Introduction
This Privacy Policy explains how Prodigy AI Solutions (“we”, “us”, “our”) collects and uses personal data when you visit our websites/documentation, purchase our products through cloud marketplaces, or contact us. It also explains how we process data when our retrieval infrastructure layer / framework (the “Service”) is used by our business customers.
We are committed to processing personal data in line with the EU General Data Protection Regulation (GDPR – Regulation (EU) 2016/679).
Scope
This policy covers our websites, documentation, and customer communications related to Verbis Graph Engine and our Service. It does not cover external websites we link to.
1) Who we are
- Data Controller: Prodigy AI Solutions by Alena Baida, VAT IT02194560385
- Registered office: A da Brescia 5/1, Argenta, (FE) ITALY
- Contact email: ab@verbisgraph.com
If you are an end user using the Service via one of our customers (for example, your employer or another organization), that customer may be the primary controller for the data they upload and process through the Service (see Section 2).
2) Roles: when we are Controller vs Processor
Because our Service is used by businesses, our role can vary depending on context:
-
We act as a Data Controller for:
- website and documentation visitors;
- sales, marketing, and business communications;
- marketplace subscription administration data we receive;
- support communications where you contact us directly (outside the customer’s own environment).
-
We act as a Data Processor (on behalf of a customer) for:
- Customer Content processed in the Service, such as documents, text, metadata, queries, embeddings/vectors, and retrieval outputs—to the extent we receive or access it in order to provide the Service.
If you are a customer and need a Data Processing Addendum (DPA), contact us at ab@verbisgraph.com.
3) What personal data we collect
The data we collect depends on how you interact with us.
A) Website, documentation, and communications
- Contact details: name, work email, company name, job title, phone number (if provided).
- Messages and support content: emails, ticket messages, meeting details, and attachments you send us.
- Website technical data: IP address, device/browser type, pages viewed, timestamps, approximate location derived from IP (city/country level), and similar technical identifiers.
B) Marketplace purchase and subscription data (AWS Marketplace / Microsoft Commercial Marketplace)
If you subscribe via AWS Marketplace or Microsoft Commercial Marketplace (including Azure Marketplace/AppSource), the marketplace may provide us data needed to provision and manage your subscription, such as:
- organization/admin contact details (e.g., name, email, company);
- subscription identifiers and entitlement details (plan, status, dates);
- cloud account/tenant/subscription identifiers (as applicable);
- usage/metering signals needed for billing reconciliation (often aggregated).
Payment details: in most cases, payment details are processed by the marketplace provider under its own terms and privacy policy, not directly by us.
C) Service telemetry and logs
To operate and secure the Service, we may process:
- Operational metrics (performance, reliability, error rates);
- Error logs and diagnostics (primarily technical);
- Security/audit events (authentication events, admin actions, configuration changes).
We do not store document snippets or customer document content in logs as a normal practice. If a customer’s configuration or troubleshooting workflow could cause limited content to appear in diagnostics, we aim to minimize it and handle it securely.
D) Customer Content (as Processor)
Depending on the customer’s usage, Customer Content may include personal data (for example, names inside documents). Typical categories can include:
- documents/text uploaded or indexed;
- metadata and tags;
- user queries;
- embeddings/vectors derived from customer data;
- retrieval results.
Customers control what they upload and must ensure they have appropriate rights and legal bases to process that content.
4) Why we use personal data (purposes) and legal bases
We process personal data only when we have a lawful basis.
A) To provide and administer the Service (Contract / Legitimate Interests)
- provisioning subscriptions (including marketplace subscriptions);
- authenticating and managing user/admin access (where applicable);
- providing support and troubleshooting;
- delivering updates and service communications.
Legal basis: performance of a contract (GDPR Art. 6(1)(b)) and/or legitimate interests (Art. 6(1)(f)).
B) To secure, maintain, and improve the Service (Legitimate Interests / Legal Obligation)
- preventing abuse and fraud;
- monitoring reliability and performance;
- maintaining audit trails and security logs;
- investigating incidents.
Legal basis: legitimate interests (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c)).
C) Sales and B2B marketing (Legitimate Interests / Consent where required)
- responding to inquiries and demo requests;
- sending product updates to business contacts where permitted;
- managing the business relationship.
Legal basis: legitimate interests (Art. 6(1)(f)) and/or consent (Art. 6(1)(a)) where required by law. You can opt out of marketing at any time (see Section 11).
D) Compliance, accounting, and legal claims (Legal Obligation / Legitimate Interests)
- accounting, audit, and tax compliance;
- enforcing terms and protecting our legal rights.
Legal basis: legal obligation (Art. 6(1)(c)) and/or legitimate interests (Art. 6(1)(f)).
5) AI / model training promise
We do not train AI models on customer datasets
We do not use Customer Content (including datasets, documents, embeddings/vectors, or queries) to train our general AI models or foundation models.
- Customer Content is processed only to provide the Service under the customer’s instructions (as Processor, where applicable).
- We do not “reuse” customer datasets for our own proprietary training purposes.
- We may use aggregated and/or de-identified operational metrics (e.g., error rates, performance counters) to improve reliability and product quality, without using customer documents or document snippets.
If you enable a third-party integration (for example, sending prompts or content to an external AI provider), that third party’s processing is governed by their own terms and privacy policy, and the customer is responsible for configuring those integrations.
6) Who we share personal data with
We do not sell or rent personal data.
We may share personal data only as needed with:
A) Cloud marketplaces
AWS and Microsoft act as independent parties for marketplace operations under their own privacy policies. We receive limited data needed to provision and support subscriptions (see Section 3B).
B) Service providers (processors/sub-processors)
We use trusted vendors to operate our business and the Service. We may share data with providers in categories such as:
- cloud hosting / infrastructure;
- monitoring and error tracking;
- support ticketing and customer communications;
- email delivery;
- security tooling and incident response;
- accounting and professional advisors.
We require appropriate contractual safeguards and confidentiality obligations. Sub-processors list: we do not publish a public list here. We can provide the current list to customers under a DPA and/or upon request at ab@verbisgraph.com.
C) Legal and safety disclosures
We may disclose information where required by law, regulation, or legal process, or to protect rights, safety, and security.
D) Business transfers
If we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards.
7) International transfers
We are established in the EU (Italy). If we transfer personal data outside the European Economic Area (EEA), we apply appropriate safeguards such as:
- EU Standard Contractual Clauses (SCCs), and/or
- transfers to countries covered by an adequacy decision, where applicable,
plus additional technical measures when appropriate (e.g., encryption, access controls).
8) Data retention
We keep personal data only as long as needed for the purposes in this policy, then delete or anonymize it, unless a longer retention is required by law.
Below is a practical retention schedule:
- Marketplace subscription and account administration records: for the duration of the subscription + up to 5 years after termination (to handle disputes and contractual claims).
- Support tickets and support communications: up to 3 years after closure (longer if needed for an ongoing issue or legal claim).
- Security logs and audit trails: typically 90 days, extendable up to 180 days for security investigations.
- Operational metrics and error logs: typically 30–90 days (longer only if needed for stability analysis in aggregated form).
- B2B marketing contacts: until you opt out, or 3 years after the last meaningful interaction.
- Accounting and tax records: 10 years where required by applicable accounting/tax laws and best practice.
- Customer Content processed for customers: retained according to the customer’s instructions and contract. If we host or store Customer Content, it is deleted after termination/request within a reasonable period, with limited backup retention typically 30–90 days.
9) Security
We apply appropriate technical and organizational measures to protect personal data, which may include:
- encryption in transit (TLS);
- access controls and least-privilege permissions;
- logging and monitoring for security events;
- secure development and vulnerability management practices;
- incident response procedures.
No system is perfectly secure, but we work to prevent unauthorized access, disclosure, alteration, or loss.
10) Cookies and similar technologies
Our websites and documentation may use cookies or similar technologies for essential functionality, preferences, analytics (where enabled), and (optional) marketing (where enabled). Where required, we show a cookie banner and allow you to manage preferences. You can also control cookies through your browser settings.
For details on cookies, categories, and controls, see our Cookie Policy.
11) Your rights under GDPR
If GDPR applies, you may have the right to:
- Access your personal data;
- Rectify inaccurate or incomplete data;
- Erase data (in certain cases);
- Restrict processing (in certain cases);
- Object to processing based on legitimate interests;
- Data portability (in certain cases);
- Withdraw consent (where processing is based on consent);
- Lodge a complaint with a supervisory authority.
How to exercise your rights
Email us at ab@verbisgraph.com. We may ask for reasonable verification to protect you from unauthorized requests.
If you are an end user of a customer
If your data is processed through a customer’s use of the Service (Customer Content), the customer is typically the controller. Please contact that customer first. We will assist the customer as required under our DPA.
Supervisory authority
If you are in Italy, you can lodge a complaint with the Garante per la protezione dei dati personali (Italian Data Protection Authority) or your local EU authority.
12) Children
Our Service is intended for business/professional use and is not directed to children. We do not knowingly collect personal data from children.
13) Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will publish updates on this page and change the “Last updated” date. If changes are material, we may provide additional notice (for example, via email to account administrators or through product notices).
14) Contact
For privacy questions or requests:
- Prodigy AI Solutions
- Email: ab@verbisgraph.com
- Address: A da Brescia 5/1, Argenta, (FE), ITALY