Privacy Policy

Last updated 26 October 2026

On this page

Who is responsible
What we collect
Legal bases (GDPR)
Google user data
AI agents
Who we share it with
Where it is kept
How long we keep it
How we protect it
Your rights
Children
Changes
Contact

This policy explains how Tech Mage (Pty) Ltd ("Tech Mage", "we") handles personal information in Prubex. It covers South Africa's Protection of Personal Information Act (POPIA) and the EU and UK General Data Protection Regulation (GDPR).

The short version: Prubex passes your mail and calendar data through rather than storing it, no one at Tech Mage reads it unless you ask us to look at a specific item, or it is needed to keep the service secure or to meet the law, and we never sell it or use it to train AI models.

Who is responsible

For your Prubex account (your sign-in, workspace, billing state and how you use Prubex), Tech Mage is the responsible party under POPIA and the controller under the GDPR.
For the mail, calendars and contacts in the accounts you connect, we act on your instructions: we are your operator (POPIA) or processor (GDPR). If you connect mailboxes for an organisation, the Data Processing Addendum applies.

Information Officer: Andre Trollip, reachable at hello@prubex.com.

What we collect

What	Examples	Why
Account	Name, email address, sign-in method, passkey and two-factor settings	To sign you in and secure your account
Sessions and sign-ins	IP address and device (browser and system) of each sign-in, kept with the session	Security: to show you where you are signed in and warn you of new sign-ins
Workspace	Workspace name and time zone, members and roles, invitations	To run your workspace
Connected accounts	Provider, email address, display name, granted scopes, connection status, and the encrypted credential Prubex uses to reach the account	To reach the account when you or your agents ask
Rules and keys	Account policies, recipient lists, API keys (stored only as a keyed hash), connected apps	To apply your rules to every request
Activity records	Which tool or route was called, by which key or app, on which account, when, with what outcome; never message bodies	Your audit log, usage figures and abuse prevention
Content held for you	A send waiting for your approval (encrypted), and files you upload to attach	So you can review a send before it goes, and so agents can attach files
Billing	Plan, number of billed accounts, Paddle customer and subscription ids	To bill you through Paddle
Emails	Your email preferences and whether you agreed to product news	To send account email, and marketing email only if you agreed
Website analytics	Pages visited and events, through Google Analytics, only if you allow analytics cookies	To understand how the site is used
Support	What you write to hello@prubex.com	To help you

Mail and calendar content is fetched from your provider when you or your agent asks, passed on in the response, and not stored, except for the approvals and uploads above. Prubex never permanently deletes mail or calendars.

Contract: to provide Prubex, including everything your agents ask for within your rules.
Legitimate interests: security, preventing abuse, keeping the service reliable, and measuring usage in aggregate.
Consent: analytics cookies and marketing email. You can withdraw consent at any time.
Legal obligation: records we must keep by law.

Under POPIA we process personal information for these same purposes, lawfully and only as far as they need.

Google user data

Prubex’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data from Gmail and Google Calendar is used only to provide the features you use in Prubex: it is fetched when you or an agent you authorised asks, and passed to that agent. It is not used for advertising, not sold, not used to develop or train generalised AI or machine-learning models, and not read by any person at Tech Mage unless you ask us to look at a specific item, it is needed for security or to meet the law.

AI agents

Prubex itself never sends the data in your connected accounts to an AI service. That data goes only to the AI agents and apps that you connect to Prubex and authorise, such as Claude or ChatGPT. Their own terms and privacy policies apply to what they do with it.

Support email is different. What you write to hello@prubex.com is handled with the help of an AI assistant (Anthropic's Claude), and the mailbox is in Microsoft 365. Both are on our Subprocessors page. Don't send mailbox content or secrets to support.

We share personal information only with the service providers listed on our Subprocessors page (Microsoft Azure for hosting and email, Microsoft 365 and Anthropic for support email, Paddle for billing, Google Analytics for website analytics with your consent), with the providers you connect (to reach your accounts), when the law requires it, or with a buyer of the business that runs Prubex, who must keep this policy's promises. We never sell personal information.

Where it is kept

Prubex runs on Microsoft Azure in South Africa (the South Africa North region); our database, files and logs are kept there, and email we send goes through Azure Communication Services with its data held in Africa. Paddle and Google process data in their own locations under their own safeguards. When personal information leaves South Africa or the European Economic Area, we rely on adequate protection or contractual safeguards, such as the EU Standard Contractual Clauses, as POPIA (section 72) and the GDPR require.

How long we keep it

Data	Kept
Message and event content	Not stored; passed through on each request
A send waiting for approval	Until it is approved, rejected or expires, plus 7 days; then deleted
Uploaded files	24 hours, or with a held send until it is decided (deleted within 9 days at most)
Activity records (audit detail)	30 days on the free plan, 90 days on paid plans; daily usage totals are kept
Sessions and their sign-in details	Until the session ends or expires (30 days after last use)
Credentials for a connected account	Deleted as soon as you disconnect it
A deleted workspace	Access at each provider revoked at once; the rest deleted within 30 days
Your account, once deleted	Deleted, apart from what the law requires us to keep
Billing records	As long as tax and company law require (Paddle keeps invoices)
Website logs	30 days

How we protect it

Credentials for your connected accounts are encrypted with AES-256-GCM under keys held in Azure Key Vault. API keys are stored only as keyed hashes. Connections use TLS, sign-in can use passkeys and two-factor authentication, and staff access follows least privilege. More on our Security page.

Your rights

You can ask to see, correct or delete your personal information, object to or restrict how we use it, and receive a copy to take elsewhere. Much of this you can do yourself:

Export your data: Settings → Profile → Export my data (a JSON file).
Delete your account or a workspace: Settings → Profile (account) or Settings → Workspace.
Disconnect an account or revoke an app or key: in the dashboard, at any time.
Marketing email: unsubscribe from the link in any such email, or in Settings → Notifications.
Analytics cookies: change your choice with "Cookie settings" in the site footer.

For anything else, email hello@prubex.com. We answer within 30 days. If you are not satisfied, you may complain to South Africa's Information Regulator (inforegulator.org.za) or, in the EU or UK, to your data protection authority.