPT gets an access token limited to those permissions. It never receives your Protuno password or your WordPress credentials. You can disconnect at any time in ChatGPT’s settings, which ends its access.
Protuno does not change a site from ChatGPT until you approve the exact plan. Fixes, scans and playbooks started from ChatGPT appear in your run history like any other run. We do not receive your ChatGPT conversations, only the requests sent to Protuno.
7. Sub-processors
These are the companies that process personal data on our behalf. Each link goes to that provider’s own privacy policy.
- Paddle.com Market Ltd
- Payments, Merchant of Record, invoicing and sales tax.
- Hetzner Online GmbH
- Application and database hosting.
- Cloudflare, Inc.
- DNS, CDN, web application firewall, and R2 object storage.
- MongoDB, Inc.
- Database hosting for account and connected-site records.
- Anthropic PBC
- AI processing of site check findings to produce reports and suggested actions.
- Zoho Corporation (ZeptoMail)
- Transactional email delivery.
- Google LLC (Google Workspace)
- Business email, including support correspondence.
- Functional Software, Inc. (Sentry)
- Application error and performance monitoring.
- Trigger.dev Ltd
- Background job orchestration for scheduled agent runs.
- PostHog, Inc.
- Product analytics, set only with your consent.
8. International transfers
Where personal data is transferred outside the UK or EEA, we rely on an adequacy decision where one exists, and otherwise on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with any additional safeguards the transfer requires. You can request details of the safeguards applying to a specific transfer at [email protected].
9. How long we keep it
- Account and connected site data: for as long as your account is open, then deleted or anonymised within 90 days of account closure.
- Scan and agent run results: for the retention period of your plan, then deleted.
- Free scan data with no account created: 90 days.
- Billing and tax records: as long as tax law requires, currently up to 7 years.
- Support correspondence: 3 years from the last message.
- Server and security logs: 12 months.
10. Security
Site credentials, including application passwords, are stored encrypted at rest. All traffic to and from the Service is encrypted in transit over TLS. Access to production data is restricted to staff who need it, and is logged.
You can revoke Protuno’s access to any connected site at any time by revoking the application password in WordPress or removing the site from your account. That takes effect immediately.
No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and notify you without undue delay where the risk is high.
11. Your rights
Subject to the law that applies to you, you have the right to: access your data; have inaccurate data corrected; have your data erased; restrict or object to processing; receive your data in a portable format; and withdraw consent where we relied on consent, without affecting processing that already happened.
To exercise any of these, email [email protected]. We respond within one month. We do not charge for this, and we will not treat you differently for asking.
For erasure specifically, our Delete My Data page sets out what to send, what we remove, and what we are required to keep.
If you are in the UK or EEA and you are unhappy with our response, you may complain to the supervisory authority in the country where you live or work. POSIMYTH INC is established in the United States, so there is no single lead authority for us in the EEA; your own national authority is the right route.
12. Children
Protuno is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact [email protected] and we will delete it.
13. Changes
We may update this Policy. When we do we will change the effective date above, and where the change is material we will notify you by email before it takes effect.
14. Contact
POSIMYTH INC
251 Little Falls Drive
Wilmington, DE 19808
United States
Privacy enquiries: [email protected]
General contact: protuno.com/contact