Privacy Policy

Information You Provide Directly

When you create an account, submit our contact form, or communicate with us, we may collect:

• Your name
• Your company name
• Your job title or role
• Your email address
• Your phone number
• Your firm size and current project management tool
• The content of your message or inquiry

Authentication is handled by Clerk (clerk.com), a third-party identity provider. We do not store passwords.

Information from Your project management tools Integration

When you connect a Professional Services Automation tool (such as BQE Core, Deltek Vantagepoint, Deltek Ajera, Productive.io, Harvest, or Unanet AE), ProLens reads your project and operational data via API. This data is processed server-side to generate dashboard metrics and client portal displays.

When you connect a project management platform, ProLens syncs your project and operational data every 15 minutes. This data is encrypted at the field level using AES-256-GCM with a key unique to your account before it reaches our database. Sensitive fields (client names, employee names, financial amounts, cost rates) are stored as encrypted text that is unreadable without your tenant's decryption key. With Bring Your Own Key (BYOK) encryption enabled, ProLens cannot decrypt your data at all.

We store the following, all encrypted at the field level with your tenant's unique key:

• Project names, statuses, and budget data
• Invoice records (number, amounts, dates, status)
• Team member records (names, roles, cost rates)
• Client records (names, contact information)
• Deal/pipeline records (names, values, stages)
• Time entry records (hours, dates, billing status)
• Weekly Pulse snapshots (created within ProLens)

Data is refreshed from your platform every 15 minutes. When you disconnect your platform or delete your account, all stored data, encryption keys, and cached values are permanently deleted.

Information Collected Automatically

When you use the Services, our hosting provider and analytics tools may automatically collect:

• Pages visited and features used
• Session duration and frequency
• General geographic region (country or state level, not precise)
• Device type, browser type, and operating system
• Performance data (page load times)

We use Vercel Analytics, which does not use third-party cookies and does not collect personally identifiable information through analytics.

We do not use third-party advertising trackers, and we do not sell or share analytics data with advertisers.

Information Processed by AI Features

When AI features are enabled (such as Revenue Pulse Daily Insight), anonymized subsets of your data are sent to Anthropic's Claude API for analysis. Before transmission:

• Client names are replaced with pseudonyms (e.g., "Client A")
• Project names are replaced with pseudonyms
• Employee names are replaced with pseudonyms
• Dollar amounts, percentages, and dates are sent as-is to enable accurate analysis

Anthropic does not store or train on data sent via their API. AI-generated insights are held on our servers for up to 24 hours and then refreshed or deleted.

• To provide, operate, and improve the ProLens platform
• To generate dashboard analytics, KPIs, and AI-powered insights
• To display project status and invoice data on client portals in real time from your project management tools
• To process Weekly Pulse publications and portal updates
• To send transactional emails (account verification, Weekly Pulse notifications, sync failure alerts)
• To respond to support requests and demo inquiries
• To understand how subscribers use the platform so we can improve it

We do not use your information for automated decision-making or profiling. We do not sell your personal information. We do not use your data to train AI models.

We do not sell your personal information. We do not share your personal information with third parties for their marketing purposes.

We may share your information with service providers who assist us in operating the platform, including:

• Clerk (clerk.com) - Authentication and user management
• Supabase (supabase.com) - Database hosting (encrypted data and platform configuration)
• Vercel (vercel.com) - Application hosting and deployment
• Anthropic (anthropic.com) - AI analysis (anonymized data only)
• AWS KMS (aws.amazon.com) - Encryption key management (hardware security module)
• Upstash (upstash.com) - Temporary metric caching (Redis, 15-minute expiration)
• Inngest (inngest.com) - Background job processing
• Resend (resend.com) - Transactional email delivery
• Stripe (stripe.com) - Payment processing and subscription management
• PostHog (posthog.com) - Product analytics (no PII collected)

These service providers are authorized to use your information only as necessary to provide services to us and are contractually obligated to protect your information.

ProLens may produce anonymized, aggregated industry benchmarks (such as average utilization rates by firm size) using data from across our customer base. These benchmarks require a minimum of 20 contributing firms and no individual firm can be identified. You can opt out of benchmark contribution at any time in Settings.

We may also disclose your information if required by law, regulation, legal process, or governmental request.

We implement administrative, technical, and physical safeguards designed to protect the information we collect. These include AES-256-GCM field-level encryption with per-tenant keys, AWS KMS hardware-backed key management, encrypted data transmission (TLS 1.3), tenant-scoped database access, role-based access controls, and comprehensive audit logging. Bring Your Own Key (BYOK) encryption is available on all plans, allowing you to control your own encryption keys through AWS KMS, Azure Key Vault, or Google Cloud KMS.

For detailed information about our security practices, visit our Security page at prolens.io/security.

Account information and platform configuration are retained for the duration of your subscription plus 90 days.

Project names and statuses synced from your project management tools are retained for the duration of your subscription and deleted upon cancellation.

Your operational data (invoices, time entries, cost rates, client records, deals) is stored encrypted for the duration of your subscription and refreshed every 15 minutes. Upon cancellation or disconnection, all encrypted records, encryption keys, and cached data are permanently deleted within 24 hours.

Weekly Pulse snapshots (created within ProLens) are retained for the duration of your subscription. After cancellation, you may request export. Data is permanently deleted 90 days after cancellation unless a legal hold requires retention.

AI-generated insights expire after 24 hours and are not permanently stored.

Analytics data is retained in aggregate form and does not contain personally identifiable information.

You may choose not to provide certain information, though this may limit our ability to provide certain features.

You may disconnect your project management tools integration at any time from the Settings page. When you disconnect, ProLens immediately stops syncing. All encrypted data associated with that connection is permanently deleted. You can also use the “Delete My Data” option in Settings to instantly remove everything.

If you have previously provided your contact information and would like to update, correct, or request deletion, contact us at hello@prolens.io.

If you are a California resident, you have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, to request deletion of your personal information, and to opt out of the sale of your personal information (which we do not do). To exercise these rights, contact us at hello@prolens.io.

If you are located in the European Union or European Economic Area, you may have additional rights under the General Data Protection Regulation (GDPR), including:

• The right to access the personal data we hold about you
• The right to request correction of inaccurate personal data
• The right to request deletion of your personal data
• The right to restrict or object to our processing
• The right to data portability
• The right to withdraw consent at any time
• The right to lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at hello@prolens.io. We will respond within 30 days.

Where GDPR applies, we process personal data under the following legal bases:

• Legitimate interest: to operate the platform and improve our services
• Contract performance: to fulfill your subscription agreement
• Consent: where you have voluntarily provided your information
• Legal obligation: where we are required to retain or disclose information by law

The platform uses essential cookies for authentication session management via Clerk. We do not use cookies for advertising or cross-site tracking. Our analytics tools operate without third-party cookies.

The Services may contain links to third-party websites, including your connected project management tools and procatalyst.com. We are not responsible for the privacy practices of these third-party sites.

The Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last updated” date and notify account holders via email for material changes.

ProLens
Rowlett, TX
Email: hello@prolens.io