Privacy Policy
Effective November 4, 2026 · version 2026-11-04
- Coalition House Products Inc (Calgary, Canada) runs Productf. We collect account details, the content you put into Productf, data from tools you connect, usage and device data, and billing details.
- We use it to run and secure Productf, bill you, support you and improve the product. We never sell it, and never use your content to train AI models.
- Free AI models are different: their providers may keep what you send them. Use a paid model for anything confidential.
- Your Brain and chats are kept until you delete them; logs for 90 days; backups for 30 days.
- You can access, correct, export or delete your data, and EU, UK and California residents have the extra rights described below. Write to mail@productf.io.
This summary is for convenience; the full text below governs.
1. Who we are
Productf is operated by Coalition House Products Inc, 2410-620 10 Ave SW, Calgary, Alberta, Canada ("we", "us"). For personal information about our account holders, website visitors and billing, we are the controller. For personal information that customers put into their workspaces (for example data from connected tools), the customer is the controller and we process it on their behalf. Contact: mail@productf.io.
2. What we collect
Account information: name, email address, sign-in details, workspace and role.
Your content: messages, prompts, files, Brain entries, agent settings, and Output generated for you.
Connected data: content and metadata from tools you choose to connect, limited to what you authorize.
Usage and device data: pages and features used, actions taken, credits used, IP address, browser and device type, and error reports.
Billing information: plan, invoices and payment status. Card details are handled by Stripe; we do not store full card numbers.
Communications: messages you send us, feedback, and survey answers.
3. How we use it
To provide the Service: run your workspace, generate Output with the AI models you choose, sync connected tools, and send you service messages.
To keep it secure: authenticate you, prevent abuse and fraud, and investigate incidents.
To bill you and manage credits.
To support you and respond to requests.
To improve the Service, using aggregated usage data and error reports. We do not use Your Content to train AI models, and our AI providers are contractually barred from training on content sent through paid models.
To meet legal obligations.
4. Legal bases (EU and UK)
Where GDPR or UK GDPR applies, we rely on: performance of our contract with you (to provide the Service and billing); legitimate interests (security, product improvement, service communications), balanced against your rights; your consent (optional analytics cookies and marketing email, which you can withdraw at any time); and legal obligation.
5. Free AI models
If you choose a free AI model, your prompts and the content sent with them go to that model's provider through OpenRouter. These providers may log, retain and use that content, including to improve their models, under their own policies. We tell you when a free model is in use. If you choose a paid model, your content is not sent to free-model providers. Do not send personal or confidential information to a free model.
7. Subprocessors
Subprocessors currently used:
Supabase: Database, authentication and file storage (United States).
Vercel: Application hosting and delivery (United States / global edge).
Railway: Agent worker hosting (United States).
Anthropic: AI models (Claude) (United States).
OpenAI: AI models and embeddings (United States).
OpenRouter: Access to free and third-party AI models (only when you choose a free model) (United States).
Portkey: AI request routing and logging (United States).
Stripe: Payments and billing (United States).
PostHog: Product analytics (United States / European Union).
Sentry: Error monitoring (United States).
Resend: Transactional email (United States).
Inngest: Background job scheduling (United States).
Data from tools you connect is also processed by those tools. We will update this list before adding a new subprocessor.
8. International transfers
We are based in Canada and our subprocessors are mainly in the United States. When personal data from the EU, the UK or Switzerland is transferred, we use the European Commission's Standard Contractual Clauses, the UK Addendum, or another lawful transfer mechanism.
9. How long we keep it
Brain entries, chats, files and workspace content: until you delete them or delete the workspace.
Logs (including AI request logs and audit logs): 90 days.
Backups: 30 days, after which deleted data is gone from backups too.
Billing records: as long as tax and accounting law requires.
When you delete your account or workspace, we delete or anonymize the related personal data within 30 days, apart from backups and records we must keep by law.
10. Security
We use encryption in transit and at rest, access controls with row-level security between workspaces, least-privilege access for staff, and monitoring. No system is perfectly secure; we will notify you and authorities of a breach as the law requires.
11. Your rights
You can access, correct, export or delete your personal information, and object to or restrict some uses. Many of these are available in Settings; otherwise write to mail@productf.io. We will answer within the time the law requires (usually 30 days). We will verify your identity before acting. If your data is in a customer's workspace, we may refer you to that customer.
12. EU and UK residents
Under GDPR and UK GDPR you have the rights of access, rectification, erasure, restriction, objection, data portability, and to withdraw consent at any time. You can complain to your local data protection authority or, in the UK, the Information Commissioner's Office. Our representative details are available on request.
13. California residents
Under the CCPA (as amended by the CPRA), California residents have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; to limit use of sensitive personal information; and not to be discriminated against for using these rights.
In the last 12 months we collected the categories in section 2 (identifiers, commercial information, internet activity, and content you provide) for the purposes in section 3, and disclosed them to the service providers in section 7 for business purposes. We do not sell or share personal information, and we do not knowingly collect personal information of anyone under 16. Californians aged 16 and 17 may use Productf (see section 15).
To make a request, email mail@productf.io. An authorized agent may make a request on your behalf with your signed permission.
15. Age
Productf is for people aged 18 and over, or the lower minimum age the law of their region allows, never below 16 (for example, 16 in California). We do not knowingly collect personal information from anyone under the minimum age for their region; if you believe we have, contact us and we will delete it.
16. Changes
We will tell you about material changes in the product or by email before they apply. The date at the top shows the current version.
17. Contact
Coalition House Products Inc, 2410-620 10 Ave SW, Calgary, Alberta, Canada. Privacy questions and requests: mail@productf.io.