How Prodigy AI Solutions Handles Personal Data

Introduction

This Privacy Policy explains how Prodigy AI Solutions (“we”, “us”, “our”) collects and uses personal data when you visit our websites, read our documentation, contact us, request information, collaborate with us, or purchase, subscribe to, evaluate, or deploy our products through cloud marketplaces.

It also explains how we may process data when our retrieval infrastructure layer, knowledge retrieval framework, Verbis Graph Engine, or related AI systems are used by our business customers.

We are committed to processing personal data in line with applicable data protection laws, including the EU General Data Protection Regulation GDPR — Regulation (EU) 2016/679.

Scope

This Privacy Policy applies to:

• our company website at prodigy-ai-solutions.com;
• our website pages, documentation, product materials, and business communications;
• communications related to Prodigy AI Solutions, Verbis Graph Engine, and our AI services;
• cloud marketplace subscriptions and product administration, including AWS Marketplace and Microsoft Commercial Marketplace / Azure Marketplace where applicable;
• support, sales, partnership, pilot, and collaboration communications;
• our role in processing data through our AI infrastructure and retrieval services, where applicable.

This Privacy Policy does not apply to external websites, services, cloud marketplaces, AI model providers, or third-party platforms that we may link to. Those third parties process data according to their own privacy policies and terms.

1. Who We Are

Data Controller: Prodigy AI Solutions

Website: prodigy-ai-solutions.com

Registered office: Please insert your registered office address here.

Privacy contact email: Contact us →

If you are an end user using our Service through one of our customers, such as your employer or another organization, that customer may be the primary controller for the data they upload, index, query, or process through the Service. Please see Section 2 for more information.

2. Roles: When We Are Controller vs Processor

Because our products and services are used mainly by businesses, our privacy role may vary depending on the context.

We act as a Data Controller for:

• website and documentation visitors;
• sales, marketing, pilot, partnership, and business communications;
• contact forms, demo requests, email inquiries, and meeting communications;
• cloud marketplace subscription administration data that we receive;
• support communications where you contact us directly outside a customer-controlled environment;
• our own security, compliance, accounting, and business administration records.

We act as a Data Processor for:

We may act as a Data Processor on behalf of a business customer when we process Customer Content according to that customer’s instructions. Customer Content may include documents, text, metadata, queries, embeddings, vectors, retrieval outputs, or related information processed through Verbis Graph Engine or another Prodigy AI Solutions service.

In these cases, the customer is typically responsible for determining the purpose and legal basis for processing Customer Content. We process that data according to the customer’s contract, instructions, and applicable data processing agreement.

If you are a customer and need a Data Processing Addendum, please contact us at Contact us →

3. What Personal Data We Collect

The personal data we collect depends on how you interact with us.

A. Website, documentation, and communications

• Contact details: name, work email, company name, job title, phone number, and other details you choose to provide.
• Messages and support content: emails, contact form messages, meeting details, attachments, files, requests, and feedback you send to us.
• Business relationship data: information about your organization, project requirements, pilot requests, collaboration interests, and procurement needs.
• Website technical data: IP address, device and browser type, operating system, referring pages, pages viewed, timestamps, approximate location derived from IP address, and similar technical identifiers.

B. Marketplace purchase and subscription data

If you subscribe to, purchase, evaluate, or deploy our products through AWS Marketplace, Microsoft Commercial Marketplace, Azure Marketplace, AppSource, or another cloud procurement platform, the marketplace may provide us with limited information needed to provision, administer, support, or reconcile your subscription.

• organization or administrator contact details, such as name, email, company name, and role;
• subscription identifiers, plan details, entitlement status, subscription dates, and product configuration details;
• cloud account, tenant, customer, or subscription identifiers, where applicable;
• usage or metering signals needed for billing reconciliation, often in aggregated or technical form.

Payment details: in most cases, payment details are processed by the relevant marketplace provider under its own terms and privacy policy, not directly by Prodigy AI Solutions.

C. Service telemetry and logs

To operate, monitor, secure, and improve the Service, we may process limited technical data, such as:

• operational metrics, including performance, reliability, uptime, latency, and error rates;
• error logs and diagnostics, primarily technical in nature;
• security and audit events, such as authentication events, admin actions, configuration changes, and access events;
• deployment, version, and environment information required to support the Service.

We do not store document snippets or customer document content in logs as a normal practice. If a customer’s configuration, troubleshooting process, or diagnostic workflow could cause limited content to appear in diagnostics, we aim to minimize it, restrict access, and handle it securely.

D. Customer Content processed as Processor

Depending on how a customer uses the Service, Customer Content may include personal data, for example names, emails, customer records, employee information, or other personal data contained inside business documents.

Typical categories of Customer Content may include:

• documents, files, text, datasets, or knowledge bases uploaded or indexed by a customer;
• document metadata, tags, labels, categories, and file references;
• user queries, prompts, and retrieval requests;
• embeddings, vectors, graph relationships, entities, and metadata derived from customer data;
• retrieval results, answers, summaries, citations, or outputs generated by the Service.

Customers control what they upload or connect to the Service and must ensure that they have appropriate rights, notices, and legal bases to process that content.

4. Why We Use Personal Data and Legal Bases

We process personal data only when we have a lawful basis under applicable data protection law.

A. To provide and administer the Service

• provisioning subscriptions, including marketplace subscriptions;
• authenticating and managing user or administrator access where applicable;
• providing support, troubleshooting, updates, and service communications;
• managing customer accounts, pilots, evaluations, and deployments.

Legal basis: performance of a contract, GDPR Article 6(1)(b), and/or legitimate interests, GDPR Article 6(1)(f).

B. To secure, maintain, and improve the Service

• preventing abuse, fraud, unauthorized access, and misuse;
• monitoring reliability, uptime, error rates, and performance;
• maintaining security logs, audit trails, and incident records;
• debugging, stability analysis, service optimization, and vulnerability management.

Legal basis: legitimate interests, GDPR Article 6(1)(f), and legal obligation where applicable, GDPR Article 6(1)(c).

C. Sales, partnerships, and B2B marketing

• responding to inquiries, demo requests, pilot requests, and collaboration proposals;
• sending product updates or business communications to professional contacts where permitted;
• managing relationships with customers, prospects, partners, advisors, and marketplace contacts;
• understanding business needs and improving our offering.

Legal basis: legitimate interests, GDPR Article 6(1)(f), and/or consent, GDPR Article 6(1)(a), where required by law. You may opt out of marketing communications at any time.

D. Compliance, accounting, and legal claims

• accounting, audit, tax, and financial record keeping;
• responding to lawful requests from authorities;
• enforcing terms, protecting legal rights, and managing disputes;
• maintaining required business and compliance records.

Legal basis: legal obligation, GDPR Article 6(1)(c), and/or legitimate interests, GDPR Article 6(1)(f).

5. AI and Model Training Promise

We do not train AI models on customer datasets

We do not use Customer Content, including customer datasets, documents, embeddings, vectors, queries, prompts, retrieval outputs, or knowledge bases, to train general AI models or foundation models.

• Customer Content is processed only to provide the Service under the customer’s instructions, where we act as Processor.
• We do not reuse customer datasets for our own proprietary model training purposes.
• We do not sell Customer Content or use it to build unrelated datasets.
• We may use aggregated and/or de-identified operational metrics, such as error rates, performance counters, or uptime data, to improve reliability, scalability, and product quality.
• We do not use customer documents or document snippets for product improvement without an appropriate legal basis and customer instruction or agreement.

If a customer enables a third-party integration, for example by sending prompts, retrieved text, or other content to an external AI provider, that third party’s processing is governed by its own terms, data processing arrangements, and privacy policy. The customer is responsible for configuring and approving those integrations.

6. Who We Share Personal Data With

We do not sell or rent personal data.

We may share personal data only where needed for the purposes described in this policy.

A. Cloud marketplaces

AWS, Microsoft, and other marketplace providers may act as independent controllers or independent parties for marketplace operations, procurement, subscription management, billing, tax, and compliance under their own privacy policies.

If you subscribe via AWS Marketplace or Microsoft Commercial Marketplace, the marketplace may share limited subscription and administrative contact information with Prodigy AI Solutions so we can provision, administer, and support your subscription. Payment details are handled by the marketplace provider under its own privacy policy.

B. Service providers and sub-processors

We may use trusted vendors and service providers to operate our website, business, communications, infrastructure, and services. These providers may process personal data only as needed to provide services to us.

Categories of providers may include:

• cloud hosting and infrastructure providers;
• monitoring, logging, performance, and error tracking providers;
• support ticketing and customer communication tools;
• email delivery and business communication providers;
• security tooling, vulnerability management, and incident response providers;
• accounting, tax, legal, and professional advisors;
• analytics tools where enabled and legally permitted.

We require appropriate contractual safeguards, confidentiality obligations, and data protection commitments from service providers where required. We can provide the current sub-processor list to customers under a DPA and/or upon request.

C. Legal and safety disclosures

We may disclose information where required by law, regulation, legal process, or governmental request, or where disclosure is necessary to protect rights, security, safety, users, customers, or the integrity of our services.

D. Business transfers

If we are involved in a merger, acquisition, financing, corporate restructuring, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards and applicable law.

7. International Transfers

We are established in the European Union. If we transfer personal data outside the European Economic Area, we apply appropriate safeguards as required by law.

These safeguards may include:

• EU Standard Contractual Clauses;
• transfers to countries covered by an adequacy decision;
• contractual, organizational, and technical safeguards;
• additional measures such as encryption, access controls, and least-privilege permissions where appropriate.

8. Data Retention

We keep personal data only for as long as needed for the purposes described in this policy, unless a longer retention period is required or permitted by law. After that, we delete, anonymize, or securely archive the data.

9. Security

We apply appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, misuse, or destruction.

These measures may include:

• encryption in transit using TLS;
• access controls and least-privilege permissions;
• authentication and administrative access controls where applicable;
• logging and monitoring of security events;
• secure development and vulnerability management practices;
• infrastructure isolation and cloud security controls where applicable;
• incident response procedures.

No system is perfectly secure. However, we work to protect personal data and reduce the risk of unauthorized access, disclosure, alteration, or loss.

10. Cookies and Similar Technologies

Our websites and documentation may use cookies or similar technologies for essential functionality, preferences, analytics where enabled, security, and optional marketing where enabled.

Where required by law, we show a cookie banner and allow you to manage preferences. You can also control or delete cookies through your browser settings.

Typical cookie categories may include:

• Essential cookies: required for basic website functionality and security.
• Preference cookies: used to remember choices such as language or interface preferences.
• Analytics cookies: used to understand website usage and improve performance, where enabled.
• Marketing cookies: used only where enabled and legally permitted.

For additional details, please see our Cookie Policy once published.

11. Your Rights Under GDPR

If GDPR applies, you may have the following rights, subject to legal limitations:

• the right to access your personal data;
• the right to correct inaccurate or incomplete data;
• the right to erase data in certain cases;
• the right to restrict processing in certain cases;
• the right to object to processing based on legitimate interests;
• the right to data portability in certain cases;
• the right to withdraw consent where processing is based on consent;
• the right to lodge a complaint with a supervisory authority.

How to exercise your rights

To exercise your privacy rights, contact us at Contact us →

We may ask for reasonable verification before responding to a request, to protect personal data from unauthorized access.

If you are an end user of one of our customers

If your data is processed through a customer’s use of the Service as Customer Content, the customer is typically the controller. Please contact that customer first. We will assist the customer as required under our contract and DPA.

Supervisory authority

If you are located in Italy, you may lodge a complaint with the Garante per la protezione dei dati personali, the Italian Data Protection Authority, or with your local EU data protection authority.

12. Children

Our website, products, and services are intended for business and professional use. They are not directed to children, and we do not knowingly collect personal data from children.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will publish updates on this page and update the “Last updated” date.

If changes are material, we may provide additional notice, for example by email to account administrators, through product notices, or through our website.

14. Contact

For privacy questions, requests, or concerns, please contact:

Prodigy AI Solutions
Website: prodigy-ai-solutions.com
Email: Contact us →

If you are a customer requesting a Data Processing Addendum or sub-processor information, please contact us using the same email address.