Privacy Policy
Last updated: July 17, 2026
Introduction
This Privacy Policy explains how Progon ("we," "us," or "our") collects, uses, stores, and shares personal data when you use the Progon service. The service consists of the Progon Chrome extension, the Progon web application at progon.io, the backend API, and the progon.io landing pages (collectively, the "Service"). This policy covers data we process in two capacities: as an operator (or controller) for data you provide directly — such as your account information, session records, and product telemetry — and as a data processor when the Service captures or analyzes content from websites you choose to test. The "Data From Websites You Test" section explains that second role in detail. This policy is intended for users located in the EU/EEA, the Russian Federation, Kazakhstan, Belarus, and elsewhere. It serves simultaneously as the Политика в отношении обработки персональных данных required under Russian Federal Law No. 152-FZ. Key terms: personal data — any information relating to an identified or identifiable natural person; processing — any operation performed with personal data; operator/controller — the party determining the purposes and means of personal data processing; data subject — the individual to whom personal data relates. For questions about this policy or your personal data, contact us at support@progon.io.
Who We Are
The Service is operated by Progon (service operator). No legal entity has been incorporated at the time of this writing. This policy will be updated to include the legal entity name, registered address, and other corporate details as soon as incorporation is complete. Contact: support@progon.io. EU representative: no EU representative under GDPR Article 27 has been appointed because no legal entity currently exists. If you are located in the EU/EEA and wish to raise a data protection concern, please contact us directly at support@progon.io. Upon incorporation, a representative will be appointed and their contact details will be added to this section. Data Protection Officer: a DPO is not required for Progon's current scale and type of processing. All privacy and data-protection inquiries should be directed to support@progon.io. Role split: Progon acts as a controller for personal data you provide directly — including account information, session and device records, product telemetry, and billing-intent data. Progon acts as a data processor when the Service captures, stores, or transmits content from websites you test, because that processing is carried out on your instructions. If that content includes personal data about third parties — for example, real user data visible on a tested application — you (or your company) are the controller of that data, and we process it solely on your behalf. Categories of data subjects: individuals who register for an account (users); company administrators; individuals invited to a company workspace; and end users of tested applications whose personal data may appear on tested pages (Progon processes this data as a processor, not as a controller). Person responsible for personal data processing (Federal Law No. 152-FZ Article 18.1): contactable at support@progon.io. A named responsible individual will be designated and disclosed upon incorporation or upon a separate appointment decision.
Data We Collect
We collect the following categories of personal data. • Account information: email address, first name, last name, and company name provided at registration; account password stored as a bcrypt hash (never in plaintext). • Device and network data: IP address and browser user agent, collected at registration, at each login session, and for security-relevant actions (password resets, team invitations, account deactivation). These are stored in session records and in the application-level security audit log. • Project and test content: test projects, pages, checklists, scenarios, test steps, element selectors, bugs, incidents, comments, and shared steps that you create or record using the Service. Test steps include the actual input values typed into forms on tested websites during recording — including values entered into password fields, which are masked only in the display, not in storage. See "Data From Websites You Test" for full details. AI assistant conversations — your prompts, assistant responses, tool calls, tool results, and AI run and usage logs — are also stored. • Product telemetry: when you use element-matching features, the Service records first-party element-match events attributed to your company account. These events include a company identifier, page domain, and page fingerprint. This telemetry is attributed to your company — it is not anonymous. • Team invitation data: when a company administrator invites a team member, Progon receives that person's email address from the inviting administrator, not directly from the invitee (GDPR Article 14 disclosure). We use this address only to send the invitation and to create the invited user's account. • Upgrade-intent signals: if you express interest in upgrading your subscription (for example, by clicking an upgrade prompt), we record that intent. No payment card or billing address data is collected because billing is not yet active in the Service.
Data From Websites You Test
When you use the Progon Chrome extension to record or replay test scenarios, or when you use AI-powered analysis features, the extension captures content from the websites you are testing. This section explains what is captured, how, and our role as a processor for that data. Screenshots: the extension captures a screenshot of the visible browser tab using the chrome.tabs.captureVisibleTab API when you trigger a recording action or initiate an AI analysis. Screenshots are captured only during recording, playback, or AI sessions you initiate — never in the background. During AI analysis sessions, we apply technical safeguards that can exclude screenshots of steps associated with known sensitive content (for example, steps associated with password-field interactions are flagged and screenshots of such steps are omitted from AI processing where this is detected). This AI-session safeguard does not apply to recording and playback screenshots, which are captured based on step type. Screenshots captured as part of canvas-based recording or playback steps are stored persistently in your test scenario data on Progon servers as long as your account is active. Screenshots taken during AI analysis sessions (for example, for element resolution or agentic AI tasks) are transmitted transiently to AI providers for analysis and are not persistently retained by Progon after delivery to the provider. Recorded input values: during recording, the extension captures the actual values typed into input fields on tested websites. This includes fields that are visually masked as password fields; the masking is display-only and does not prevent the value from being captured and stored in cleartext in your test scenario data on Progon servers. This is necessary for automated playback. We strongly recommend testing against staging or test environments using non-production data, particularly when recording sensitive workflows. Network traffic of tested applications: the extension captures network requests and responses of the tested application — URL, method, headers, and request and response bodies up to 200 KB each — to build an API endpoint catalog. Credential header values (Authorization, Cookie, Set-Cookie, X-Api-Key, and similar headers) are redacted before storage. Request and response bodies are stored in their original form and may contain data from your tested application's end users. Accessibility information and page context: during AI-assisted analysis, the extension sends accessibility tree data, page URL, page title, and viewport dimensions to the backend and to AI providers. Console errors and exceptions: the extension monitors console errors and exceptions from tested pages for diagnostic purposes. This information is processed locally within the extension and displayed in the extension's error panel; it is not uploaded to Progon servers. Processor role and shared responsibility: Progon processes tested-website content solely on your instructions. You are responsible for ensuring that your testing activities comply with applicable data protection law, particularly when testing against systems that contain real user data. We strongly recommend using staging or test environments with anonymized or synthetic data. No background capture: the extension does not capture screenshots, record input values, or collect page data in the background. All capture occurs only during recording, playback, or AI sessions you explicitly start.
AI Features and Your Data
Progon includes an AI assistant and AI-powered test analysis features that send data to external large language model (LLM) providers. This section explains what data is involved, with which providers, and on what terms. What triggers data transmission: when you actively use an AI feature — for example, sending a message to the AI assistant, using AI-powered element resolution, or running an agentic AI session — Progon sends the relevant context to an LLM provider. That context may include your text prompt, selected test steps, page URLs, element selectors, and where applicable, screenshots of the page being tested or its accessibility tree. Semantic search indexing: when you create or update test content (scenarios, checklist items, bugs, and similar entities), Progon automatically processes the text content of those entities to generate vector embeddings used to power semantic search within the AI assistant. This processing runs on Progon's own self-hosted infrastructure. Your test content is not transmitted to OpenAI or any other third-party provider for this purpose. AI providers: the LLM providers currently used by Progon include Anthropic, OpenAI, Amazon Web Services (via AWS Bedrock), and Google (via Gemini). A current list of AI subprocessors, including any additions or changes, is maintained at progon.io/legal/subprocessors. No training on your data: Progon does not use your data to train AI models. Based on the published commercial API terms of Anthropic and OpenAI (as of the date of this policy), data submitted through their commercial APIs is not used by those providers to train their models. For Amazon Bedrock and Google Gemini, we are not in a position to independently verify equivalent commitments on your behalf; if this is important to you, please review those providers' API terms directly. Regardless of provider, your prompts and AI outputs are your data and are not used by Progon for any purpose other than delivering the AI features to you. Provider data retention: in accordance with their own published terms, AI providers may retain submitted data for a limited period for abuse monitoring and trust-and-safety purposes. Retention periods vary by provider and we do not control them; please review each provider's current terms directly. BYOK API keys: if you choose to connect your own LLM API key ("bring your own key"), your key is stored on Progon servers encrypted with AES-256-GCM. It is never written to application logs and is never displayed back to you in full. It is used solely to authenticate your requests to the AI provider you selected. When you use a BYOK key, requests are routed through Progon's backend to your chosen provider. Progon's commitments in this policy apply to how Progon handles your data; the provider's handling of requests made under your own key is governed by your own agreement with that provider. Defined terms: "Prompts" means the text, context, and other content you submit to an AI feature. "Outputs" means the AI-generated responses returned to you. Both are your data — or your company's data for company account users — and are not used by Progon for any purpose beyond providing the AI features. Automated decisions: Progon's AI features assist you in creating and analyzing tests. They do not make legal or similarly significant decisions about you automatically. No automated decision-making of the type described in GDPR Article 22 occurs. EU AI Act: Progon is committed to ensuring that, from 2 August 2026, users interacting with the Progon AI assistant will be informed within the product interface that they are interacting with an AI system, in accordance with EU AI Act Article 50. Implementation of the required in-product disclosure is ongoing product work. This policy section provides the underlying data-flow detail.
How We Use Your Data
We process personal data only for the purposes described below. For each purpose we state the legal basis under GDPR Article 6 and the corresponding basis under Federal Law No. 152-FZ. • Account creation and authentication (legal basis: performance of a contract, Art. 6(1)(b); Federal Law No. 152-FZ, Art. 6, Part 1, Para. 5): your email, name, company name, and password hash are used to create your account, authenticate you, and provide the core Service. • Providing test recording, playback, and project management features (legal basis: performance of a contract, Art. 6(1)(b); Federal Law No. 152-FZ, Art. 6, Part 1, Para. 5): project and test content, including recorded steps, element selectors, and tested-site captures, are processed to deliver the Service you subscribed to. • AI features (legal basis: performance of a contract, Art. 6(1)(b); Federal Law No. 152-FZ, Art. 6, Part 1, Para. 5): prompts, context, page data, screenshots, and test content retrieved as context for AI responses are processed to generate AI assistant responses and perform AI-powered test analysis. Semantic-search indexing runs on Progon's self-hosted infrastructure. These are core features of the Service. • Security, fraud prevention, and service integrity (legal basis: legitimate interests, Art. 6(1)(f); Federal Law No. 152-FZ, Art. 6, Part 1, Para. 6; legitimate interest — protecting the Service and its users from unauthorized access, abuse, and security incidents): IP addresses, user agents, and security audit logs are processed to detect suspicious activity, investigate security incidents, and maintain service integrity. • Product telemetry (legal basis: legitimate interests, Art. 6(1)(f); Federal Law No. 152-FZ, Art. 6, Part 1, Para. 6; legitimate interest — improving the reliability of element matching in the product): element-match events attributed to your company account are processed to improve element-matching accuracy and reliability. • Service communications (legal basis: legitimate interests, Art. 6(1)(f); Federal Law No. 152-FZ, Art. 6, Part 1, Para. 6; legitimate interest — notifying you of service-critical events): your email address is used to send account verification, password reset, team invitation, and service-update notifications. Marketing communications, if any, will be sent only with your prior consent. • Processing invitee email addresses for team invitations (legal basis: legitimate interests, Art. 6(1)(f); Federal Law No. 152-FZ, Art. 6, Part 1, Para. 6; legitimate interest — enabling company administrators to invite colleagues to the Service): when a company administrator invites a colleague, we process the invitee's email address to send the invitation and create an account if accepted. The email address is received from the administrator, not from the invitee directly. • Upgrade-intent signals (legal basis: legitimate interests, Art. 6(1)(f); Federal Law No. 152-FZ, Art. 6, Part 1, Para. 6; legitimate interest — understanding demand for paid features to inform product development): records of expressed upgrade intent are processed to guide product planning. • Compliance with legal obligations (legal basis: legal obligation, Art. 6(1)(c); Federal Law No. 152-FZ, Art. 6, Part 1, Para. 2): where required by applicable law or a binding order from a competent authority, we may process and disclose personal data to courts, law enforcement agencies, regulators, or other public authorities. Data provision requirement: providing your email address, name, and company name is a contractual requirement for creating an account. You are not legally obligated to provide this data, but without it we cannot provide the Service. Processing is limited to what is necessary for the purposes listed above. We do not use your data for advertising, sell it to data brokers, or process it for purposes beyond those stated here. Implied or passive acceptance does not constitute valid consent under GDPR or applicable CIS law; any new processing purpose that requires consent will be sought through a separate, affirmative consent action.
Third Parties and Recipients
We share personal data with the following third parties. We do not sell your personal data to any third party. • LLM and AI providers (Anthropic, OpenAI, Amazon Web Services via AWS Bedrock, Google via Gemini): when you use AI features, prompts, page context, screenshots, and test content retrieved as context for AI responses are transmitted to these providers. Semantic-search embedding generation runs on Progon's self-hosted infrastructure and is not transmitted to these providers. In BYOK mode, your chosen provider also receives your traffic. See "AI Features and Your Data" for details. A current list is maintained at progon.io/legal/subprocessors. • Email delivery (Twilio SendGrid or SMTP when configured): when email delivery is active, your email address and the content of transactional emails (verification codes, password reset links, team invitations, service notifications) are processed by the configured email delivery provider, which may be Twilio SendGrid or a generic SMTP relay. Email sending is inactive in some deployment configurations. • Atlassian (Jira Cloud): if you enable the Jira integration, the bug and test data you choose to sync is shared with Atlassian under your Jira Cloud account. This integration is entirely opt-in; no data is shared unless you enable it. • Hosting provider: the Service backend and database run on infrastructure provided by a third-party hosting provider. The specific provider and region are not confirmed at this time and will be added to this section once the hosting arrangement is finalized. All data stored on these servers is protected by the measures described in "Data Storage and Security." • Let's Encrypt: TLS certificates for progon.io are issued by Let's Encrypt. Domain names are shared with Let's Encrypt for certificate issuance; no personal data beyond domain names is involved. • Google Fonts: the Progon web application currently loads fonts from Google's servers (fonts.googleapis.com, fonts.gstatic.com). This causes your browser to make a request to Google's servers when using the web application, which may expose your IP address and browser user agent to Google. We intend to self-host fonts in a future release to eliminate this third-party request. • Government and law enforcement authorities: we may disclose personal data to courts, law enforcement agencies, regulators, or other public authorities where required by applicable law, pursuant to a legally binding order, or to establish, exercise, or defend legal claims. We do not currently use analytics providers, error-tracking providers, or payment processors. If we integrate any of these in the future, this section will be updated and, where required, your consent will be obtained.
International Data Transfers
Progon transfers personal data outside the European Economic Area (EEA). This section describes those transfers and the safeguards applicable to them. Transfers to AI and email providers in the United States: Anthropic, OpenAI, Amazon Web Services, Google, and Twilio SendGrid are based in the United States. Data transferred to these providers includes AI feature inputs (prompts, page context, screenshots) and, when email delivery is active, transactional email content. The applicable transfer safeguard varies by provider, as follows. • Amazon Web Services, Inc. (AWS Bedrock): as of July 2026, AWS holds an active certification under the EU-US Data Privacy Framework (DPF) and publishes its DPF commitments. We rely on the DPF as the transfer safeguard for AWS. Current certification status can be verified at dataprivacyframework.gov. • Google LLC (Gemini): as of July 2026, Google holds an active DPF certification and publishes its DPF commitments. We rely on the DPF as the transfer safeguard for Google. Current certification status can be verified at dataprivacyframework.gov. • Twilio Inc. (SendGrid): as of July 2026, Twilio holds an active DPF certification and publishes its DPF commitments. We rely on the DPF as the transfer safeguard for Twilio when email delivery is active. Current certification status can be verified at dataprivacyframework.gov. • Anthropic PBC: Anthropic is not currently certified under the DPF (checked July 2026; Anthropic's own Data Processing Addendum specifies Standard Contractual Clauses with no DPF mention). We have not yet executed Standard Contractual Clauses with Anthropic because no legal entity currently exists from which to do so. Transfers to Anthropic for AI assistant and AI analysis features currently rely on GDPR Article 49(1)(b) as a derogation based on necessity for the performance of a contract with you. Upon incorporation, we will execute SCCs with Anthropic and update this section. • OpenAI OpCo, LLC: OpenAI's DPF certification status is unverifiable from available evidence and we treat it as not certified for the purpose of this policy (checked July 2026). We have not yet executed Standard Contractual Clauses with OpenAI because no legal entity currently exists from which to do so. Transfers to OpenAI for AI assistant and AI analysis features currently rely on GDPR Article 49(1)(b) as a derogation based on necessity for the performance of a contract with you. Upon incorporation, we will verify OpenAI's DPF status and, if not certified, execute SCCs. Hosting location: the hosting provider and data center region for the Progon backend and database have not been confirmed at this stage. This section will be updated with specific location information and the applicable transfer mechanism once the hosting arrangement is finalized. Transfers involving users in the Russian Federation: Progon transfers personal data of users located in the Russian Federation to third-party providers located outside Russia. A cross-border transfer notification with Roskomnadzor under Federal Law No. 152-FZ Article 12 has not been filed; no legal entity currently exists from which to file it. Filing is deferred to the future entity-registration decision. We disclose this openly. Transfers involving users in Kazakhstan: if you are located in Kazakhstan, your data may be transferred to countries outside Kazakhstan, including the United States. Under Kazakhstani Law No. 94-V, transfers to countries that do not ensure an adequate level of personal data protection require written or electronic consent or another recognized legal basis. No Kazakhstan-specific consent mechanism currently exists in the Service. We disclose this openly as a known gap; a dedicated consent screen for users located in Kazakhstan will be implemented before go-to-market in Kazakhstan. If you are located in Kazakhstan and have concerns about transfers of your data, contact us at support@progon.io. Transfers involving users in Belarus: if you are located in Belarus, certain transfers of your personal data occur to countries that Belarus has not recognized as ensuring an adequate level of personal data protection, including the United States. Under Belarusian Law No. 99-Z, such transfers require explicit prior consent accompanied by risk disclosure. We are in the process of implementing a dedicated consent mechanism for users located in Belarus. Until that mechanism is in place, please contact us at support@progon.io if you have concerns about transfers of your data.
Data Retention and Deletion
Personal data collected in connection with your account — including account information, session records, security audit logs, project content, AI conversation data, and product telemetry — is retained for as long as your account remains active. Deactivating your account does not automatically trigger deletion; data is retained until a verified deletion request is submitted to support@progon.io. Upon your verified request, personal data is deleted. Deletion requests must be sent to support@progon.io with sufficient information to verify your identity. Requests are fulfilled within 30 days of receiving a verifiable request. We do not have automated data purge jobs for user data at this time; deletion is performed manually upon request. Screenshot data: canvas-based recording and playback screenshots are stored as part of your test scenario data and are retained for as long as your account is active or until a verified deletion request is fulfilled. Screenshots captured during AI analysis sessions are transmitted transiently to AI providers and are not persistently retained by Progon. BYOK API keys: your personal BYOK API key is deleted from Progon servers when you remove it from your account settings. Your company's shared BYOK API key is stored in encrypted form on Progon servers; disabling the key prevents it from being used, but the encrypted key data is retained until an explicit deletion request is submitted to support@progon.io. Integration tokens: Jira OAuth tokens are deleted from Progon servers when you disconnect the Jira integration from your account settings. Trash: deleted projects, scenarios, and other entities are moved to a restorable trash from which they can be recovered. Triggering "permanent delete" or "empty trash" within the product interface marks items as permanently deleted in the database but does not physically remove data from storage at this time; complete removal from storage requires a verified deletion request to support@progon.io. Console error data captured during testing is processed locally in the extension and is not uploaded to Progon servers. Under applicable data protection law, personal data must be erased or anonymized when the purposes for which it was collected are fulfilled, when consent is withdrawn and no other legal basis exists, or upon a valid erasure request.
Data Storage and Security
We implement security measures appropriate to the nature of the data we process. The following claims reflect our current, verifiable implementation. Data in transit: all data transmitted between your browser, the Progon extension, and Progon servers is encrypted using TLS (via Traefik with Let's Encrypt certificates). Unencrypted HTTP access to Service endpoints is not supported. API keys and integration tokens at rest: BYOK LLM API keys and Jira OAuth tokens are encrypted at rest on Progon servers using AES-256-GCM before being written to the database. Passwords: account passwords are stored as bcrypt hashes. Passwords are never stored or logged in plaintext. Audit logging: security-relevant actions (login, logout, password reset, team invitation, account deactivation) are recorded in an application-level audit log that captures the action type, affected user, timestamp, IP address, and user agent. We apply legal, organizational, and technical measures to protect personal data, including encryption and access controls, as required by applicable data protection law. We do not currently implement full disk or database encryption at rest beyond the application-level encryption described above for API keys and tokens. Breach notification: in the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach where required (GDPR Art. 33); within 24 hours under Russian Federal Law No. 152-FZ; within 3 working days under Belarusian Law No. 99-Z. We will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
Chrome Extension and Limited Use
Progon's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically: • Data collected by the extension is used solely to provide the test recording, playback, AI analysis, and related features described in the Service. • We do not sell or transfer data to third parties for purposes unrelated to providing the Service, including to data brokers or advertising platforms. • We do not use data obtained through Chrome APIs for advertising or to determine creditworthiness. • We do not allow humans to read user data except where you have given explicit permission, where it is necessary for security purposes, where it is required by applicable law, or where the data is genuinely anonymized and aggregated. The extension stores the following data locally on your device: • Authentication tokens (access token and refresh token) in chrome.storage.local, used to authenticate your session with the Progon backend. • Network capture buffers, including captured request and response bodies of tested applications, temporarily in browser IndexedDB before upload to Progon servers. • Session-related page values and state in chrome.storage.session. The recording feature collects browsing activity — page URLs, interaction events, and element selectors — from the websites you are actively testing. This collection is exclusively tied to the recording and playback feature and is disclosed prominently in this policy. A dedicated pre-recording disclosure within the extension's user interface is planned product work and will be implemented before Chrome Web Store enforcement takes effect on 1 August 2026; it does not currently exist in the extension.
Cookies and Local Storage
The Progon web application and landing pages use browser storage technologies. Below we describe each technology, its purpose, and its retention duration. Note: under GDPR and similar data protection regulations, cookies, IP addresses, and similar online identifiers qualify as personal data where they can be linked to an identified or identifiable individual. Authentication tokens (localStorage, web application): access and refresh tokens are stored in the browser's localStorage under the keys "accessToken" and "refreshToken". These are strictly necessary to maintain your authenticated session. They are stored until you log out or until the token expires per its configured lifetime. No consent is required for strictly necessary storage. Language preference (localStorage, landing page): your selected language is stored under the key "progon.locale". This is a user-preference item that does not require consent. It is stored persistently with no set expiry. Theme and UI preferences (localStorage, web application): theme selection and other UI preferences are stored persistently with no set expiry. These fall within the user-preference exemption and do not require consent. OAuth session cookie: a first-party session cookie named "__Host-progon_oauth_as" is set by the Progon backend during the OAuth authorization flow. It is a session cookie and is deleted when you close your browser session. It is strictly necessary for the authorization flow. Google Fonts (third-party request, not a Progon-set cookie): when you use the Progon web application, your browser makes a request to Google's font servers (fonts.googleapis.com, fonts.gstatic.com). This may result in Google receiving your IP address and browser user agent. This is a third-party HTTP request, not a cookie set by Progon. We intend to self-host fonts in a future release to eliminate this request. You can remove any locally stored items or session cookies set by Progon at any time by clearing your browser's cookies and site data for progon.io in your browser settings, or by logging out of the Service. We do not use tracking cookies, advertising cookies, or analytics cookies. If we integrate analytics functionality in the future, we will update this section and obtain your consent before any analytics cookies or non-essential storage technologies are activated.
Your Rights
If you are located in the EU/EEA, you have the following rights under GDPR: • Right of access (Art. 15): request a copy of the personal data we hold about you. • Right to rectification (Art. 16): request correction of inaccurate or incomplete data. • Right to erasure (Art. 17): request deletion of your personal data, subject to legal retention obligations. • Right to restriction of processing (Art. 18): request that we restrict processing of your data in certain circumstances. • Right to data portability (Art. 20): request a machine-readable copy of the personal data you provided to us. • Right to object (Art. 21): object to processing based on legitimate interests. Where you exercise this right, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. Where processing is for direct marketing purposes, the right to object is absolute. • Right to withdraw consent (Art. 7(3)): where processing is based on consent, withdraw it at any time with effect for the future, without affecting the lawfulness of processing before withdrawal. • Right to lodge a complaint with a supervisory authority (Art. 77): lodge a complaint with a data protection authority in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. A list of EU supervisory authorities is available at edpb.europa.eu. If you are located in the Russian Federation or other CIS countries, you have the following rights under Federal Law No. 152-FZ and applicable local law: • Right to obtain information about the processing of your personal data. • Right to demand correction of inaccurate or incomplete personal data. • Right to withdraw consent to processing and to demand cessation of processing based on consent. • Right to demand erasure of personal data when processing purposes are achieved or consent is withdrawn and no other legal basis exists. • Right to obtain information about cross-border transfers of your personal data. • Right to lodge a complaint with the relevant supervisory authority: Roskomnadzor (Russian Federation, pd.rkn.gov.ru); Ministry of Digital Development, Innovation and Aerospace Industry of Kazakhstan — MDDIAI (Kazakhstan, mddiai.gov.kz); NPDPC (Belarus, cpd.by). How to exercise your rights: send a request to support@progon.io with sufficient information to verify your identity and describe your request. Under GDPR, we will respond within one month (Art. 12(3)). Under Russian Federal Law No. 152-FZ, requests for information and access to personal data are fulfilled within 10 business days (Art. 20); deletion and blocking requests are fulfilled within 30 calendar days (Art. 21). Under applicable Kazakhstani and Belarusian law, requests are fulfilled within 15 business days. We do not currently offer self-service deletion or export tools; all rights requests are handled manually.
Children's Privacy
The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected personal data from a child under 16, please contact us at support@progon.io and we will delete that data promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. The date at the top of this policy reflects when it was last revised. For material changes — meaning changes that affect the purposes for which we process your data, the categories of data we collect, the third parties we share data with, or your rights — we will provide at least 14 days' advance notice before the change takes effect. Notice will be sent by email to the address associated with your account and displayed as a notification within the Service. Where a material change requires your consent as a legal basis, we will seek your explicit, affirmative consent through a separate mechanism before beginning that processing. Continued use of the Service after receiving notice of a material change does not constitute consent to that change; implied or passive acceptance does not constitute valid consent under GDPR or applicable CIS law. Where a change does not materially affect your rights or our processing practices — for example, clarifying language or correcting factual errors — we may update the policy without prior notice. We encourage you to review this policy periodically. Versions of this policy are identified by their "Last updated" date. Prior versions are available upon request to support@progon.io.
Contact Us
For all privacy and data protection inquiries: support@progon.io We aim to respond to privacy inquiries within 5 business days. Controller identity: the Service is operated by Progon. No legal entity has been registered at the time of this policy. This section will be updated with the legal entity name and registered address upon incorporation. EU representative (GDPR Art. 27): not yet appointed. Will be appointed upon incorporation; contact details will be added here. Data Protection Officer: not appointed (not required at Progon's current scale and type of processing). Direct all data protection questions to support@progon.io. Person responsible for personal data processing (Russian Federation, Federal Law No. 152-FZ Art. 18.1): contactable at support@progon.io. A named responsible individual will be designated and disclosed here upon incorporation or upon a separate appointment decision.