1. Introduction
Prael is an AI personal assistant, built by Prael Inc., that works inside the messaging apps you already use, including iMessage, SMS, WhatsApp, and Telegram. Prael Inc. is a Delaware-incorporated fintech company with its office at 44, Wall Street, Suite 502, New York, NY 10005, USA. With Prael, you prompt it in plain language, while Prael will research, answer questions, and perform any task as you may direct it, ranging from shopping and checkout, paying bills, travel and restaurant bookings, food orders, managing subscriptions and refunds, scheduling appointments, sorting your inbox, and sending reminders.
This Privacy Notice (the “Notice”) guides your use of our Website and related services (together, the “Services”) and your rights regarding our collection, use, storage, and protection of your personal data when you visit, access, browse through, and/or use our Website or Services.
We may share your personal data with service providers, their affiliates, and partner financial institutions to facilitate various tasks such as processing bookings and completing orders as instructed by you. “Personal data” means any information about an individual that can directly or indirectly identify that person. In connection with the services we provide and the functionalities available on Prael, we collect the following personal data from you while you use Prael. We will ask you to provide certain personal data to contact or identify you, and we will collect some automatically for our Website to function effectively. We also collect personal data when you provide feedback and/or report a problem. We do not consider anonymised information that does not identify a specific user to be personal data.
2. Personal Data We Obtain
2.1. The personal data we obtain includes
- Full name: to identify the user and to fill in the bookings and orders they request.
- Mobile phone number: to create the account, sign the user in with a one-time authentication code, and contact them via SMS or iMessage.
- Messaging identifiers (WhatsApp or Telegram ID): to deliver the service on the channel the user picks.
- Message content, files, and photos the user sends: to understand and carry out their requests.
- Email address (optional): for bookings, receipts, and order confirmations.
- Shipping and delivery addresses: to deliver orders the user places.
- Timezone and preferences, such as dietary needs, home airport, or saved memories: to personalise help and schedule reminders correctly.
- Billing and payment information: wallet deposits in USDC on the Polygon network, transaction history, and cards saved in the vault. This is used to pay merchants for purchases the user approves.
- Saved sign-ins for third-party sites (optional): kept in an encrypted vault so the assistant can sign in for the user.
- Connected app data (optional: Gmail, Google Calendar, Slack, Notion, Linear, etc.): read and acted on only to perform the tasks the user asks for.
- Forwarded emails: to read things like sign-in codes or bookings that the user sends to their Prael address.
- Approvals and decisions: to record the user’s consent to each action.
- Customer support interactions: to resolve issues and improve the service.
- Friends: names and emails (when the user invites someone): only to send them an invitation.
2.2. The personal data we automatically collect includes
- Usage and session logs (timestamps, channel used, actions taken, errors): to operate the service, debug problems, and prevent abuse.
- Approximate location from timezone or IP: to show the right times and local results.
- One-time sign-in codes: these match the site you’re signing into, fill in automatically, and are never shown to the AI.
3. Lawful Bases for Processing Data
We will only process your personal data where we can rely on at least one of the following lawful bases:
- Legitimate interest: Processing is necessary for our or third-party legitimate interests except where such interests are overridden by your interests or fundamental rights and freedoms.
- Consent: You have given explicit consent for us to process your data for a specific purpose.
- Contract: Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into a contract.
- Legal obligation: If the processing of your data is necessary where there is a statutory obligation on us.
4. Purpose of Processing Your Data and the Lawful Basis
| Purpose of Processing | Legal Basis for Processing |
|---|---|
| Legitimate interest; Performance of a Contract |
| Legitimate interest; Consent. |
| Legal obligation; Legitimate Interest |
| Performance of a Contract |
| Legal obligation; Performance of a Contract |
| Legal obligation |
5. Your Rights as a Data Subject
The law vests you with certain rights as a data subject. They include the right to:
- Access personal data we hold about you by requesting a copy of the personal data we hold about you;
- Rectify such information where you believe it to be inaccurate;
- Restrict the processing of your data in certain circumstances;
- Object to the processing of your data where we intend to process such data for marketing purposes;
- Where feasible, receive all personal data you have provided to us—in a structured, commonly used, and machine-readable format—and transmit the information to another data controller;
- Request the erasure of your data (also known as the right to be forgotten);
- Withdraw your consent to the processing of your personal data;
- Lodge a complaint with a relevant Supervisory Authority relevant to your jurisdiction, where you have reason to believe that we have violated the term(s) of this Privacy Notice. You may raise concerns with us directly at any time; this does not limit your right to lodge a complaint with a competent supervisory authority, which is not subject to any time limit.
- Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, and to request human intervention, express your point of view, and contest the decision.
5.1. Standard Notice to Address Grievance (SNAG)
For customers in Nigeria, you have the right to issue a SNAG to us if you believe we have violated your right to privacy. A SNAG may be served by you personally or by your representative. It may be delivered to us by telephone message, e-mail address, at our office, 2 The Rock Drive, Lekki Phase 1, Lagos, or by any other means of correspondence of your choice. When you issue a SNAG, we will communicate our decision to you and to the NDPC through the NDPC’s designated portal. Please note that a SNAG is not a condition precedent to filing a complaint with the NDPC.
6. California Privacy Rights (CCPA Clause)
California residents have the right to request:
- The categories and specific pieces of personal information we collect;
- The categories of sources of personal information;
- The purpose for collecting personal information;
- The categories of third parties with whom we share personal information;
- Deletion of their personal data.
- California residents also have the right to correct inaccurate personal information, and the right to opt out of the sale or sharing of their personal information (“Do Not Sell or Share My Personal Information”).
To exercise these rights, contact our Data Protection Officer at dpo@prael.ai with the subject line: “California Privacy Request” or contact support@prael.ai.
You may seek to exercise any of the above rights at any time by sending an email to us at: support@prael.ai or to our Data Protection Officer at dpo@prael.ai. Depending on your location, you may lodge a complaint to the relevant supervisory authority, which may include: the Federal Trade Commission (FTC) for US residents; the Nigeria Data Protection Commission (NDPC) for Nigerian residents; or the Supervisory Authority in the European Union and other applicable authorities depending on your jurisdiction.
8. Retention of Your Data
The data and any other information we collect from you will be stored for as long as necessary to fulfil the purposes described in this Notice. However, we will retain personal data to comply with relevant provisions of applicable laws in order to resolve disputes, prevent fraud and abuse, and enforce our legal agreements and policies. For instance, data relating to identity verification (KYC) and transaction records are retained for seven (7) years after account closure to comply with anti-money laundering obligations, while data collected for marketing purposes is deleted once you unsubscribe.
Please note that we may keep your data longer than requested if a legal requirement requires it.
9. How Data Is Stored and Secured
We take your privacy and data protection very seriously. We deploy reasonable and appropriate technical and organisational measures to keep your data safe. However, we cannot completely guarantee the security of any information you transmit via our website, as the internet is not entirely secure. Nevertheless, we are committed to doing our best to protect you. We protect your data using physical, technical, and administrative security measures to reduce the risks of loss, misuse, unauthorised access, disclosure and alteration. Where there is an actual or suspected data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in accordance with applicable law. We will also notify the competent supervisory authority where required.
10. Services to Minors
Our Services are not directed to, and we do not knowingly collect personal data from, individuals under 18. If we become aware that we have collected personal data from a minor, we will take steps to delete such information.
12. International Transfer of Data
To achieve the purposes described in this Notice, we may transfer your data to foreign countries. We will take additional precautions to ensure the adequate protection of personal information when transferring it to a country other than where we operate. We comply with applicable local laws and regulations in the countries where we operate when conducting international data transfers. This includes transferring data to countries deemed adequate under applicable laws, obtaining licences or approvals from the relevant authority, maintaining appropriate documentation, obtaining explicit consent, and performing contractual obligations.
Where we transfer personal data outside of your country of residence, we rely on one or more of the following legally recognised safeguards: (i) Adequacy decision (ii) the EU-US Data Privacy Framework; (iii) Standard Contractual Clauses approved by the European Commission; or (iv) other lawful transfer mechanisms applicable in your jurisdiction.
You may request that we not transfer your personal data to certain jurisdictions, unless the transfer is required to provide our services or fulfil legal obligations. If you prefer your data not be transferred outside of your home country for non-operational purposes (such as third-party integrations), please contact support@prael.ai. We will honour your request to the extent possible without disrupting service delivery or violating regulatory requirements.
13. Changes to This Notice
We update our privacy notice occasionally. We will notify our users when we make a change, and visitors will know this by checking the last date of the update on this page whenever they visit.
14. Contact Information
Questions about this Notice or your personal data? Contact us at support@prael.ai or our Data Protection Officer at dpo@prael.ai.
Prael Inc.
44, Wall Street, Suite 502
New York, NY 10005, USA