Privacy Policy

1. Who we are

Propheus Pte. Ltd., a company incorporated in Singapore (“Propheus”, “we”, “us”), operates Propheus Digital Atlas and digitalatlaspropheus.com (the “Service”). We are responsible for the personal data described here.

This policy sits alongside the Terms of Service. Where your organisation has a separate written agreement with us, that agreement also applies to data you provide under it.

2. What we collect

We collect only what the Service needs to run:

• Account details: your name, email address, organisation and role, and the date you joined. Your password is stored only in hashed form.
• Terms acceptance: which version of the Terms you accepted and when, with the IP address and browser details used at the time.
• Sign-in security: your session, and short-lived counts of sign-in attempts by email address and IP address, used to stop password guessing, and records of sign-ins kept by our sign-in service.
• API keys: a key’s name, its first characters and when it was created, last used or revoked. We store only a one-way hash of the key, never the key itself.
• Usage records: for each tool call, which tool was called, its inputs, whether it succeeded, how long it took and the credits it used. Inputs that look like secrets or web addresses are removed and very long inputs are replaced by a fingerprint, but inputs such as place names and addresses are kept as entered.
• Content you provide: files you upload, such as sales data, the analyses we produce from them, and questions you ask in Agent Lab.

We do not use analytics, advertising or tracking tools on the website, and we do not collect data about you from data brokers.

3. How we use it

We use personal data to:

• create and secure your account and sign you in;
• run the tools, answer your requests and process the data you upload;
• count credits, enforce usage limits and keep a record of charges;
• keep a record that you accepted the Terms of Service;
• detect, investigate and stop misuse, errors and security problems;
• answer your support requests and send messages about your account;
• meet our legal obligations and enforce our agreements.

We do not sell personal data and we do not use it for advertising.

4. Cookies and browser storage

We use only cookies the Service needs to work. They cannot be read by scripts on the page, and none are used for analytics or advertising:

• da_session keeps you signed in, for up to 7 days.
• da_login protects a sign-in while it is in progress, for 10 minutes.
• da_agent_link holds the encrypted key that connects Agent Lab to your account, for up to 30 days, and is sent only to Agent Lab.

The website does not keep anything else in your browser’s storage.

5. Who receives it

We share personal data only with the following, and only as far as they need it:

• Infrastructure providers that host our servers and storage, including Microsoft Azure.
• Mapbox, which supplies the maps on our public pages. Your browser requests map images from Mapbox directly, so Mapbox receives your IP address and the area of the map you view.
• Microsoft Azure OpenAI, which runs the AI model behind Agent Lab (see section 6).
• Data providers that some tools query for you. For example, live place details send a place’s name or address to the provider of place listings, and tools that assess property photos send the photos you submit, with location metadata removed, to the provider that assesses them.
• An email delivery provider, to send sign-in and account messages.
• Professional advisers and authorities, when the law requires it or to protect our rights, our users or the public.
• A buyer or successor, if all or part of our business is sold or reorganised, under the same protections.

If you belong to an organisation on the Service, its owners can see that you are a member and your role.

6. AI features and connected AI clients

When you ask a question in Agent Lab, your question, the steps taken to answer it and the answer are sent to Microsoft Azure OpenAI for processing. That processing is also subject to Microsoft’s terms.

When you connect an AI client such as Claude, ChatGPT or Grok, the client sends us your requests and receives the results. What the client and its provider do with your conversations is governed by their own terms and privacy policies, not this one. Files you share with us through such a client are downloaded from that client’s file service so that we can process them.

7. Where it is processed

We and our providers may process personal data outside Singapore. When we transfer it, we take steps to make sure it receives a standard of protection comparable to that under Singapore’s Personal Data Protection Act 2012.

8. How long we keep it

Some data is deleted automatically:

We keep other data, including account details, usage records, credit records, terms acceptances and the files and analyses you upload, for as long as your account is open and afterwards for as long as we need it for billing, security, resolving disputes and meeting legal obligations.

When you delete your account, we delete your account details and sign-in identity, end your sessions and revoke your API keys. We keep usage, credit and terms acceptance records. To have files you uploaded deleted as well, email us.

9. Security

We protect personal data with measures that include encrypted connections (HTTPS), hashed API keys and passwords, cookies that page scripts cannot read, separate storage for each account’s uploaded data, and restricted access to our servers. No system is perfectly secure, so please keep your password and API keys safe and tell us at once if you think they have been exposed.

10. Your choices and rights

You can see and change your name, and delete your account, from your account settings. You can also ask us to:

• tell you what personal data we hold about you and how we have used it;
• correct personal data that is wrong;
• stop using your personal data for a purpose you agreed to, where the law allows;
• delete files you uploaded.

Email support@propheus.com from the address on your account. We may need to confirm your identity and will respond within the time the law requires. If you are not satisfied with our response, you may contact your local data protection authority.

11. Children

The Service is for business use by people aged 18 or over. We do not knowingly collect personal data from children.

12. Changes to this policy

We will update this policy when the way we handle personal data changes. The date at the top shows when it last changed. If a change is significant, we will tell you through the Service or by email.

13. Contact

Questions or requests about this policy or your personal data: support@propheus.com.