Privacy Policy
On this page 17 sections
Effective date: 19 October 2026
Applies to: the Nject browser extension, the Nject web app and the websites nject.ai and prompt-copilot.ai (together, the "Service"). Nject was formerly called Prompt Copilot.
1. Who we are
The Service is operated by PROMPT COPILOT - FZCO, a free zone company with limited liability registered in the United Arab Emirates.
| Registration No. | 83033 |
| Trade Licence No. | 89798, issued by the Dubai Integrated Economic Zones Authority (DIEZA) |
| Registered address | IFZA Business Park, Dubai Digital Park, PO Box 342001, Dubai, United Arab Emirates |
| Corporate Tax TRN | 105585853200001 |
| Privacy contact | [email protected] (subject: "Privacy") |
We are the data controller for the personal data described in this policy. If you use Nject through a team or company workspace, your organisation is the controller for workspace content and we act as its processor.
2. The short version
- We collect what is needed to run Nject: your account, your copilots and profiles, the prompts you choose to enhance, and basic technical data.
- The extension reads a page only when you actively use an Nject feature on it. It does not record your browsing or your full AI conversations.
- We do not sell personal data, do not share it for advertising, and do not use your content to train AI models. Our AI and memory providers are contractually barred from training on it.
- You can export or delete your data at any time.
3. What we collect
3.1 Data you give us
| Category | Examples | Where it is stored |
|---|---|---|
| Account data | email address, name, profile picture and Google account ID if you sign in with Google | our servers |
| Copilots and context profiles | role, expertise, tone, instructions and any background you add to a copilot | our servers and your browser |
| Prompts and outputs | the text you submit for enhancement, the enhanced result, saved prompts, variables, folders | our servers |
| Memory | facts and preferences Nject keeps so your copilots stay consistent between sessions | our memory provider (section 6) |
| Billing data | plan, subscription status, invoices, country, tax ID if you provide one. Card numbers are handled by our payment processor and never reach us | payment processor and our servers |
| Support messages | emails and attachments you send us | our email provider |
3.2 Data collected automatically
| Category | Examples |
|---|---|
| Usage data | features used, clicks inside Nject, timestamps, extension version |
| Device and log data | browser type and version, operating system, language, IP address, error reports |
| Approximate location | country or region derived from IP address. We never collect precise location |
| Cookies | strictly necessary session and security cookies on our websites (section 11) |
3.3 What the extension does not do
- It does not read, store or transmit your conversations with AI tools, except the specific text you ask Nject to enhance or save.
- It does not collect passwords, payment details or form data from the sites you visit.
- It does not track your browsing history or the sites you visit.
- It does not run on a page unless that page is a supported AI tool or you invoke Nject on it.
3.4 Sensitive data
Nject is not designed for special categories of data (health, biometrics, religion, political opinions, sexual orientation, criminal records) or for other people's confidential information. Please do not put such data in prompts or copilots. If you do, we process it only to deliver the feature you used.
4. Why we use your data and our legal bases
| Purpose | Data used | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Provide the Service: accounts, copilots, prompt enhancement, sync, memory | account, copilots, prompts, memory | contract (Art. 6(1)(b)) |
| Process payments and send invoices | billing, account | contract; legal obligation (Art. 6(1)(c)) |
| Keep the Service secure, prevent abuse, debug errors | log, device, usage | legitimate interests (Art. 6(1)(f)) |
| Understand feature usage and improve the product, using aggregated or pseudonymised data | usage | legitimate interests |
| Send service messages (security, billing, changes to terms) | account | contract; legitimate interests |
| Send product news and offers | consent (Art. 6(1)(a)), withdrawable at any time via the unsubscribe link | |
| Comply with law and respond to lawful requests | as required | legal obligation |
Under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), we rely on your consent and on the contract, legal-obligation and legitimate-interest exceptions that correspond to the bases above.
No training on your content. We do not use your prompts, copilots, memory or outputs to train or fine-tune machine learning models, and we do not allow our providers to do so.
5. Artificial intelligence transparency
- Nject uses large language models, operated by third-party providers, to rewrite and enhance the prompts you submit. Enhanced prompts and other outputs are AI-generated and can be inaccurate. Review them before use.
- To produce a result we send the provider your prompt together with the relevant parts of the copilot you selected. We send only what the feature needs.
- We do not carry out automated decision-making that produces legal or similarly significant effects on you (GDPR Art. 22).
- Nject is not intended for the high-risk uses listed in Annex III of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), such as employment screening, credit scoring or law enforcement.
6. Who we share data with
We share personal data only with the service providers below, each bound by a written data processing agreement, and never for their own marketing.
| Provider | Role | Data | Location |
|---|---|---|---|
| Railway Corp. | application hosting and PostgreSQL database | all Service data | USA / EU |
| Cloudflare, Inc. | DNS, CDN, DDoS protection | IP address, request metadata | global |
| Google LLC | Sign in with Google (OAuth), company email | email, name, Google ID, support emails | USA / EU |
| Large language model API providers (current list available on request) | prompt enhancement | submitted prompt and relevant copilot context | USA / EU |
| Midbrain Inc. (midbrain.ai), Austin, Texas | memory infrastructure: stores and retrieves the long-term memory your copilots use | memory entries derived from your copilots and prompts, pseudonymous user ID | USA |
| Stripe, Inc. | payments, subscriptions, tax and fraud checks | billing data, email, IP address | USA / EU |
| Postmark (ActiveCampaign, LLC) | transactional email | email address, message content | USA |
| Sentry (Functional Software, Inc.) | error monitoring | error traces, device data, pseudonymous user ID | USA / EU |
You can request the current list of sub-processors, including the named language model providers, at [email protected]. We give at least 30 days' notice of a new sub-processor to business customers who ask to be notified.
We may also disclose data:
- to professional advisers, auditors and insurers under confidentiality;
- to a buyer, investor or successor (and their advisers, under confidentiality) in connection with a merger, acquisition, financing, reorganisation, or sale of all or part of our business or assets. Your data, including your account, copilots, prompts and memory, is one of the assets that passes to the successor, who then becomes the controller and must honour this policy until it gives you notice of a new one. We will tell you by email or in the Service before your data becomes subject to a different privacy policy, and you can delete your account before the transfer takes effect;
- to courts, regulators or law enforcement where the law requires it. We review each request and disclose the minimum necessary.
We do not sell personal data to data brokers or advertisers and do not share it for cross-context behavioural advertising. A transfer of the business as described above is not a sale of personal data.
7. Chrome Web Store and Google API disclosures
- The use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- In line with the Chrome Web Store User Data Policy, Nject uses your data only to provide and improve its single purpose (managing and enhancing prompts for AI tools). We do not sell it, do not use it for advertising or creditworthiness, and do not allow humans to read your content except with your permission, for security, to comply with law, or in aggregated and anonymised form for internal operations.
- Extension permissions are limited to supported AI websites and to local storage needed for your copilots and settings.
8. International transfers
We are established in the United Arab Emirates and use providers in the United States and the European Union, so your data is processed outside your country.
For data from the EEA, the United Kingdom and Switzerland we rely on:
- the European Commission's Standard Contractual Clauses (2021/914), with the UK International Data Transfer Addendum and Swiss amendments where relevant;
- the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. DPF, where the provider is certified;
- transfer impact assessments and supplementary measures such as encryption in transit and at rest.
Transfers out of the UAE follow PDPL Articles 22 and 23. You can request a copy of the relevant safeguards at [email protected].
9. How long we keep data
| Data | Retention |
|---|---|
| Account, copilots, saved prompts, memory | until you delete the item or your account |
| Prompt enhancement requests and outputs not saved by you | up to 30 days, for abuse prevention and debugging |
| Server and security logs | up to 90 days |
| Error reports | up to 90 days |
| Usage analytics | up to 24 months, then aggregated or deleted |
| Billing and tax records | 7 years from the end of the financial year, as UAE tax law requires |
| Support correspondence | 24 months after the ticket closes |
| Backups | overwritten within 35 days |
When you delete your account we erase or anonymise your personal data within 30 days, instruct our sub-processors (including the memory provider) to do the same, and keep only what the law obliges us to keep.
10. Security
We apply measures appropriate to the risk (GDPR Art. 32), including TLS encryption in transit, encryption at rest, least-privilege access with multi-factor authentication, secrets held in a dedicated secret manager, separation of production and test environments, dependency and vulnerability monitoring, and a documented incident response process. Staff and contractors are bound by confidentiality and security obligations.
No system is perfectly secure. If a breach is likely to result in a risk to your rights, we notify the competent authority within 72 hours where the law requires it and inform you without undue delay when the risk is high.
Report a vulnerability to [email protected] with the subject "Security".
11. Cookies and similar technologies
- Extension: no cookies. It uses browser extension storage for your settings, session and local copies of your copilots.
- Websites: strictly necessary cookies for sign-in, security and load balancing. We do not use advertising cookies or cross-site trackers.
- If we introduce analytics that are not strictly necessary, we will ask for your consent first where the law requires it.
- We honour the Global Privacy Control signal as a valid opt-out request.
12. Your rights
12.1 Everyone
Whatever your country, you can:
- access and export your data (in the app where available, or by email);
- correct your account and copilot data in the app;
- delete individual items or your whole account (in the app where available, or by email);
- unsubscribe from marketing email at any time.
12.2 EEA, United Kingdom and Switzerland
Under the GDPR, UK GDPR and the Swiss Federal Act on Data Protection you have the right to access, rectification, erasure, restriction, data portability, to object to processing based on legitimate interests, to withdraw consent at any time, and not to be subject to solely automated decisions with legal or similar effects. You may lodge a complaint with your local supervisory authority (for example the ICO in the UK or the FDPIC in Switzerland). We respond within one month, extendable by two months for complex requests.
EU and UK representative. Where Article 27 GDPR or UK GDPR requires us to appoint a representative, we will publish their contact details in this section. Until then, contact us directly at [email protected].
12.3 United Arab Emirates
Under the PDPL you have the right to obtain information, to request transfer of your data, to correction and erasure, to restrict or stop processing, and to object to automated processing. You may complain to the UAE Data Office.
12.4 United States
Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Nebraska, Maryland, Minnesota, Rhode Island, Indiana, Kentucky and other states with comprehensive privacy laws have, subject to each law's thresholds, the right to know, access, correct, delete and port their personal information, to opt out of sale, sharing, targeted advertising and significant profiling (we do none of these), to limit the use of sensitive personal information (we do not use it for inferences), to appeal a refused request, and not to be discriminated against for exercising these rights.
California notice at collection (CCPA/CPRA). In the past 12 months we collected: identifiers (email, name, IP address, account ID); commercial information (subscription and transaction history); internet or network activity (usage of the Service); approximate geolocation; and user content (prompts, copilots, memory). Sources: you and your device. Purposes: section 4. Recipients: the service providers in section 6. We have not sold or shared personal information. Retention: section 9. You may use an authorised agent with written proof of authority. We respond within 45 days, extendable once by 45 days.
12.5 How to make a request
Email [email protected] with the subject "Privacy request", from the email address on your account, and tell us your country or state and what you are asking for. We may ask for information to verify your identity and will use it for nothing else. Requests are free unless manifestly unfounded or excessive. To appeal a decision, reply to our response with "Appeal" in the subject line.
13. Children
Nject is not directed to children. You must be at least 16 to use it (or the higher age of digital consent in your country), and at least 18 to buy a subscription. We do not knowingly collect data from children under 13 (COPPA) or under the applicable age of consent. If you believe a child has given us data, contact us and we will delete it.
14. Third-party sites and AI tools
Nject works alongside AI tools such as ChatGPT, Claude and Gemini. When you send a prompt to one of those tools, that provider processes it under its own privacy policy. We are not responsible for their practices.
15. Data Protection Officer
We are not required to appoint a Data Protection Officer under Article 37 GDPR or the PDPL given the nature and scale of our processing. Privacy matters are handled by our General Manager at [email protected].
16. Changes to this policy
We will post any change here and update the effective date. For material changes we give at least 14 days' notice by email or inside the Service before they take effect. Earlier versions are available on request.
17. Contact
PROMPT COPILOT - FZCO IFZA Business Park, Dubai Digital Park, PO Box 342001, Dubai, United Arab Emirates Email: [email protected]
© 2026 PROMPT COPILOT - FZCO. All rights reserved.