Privacy Policy

Last updated: October 6, 2026 · Effective October 6, 2026 for new accounts and November 5, 2026 for accounts created before October 6, 2026

1. Who We Are and Scope

1.1. This Privacy Policy explains how ALCO GROUP LLC, a Wyoming (United States) limited liability company with its address for legal notices at 30 N Gould St, Sheridan, WY 82801, USA, doing business as Prosabe and formerly as Optimo Education ("Prosabe", "we", "us"), collects, uses, shares and protects personal information when you use prosabe.com, optimoeducation.com, the Prosabe web application, the Prosabe WhatsApp assistant, our API and related services and digital products (the "Service").

1.2. Our roles.

• Controller. We are the controller (or "business", "responsable" or "responsable del tratamiento", depending on the law) of the personal information we process to provide and manage accounts, billing, security, support, our websites and our own communications.
• Processor. When a business customer uses Prosabe, the personal information its users and Members put into SOPs, comments, images, questions and other content ("Customer Content") is processed by us on behalf of that customer, which is the controller. That processing is governed by our agreement with the customer and our Data Processing Agreement. If you are a Member of a customer's team and have questions about how that customer uses your information, please contact the customer directly; we will assist them in responding.

1.3. Capitalized terms not defined here have the meaning given in our Terms of Service.

2. Information We Collect

2.1 Information you provide

Category	Examples
Account information	Name, email address, password (stored only as a secure hash by our authentication provider), language and interface preferences.
Company profile	Company name, industry, country and city, team size, business description, business model, operation type, departments, preferred document language and documentation style.
Team information	Email addresses and names of people you invite, their roles (owner, editor, viewer), invitation status and areas of responsibility.
Customer Content	SOPs and their versions, templates, areas, comments, images and files in your media library, business analyses, and the questions you ask the operational assistant. Customer Content may include personal information about you, your Members or other people, depending on what you choose to include.
AI chat and prompts	Messages you send to the AI features, the company context we attach to them so the AI can answer, and the responses generated.
WhatsApp assistant	Phone numbers registered by the Account Owner, WhatsApp profile name, message content, timestamps and delivery status.
Billing information	Plan, billing frequency, subscription status and history, and the identifiers Stripe gives us. Card details and billing address are collected and stored by Stripe, not by us.
Communications	Emails and messages you send us, support requests, contact-form submissions, and newsletter or guide sign-ups (name and email).
Digital product purchases	Email address, purchase details and download records for ebooks or other digital products.
API	Names you give API keys and a hashed version of each key (we do not store API keys in readable form).

2.2 Information collected automatically

Category	Examples
Usage data	AI usage consumed (tokens), storage used, features used, actions such as creating, editing, approving or sharing SOPs, and dates and times of those actions.
Security and audit logs	Records of security-relevant actions (such as API access and API key creation or revocation), including the IP address from which they were made.
Device and connection data	IP address, browser type and version, operating system, device type, referring URLs and similar information recorded in the server logs of our hosting and infrastructure providers.
Local storage and cookies	Session tokens that keep you signed in and small preference values (such as a pending plan choice). See our Cookie Policy. We do not use advertising or cross-site tracking cookies.

2.3 Information from third parties

• Your organization, when an Account Owner invites you to a team or registers your phone number for the WhatsApp assistant.
• Stripe, which tells us whether a payment succeeded and gives us subscription identifiers and status.
• Twilio and WhatsApp, which deliver your WhatsApp messages to us together with your phone number and profile name.

2.4 Sensitive information

We do not ask for sensitive personal information (such as health data, government ID numbers, racial or ethnic origin, religious beliefs, sexual orientation, biometric data or precise geolocation), and our Terms ask you not to include it in Customer Content unless strictly necessary. Your account password is "sensitive personal information" under some U.S. state laws; we use it only to authenticate you.

3. How We Use Information and Legal Bases

We use personal information only for the purposes below. Where the GDPR, UK GDPR, LGPD or similar laws apply, we rely on the legal bases indicated.

Purpose	Legal basis
Create and manage your account, authenticate you and provide the Service, including storing, versioning, sharing and exporting SOPs, team collaboration and the WhatsApp assistant	Performance of a contract
Generate AI responses, SOPs, edits, imports and analyses that you request	Performance of a contract
Process payments, manage subscriptions, send receipts and renewal reminders, and handle refunds	Performance of a contract; legal obligation
Measure and enforce plan limits (AI usage and storage)	Performance of a contract; legitimate interests in fair use
Send transactional messages (account confirmation, password reset, team invitations, security and service notices, changes to our terms)	Performance of a contract; legal obligation
Provide customer support and respond to requests	Performance of a contract; legitimate interests
Secure the Service, detect and prevent fraud, abuse and security incidents, maintain logs and backups	Legitimate interests in protecting our users and the Service; legal obligation
Maintain and improve the Service using aggregated and de-identified usage statistics	Legitimate interests
Send newsletters, guides and product news to people who signed up for them or are existing customers (you can unsubscribe at any time)	Consent, or legitimate interests where permitted for existing customers
Comply with legal obligations, respond to lawful requests from authorities, and establish, exercise or defend legal claims	Legal obligation; legitimate interests

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms; you can object as described in Section 10. Where we rely on consent, you can withdraw it at any time without affecting processing carried out before.

We do not use personal information or Customer Content for targeted or cross-context behavioral advertising, we do not sell it, and we do not use it to train AI models.

4. Artificial Intelligence

4.1. How the AI features work. When you use the SOP chat, the operational assistant, AI editing, document import, business analysis, team intelligence or the WhatsApp assistant, the content needed for your request is sent to our AI model provider, Anthropic PBC (United States), and, for the SOP chat and WhatsApp assistant, through our workflow automation provider n8n (n8n GmbH, Germany). Depending on the feature, this may include your message, relevant SOPs, your company profile, previous messages in the conversation, and your name.

4.2. No training. Under Anthropic's commercial terms, data sent through its API is not used to train its models and is retained by Anthropic only for a limited period for trust-and-safety purposes before deletion. We do not use your Customer Content to train any AI model.

4.3. No automated decisions with legal effects. We do not use AI or other automated processing to make decisions about you that produce legal or similarly significant effects. AI Output is a draft for human review.

4.4. Transparency. Responses produced by the AI features are generated automatically by artificial intelligence. They may be inaccurate and should be reviewed by a person before you rely on them.

5. How We Share Information

5.1. Service providers (subprocessors). We share personal information with the following providers, only as needed to provide the Service and under written agreements that require them to protect it and use it only on our instructions:

Provider	Purpose	Location
Supabase, Inc.	Database, authentication, file storage and server functions	United States (and other regions where our project is hosted)
Anthropic PBC	AI language models	United States
n8n GmbH	Workflow automation for the SOP chat and WhatsApp assistant	European Union (Germany)
Twilio Inc.	WhatsApp message delivery	United States
WhatsApp LLC / Meta Platforms	WhatsApp messaging channel	United States / Ireland
Stripe, Inc.	Payment processing and subscription management	United States
Sendinblue SAS (Brevo)	Transactional and newsletter email delivery	European Union (France)
Hostinger International Ltd.	Website hosting and server-side scripts	European Union / United States
Google LLC (Google Fonts) and unpkg	Delivery of fonts and icons used by our web pages (receive your IP address and browser information when the page loads)	United States / global CDN

The current list of subprocessors that process Customer Content is maintained in our DPA.

5.2. Within your organization. Content you create in a team workspace is visible to the Account Owner and other Members according to their roles. Account Owners can see Members' names, emails, roles and activity related to shared content.

5.3. Public links. If you create a public link or QR code for an SOP, anyone with that link can view the SOP's content.

5.4. Legal and safety. We may disclose information if we believe in good faith it is required by law, subpoena, court order or other legal process; to respond to lawful requests by public authorities, including to meet national security or law enforcement requirements; or to protect the rights, property or safety of Prosabe, our users or others, including to prevent fraud or security incidents. Where legally permitted, we will notify the affected customer before disclosing Customer Content.

5.5. Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, personal information may be transferred as part of that transaction, subject to this Privacy Policy or a notice to you.

5.6. Professional advisers. We may share information with our lawyers, accountants, auditors and insurers under confidentiality obligations, where needed for those services.

5.7. With your consent or at your direction, for example when you share content with someone or connect an integration.

6. International Data Transfers

We are based in the United States and our providers operate in the United States, the European Union and other countries. If you are located elsewhere, your information will be transferred to and processed in countries whose data protection laws may differ from those of your country. Where required, we protect these transfers with appropriate safeguards, including the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the standard contractual clauses approved by Brazil's ANPD, adequacy decisions or the EU-U.S. Data Privacy Framework where our provider is certified, contractual commitments with our providers, or other mechanisms permitted by applicable law (such as transfers necessary to perform our contract with you). You may request a copy of the relevant safeguards by writing to privacy@prosabe.com.

7. Data Retention

We keep personal information only for as long as necessary for the purposes described in this policy, unless a longer period is required or permitted by law.

Data	Retention
Account, company profile and Customer Content	While your account is active. When you delete your account (Settings → Delete account) it is removed from our production systems immediately; residual copies in backups are deleted within 90 days. After a termination for non-deletion reasons, you may request an export for 30 days.
Team invitations	Until accepted, revoked or replaced; accepted invitations are kept as long as the membership exists.
AI requests sent to providers	Processed transiently to generate the response. Anthropic retains API data only for a limited period under its commercial terms. Workflow execution records at n8n are kept for up to 30 days.
WhatsApp messages	Conversation records are kept while the Account Owner's account is active and the number remains registered; Twilio and WhatsApp retain delivery records according to their own policies.
Billing records	Up to 7 years after the transaction, to comply with tax and accounting obligations.
Security and audit logs (including IP addresses)	Up to 24 months, or until you delete your account, whichever is earlier.
Support and communications	Up to 3 years after the matter is closed.
Newsletter subscriptions	Until you unsubscribe; we then keep your email on a suppression list so we do not email you again.
Inactive free accounts	May be deleted after 12 months of inactivity, following at least 30 days' notice.

8. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit (HTTPS/TLS); encryption at rest provided by our infrastructure providers; database row-level security policies that restrict each user to the data they are authorized to access; hashing of passwords and API keys; role-based access within teams; server-side verification of sessions for AI features; limits on the content returned through public links; restricted administrative access; and payment processing through PCI DSS-compliant Stripe. No system is completely secure; if we become aware of a personal data breach affecting you, we will notify you and the competent authorities as required by law.

9. Your Choices

• Account and content. You can view, edit, export (Word/PDF) and delete your SOPs and update your profile in the Service at any time, and delete your account from Settings.
• Emails. You can unsubscribe from newsletters and marketing emails using the link in each email. We will still send you transactional and legal messages while you have an account.
• WhatsApp. Ask your Account Owner, or write to support@prosabe.com, to remove your phone number from the WhatsApp assistant.
• Cookies. See our Cookie Policy.
• Global Privacy Control. We do not sell or share personal information for targeted advertising, so there is nothing to opt out of; we nevertheless treat a Global Privacy Control signal as a valid opt-out request where the law requires it.

10. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights. To exercise them, email privacy@prosabe.com from the email address associated with your account (or provide enough information for us to verify your identity). We will respond within the period required by the applicable law and will not discriminate against you for exercising your rights. If your request concerns Customer Content controlled by a business customer, we will forward it to that customer. You may use an authorized agent where the law allows; we may ask the agent for proof of authorization and ask you to verify your identity.

10.1 European Economic Area, United Kingdom and Switzerland

You have the right to access your personal data; to rectification; to erasure; to restriction of processing; to data portability; to object to processing based on legitimate interests (including profiling) and to direct marketing at any time; to withdraw consent at any time; and not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We respond within one month, extendable by two further months for complex requests. You have the right to lodge a complaint with the data protection supervisory authority of your habitual residence, place of work or place of the alleged infringement.

10.2 United States

California. If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), gives you the right to know the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes, and the categories of third parties to whom we disclose it; to delete; to correct; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. Notice at collection and disclosures for the preceding 12 months:

CCPA category	Examples	Disclosed for a business purpose to
Identifiers	Name, email, phone number (WhatsApp), IP address, account and subscription identifiers	Service providers listed in Section 5.1
Customer records	Name, email, billing identifiers	Stripe, Supabase, Brevo
Commercial information	Plans purchased, subscription and payment history	Stripe, Supabase
Internet or electronic network activity	Usage data, logs, browser and device information	Supabase, Hostinger, Google Fonts, unpkg
Professional or employment-related information	Company, role and area of responsibility within your organization	Supabase, Anthropic, n8n
Sensitive personal information	Account log-in credentials (password, stored as a hash)	Supabase (authentication only)
Other information you include in Customer Content	Depends on what you include	Supabase, Anthropic, n8n, Twilio/WhatsApp

Sources: you, your organization, our payment and messaging providers, and automatic collection. Purposes: those described in Section 3. Retention: Section 7. We do not sell or share personal information (as those terms are defined in the CCPA) and have not done so in the past 12 months, including about consumers under 16. We use sensitive personal information only for purposes permitted by the CCPA, so the right to limit does not apply. California residents may also request information about disclosures of personal information to third parties for their direct marketing purposes under California Civil Code § 1798.83; we make no such disclosures.

Other U.S. states. Residents of states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) may have the right to confirm whether we process their personal data and to access, correct, delete and obtain a portable copy of it, and to opt out of targeted advertising, the sale of personal data and profiling in furtherance of decisions with legal or similarly significant effects. We do not engage in targeted advertising, sales of personal data or such profiling. If we deny your request, you may appeal by replying to our response with the subject line "Appeal" within 60 days; we will respond within the period required by law, and if the appeal is denied you may contact your state Attorney General.

10.3 Latin America

Mexico. Under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares, you may exercise your rights of access, rectification, cancellation and opposition (ARCO rights), revoke your consent, and limit the use or disclosure of your data, by sending a request to privacy@prosabe.com with your name, the data concerned, a description of the request and a copy of an identification document or proof of authority of your representative. We will respond within 20 business days and, if the request is granted, implement it within 15 business days following our response. The purposes in Section 3 relating to newsletters and product news are secondary purposes that are not necessary for the Service; you may object to them at any time by unsubscribing or writing to us. We will notify you of changes to this notice as described in Section 13. You may file complaints with the competent federal data protection authority.

Chile. You have the rights granted by Law No. 19,628 on the Protection of Private Life and, from its entry into force, Law No. 21,719, including the rights of access, rectification, deletion (supresión), objection, portability and blocking, and you may lodge complaints with the competent authority (the Agencia de Protección de Datos Personales, once operational).

Argentina. You may exercise your rights of access (free of charge at intervals of not less than six months, unless a legitimate interest is shown), rectification, updating and deletion under Law No. 25,326. THE AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, IN ITS CAPACITY AS THE CONTROL BODY OF LAW No. 25,326, HAS THE AUTHORITY TO HEAR COMPLAINTS AND CLAIMS FILED BY THOSE WHOSE RIGHTS ARE AFFECTED BY NON-COMPLIANCE WITH THE RULES IN FORCE ON THE PROTECTION OF PERSONAL DATA.

Colombia. Under Law 1581 of 2012 and its regulations, you have the right to know, update and rectify your data, request proof of your authorization, be informed about the use of your data, revoke your authorization or request deletion where appropriate, access your data free of charge, and file complaints with the Superintendencia de Industria y Comercio after exhausting the request procedure with us. Queries are answered within 10 business days and claims within 15 business days, extendable as provided by law. This policy constitutes our data processing policy for Colombian data subjects.

Peru. You may exercise your rights of information, access, rectification, cancellation and objection under Law No. 29733 and its regulations, and you may file claims with the Autoridad Nacional de Protección de Datos Personales.

Brazil. Under the Lei Geral de Proteção de Dados (LGPD), you have the rights listed in Article 18, including confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, information about sharing, information about the possibility of not consenting and its consequences, and revocation of consent. You may file complaints with the Autoridade Nacional de Proteção de Dados (ANPD). Our channel for data subjects and the ANPD is privacy@prosabe.com.

Other countries. If you live in another country, you have the rights granted by your local law, and you may exercise them through the same channel.

11. Children

The Service is intended for adults and businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact privacy@prosabe.com and we will delete it.

12. Third-Party Links and Services

The Service may link to or integrate with third-party websites and services (for example, Stripe's billing portal or WhatsApp). Their privacy practices are governed by their own policies, which we encourage you to read.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice in the Service at least 30 days before they take effect, and where the law requires your consent to a new purpose, we will ask for it. The date at the top of this page shows when the policy was last updated.

14. Contact

ALCO GROUP LLC — Prosabe
Address: 30 N Gould St, Sheridan, WY 82801, USA
Privacy requests and questions: privacy@prosabe.com
General support: support@prosabe.com