Privacy Policy
On this page 17 sections
Effective date: 19 October 2026
Applies to: the Nject browser extension, the Nject web app and the websites nject.ai and prompt-copilot.ai (together, the "Service"). Nject was formerly called Prompt Copilot.
1. Who we are
The Service is operated by PROMPT COPILOT - FZCO, a free zone company with limited liability registered in the United Arab Emirates.
| Registration No. | 83033 |
| Trade Licence No. | 89798, issued by the Dubai Integrated Economic Zones Authority (DIEZA) |
| Registered address | IFZA Business Park, Dubai Digital Park, PO Box 342001, Dubai, United Arab Emirates |
| Corporate Tax TRN | 105585853200001 |
| Privacy contact | [email protected] (subject: "Privacy") |
We are the data controller for the personal data described in this policy. If you use Nject through a team or company workspace, your organisation is the controller for workspace content and we act as its processor.
2. The short version
- We collect what is needed to run Nject: your account, your copilots and profiles, the prompts you choose to enhance, and basic technical data.
- The extension reads a page only when you actively use an Nject feature on it. It does not record your browsing or your full AI conversations.
- We do not sell personal data and do not use your content to train AI models. Our AI and memory providers are contractually barred from training on it. Our websites measure our ads with Meta only if you allow marketing cookies.
- You can export or delete your data at any time.
3. What we collect
3.1 Data you give us
| Category | Examples | Where it is stored |
|---|---|---|
| Account data | email address, name, profile picture and Google account ID if you sign in with Google | our servers |
| Copilots and context profiles | role, expertise, tone, instructions and any background you add to a copilot | our servers and your browser |
| Prompts and outputs | the text you submit for enhancement, the enhanced result, saved prompts, variables, folders | our servers |
| Memory | facts and preferences Nject keeps so your copilots stay consistent between sessions | our memory provider (section 6) |
| Billing data | plan, subscription status, invoices, country, tax ID if you provide one. Card numbers are handled by our payment processor and never reach us | payment processor and our servers |
| Support messages | emails and attachments you send us | our email provider |
3.2 Data collected automatically
| Category | Examples |
|---|---|
| Usage data | features used, clicks inside Nject, timestamps, extension version |
| Device and log data | browser type and version, operating system, language, IP address, error reports |
| Approximate location | country or region derived from IP address. We never collect precise location |
| Where you came from | the campaign tags of the ad or link that brought you (such as utm_source), the ad network's click ID, the first page you landed on and the website that sent you (section 11) |
| Cookies | strictly necessary session and security cookies on our websites, and analytics cookies only once you allow them (section 11) |
3.3 What the extension does not do
- It does not read, store or transmit your conversations with AI tools, except the specific text you ask Nject to enhance or save.
- It does not collect passwords, payment details or form data from the sites you visit.
- It does not track your browsing history or the sites you visit.
- It does not run on a page unless that page is a supported AI tool or you invoke Nject on it.
3.4 Sensitive data
Nject is not designed for special categories of data (health, biometrics, religion, political opinions, sexual orientation, criminal records) or for other people's confidential information. Please do not put such data in prompts or copilots. If you do, we process it only to deliver the feature you used.
4. Why we use your data and our legal bases
| Purpose | Data used | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Provide the Service: accounts, copilots, prompt enhancement, sync, memory | account, copilots, prompts, memory | contract (Art. 6(1)(b)) |
| Process payments and send invoices | billing, account | contract; legal obligation (Art. 6(1)(c)) |
| Keep the Service secure, prevent abuse, debug errors | log, device, usage | legitimate interests (Art. 6(1)(f)) |
| Understand feature usage and improve the product, using aggregated or pseudonymised data | usage | legitimate interests |
| Measure how visitors find and use our websites and which ads and links bring sign-ups | usage, device, campaign tags and click IDs | legitimate interests; consent for analytics cookies where the law requires it |
| Measure our ads on Facebook and Instagram (Meta Pixel) | pages visited; account creation, checkout and subscription events; device and browser; Meta's cookie IDs | consent (Art. 6(1)(a)), given and withdrawn in the cookie banner |
| Send service messages (security, billing, changes to terms) | account | contract; legitimate interests |
| Send product news and offers | consent (Art. 6(1)(a)), withdrawable at any time via the unsubscribe link | |
| Comply with law and respond to lawful requests | as required | legal obligation |
Under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), we rely on your consent and on the contract, legal-obligation and legitimate-interest exceptions that correspond to the bases above.
No training on your content. We do not use your prompts, copilots, memory or outputs to train or fine-tune machine learning models, and we do not allow our providers to do so.
5. Artificial intelligence transparency
- Nject uses large language models, operated by third-party providers, to rewrite and enhance the prompts you submit. Enhanced prompts and other outputs are AI-generated and can be inaccurate. Review them before use.
- To produce a result we send the provider your prompt together with the relevant parts of the copilot you selected. We send only what the feature needs.
- We do not carry out automated decision-making that produces legal or similarly significant effects on you (GDPR Art. 22).
- Nject is not intended for the high-risk uses listed in Annex III of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), such as employment screening, credit scoring or law enforcement.
6. Who we share data with
We share personal data only with the service providers below, each bound by a written data processing agreement, and never for their own marketing.
| Provider | Role | Data | Location |
|---|---|---|---|
| Railway Corp. | application hosting and PostgreSQL database | all Service data | USA / EU |
| Cloudflare, Inc. | DNS, CDN, DDoS protection | IP address, request metadata | global |
| Google LLC | Sign in with Google (OAuth), company email | email, name, Google ID, support emails | USA / EU |
| Large language model API providers (current list available on request) | prompt enhancement | submitted prompt and relevant copilot context | USA / EU |
| Midbrain Inc. (midbrain.ai), Austin, Texas | memory infrastructure: stores and retrieves the long-term memory your copilots use | memory entries derived from your copilots and prompts, pseudonymous user ID | USA |
| Stripe, Inc. | payments, subscriptions, tax and fraud checks | billing data, email, IP address | USA / EU |
| Postmark (ActiveCampaign, LLC) | transactional email | email address, message content | USA |
| Sentry (Functional Software, Inc.) | error monitoring | error traces, device data, pseudonymous user ID | USA / EU |
| Google LLC | Google Analytics: visits and sign-ups on our websites and dashboard (section 11) | pages viewed, the website that sent you, device and browser, approximate location, events such as a sign-up | USA / EU |
You can request the current list of sub-processors, including the named language model providers, at [email protected]. We give at least 30 days' notice of a new sub-processor to business customers who ask to be notified.
We may also disclose data:
- to professional advisers, auditors and insurers under confidentiality;
- to a buyer, investor or successor (and their advisers, under confidentiality) in connection with a merger, acquisition, financing, reorganisation, or sale of all or part of our business or assets. Your data, including your account, copilots, prompts and memory, is one of the assets that passes to the successor, who then becomes the controller and must honour this policy until it gives you notice of a new one. We will tell you by email or in the Service before your data becomes subject to a different privacy policy, and you can delete your account before the transfer takes effect;
- to courts, regulators or law enforcement where the law requires it. We review each request and disclose the minimum necessary.
Our website also uses Microsoft Clarity for analytics, described in section 11. Microsoft processes that data as an independent controller under the Microsoft Privacy Statement.
With your consent, our websites and the web app also send page visits and account creation, checkout and subscription events to Meta through the Meta Pixel, described in section 11. Meta Platforms Ireland Limited (Meta Platforms, Inc. outside Europe) and we are joint controllers for collecting and sending this data; what Meta does with it afterwards is governed by the Meta Privacy Policy.
We do not sell personal data to data brokers or advertisers. The only data an advertising company receives is the Meta Pixel's, and only with your consent. A transfer of the business as described above is not a sale of personal data.
7. Chrome Web Store and Google API disclosures
- The use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- In line with the Chrome Web Store User Data Policy, Nject uses your data only to provide and improve its single purpose (managing and enhancing prompts for AI tools). We do not sell it, do not use it for advertising or creditworthiness, and do not allow humans to read your content except with your permission, for security, to comply with law, or in aggregated and anonymised form for internal operations.
- Extension permissions are limited to supported AI websites and to local storage needed for your copilots and settings.
8. International transfers
We are established in the United Arab Emirates and use providers in the United States and the European Union, so your data is processed outside your country.
For data from the EEA, the United Kingdom and Switzerland we rely on:
- the European Commission's Standard Contractual Clauses (2021/914), with the UK International Data Transfer Addendum and Swiss amendments where relevant;
- the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. DPF, where the provider is certified;
- transfer impact assessments and supplementary measures such as encryption in transit and at rest.
Transfers out of the UAE follow PDPL Articles 22 and 23. You can request a copy of the relevant safeguards at [email protected].
9. How long we keep data
| Data | Retention |
|---|---|
| Account, copilots, saved prompts, memory | until you delete the item or your account |
| Prompt enhancement requests and outputs not saved by you | up to 30 days, for abuse prevention and debugging |
| Server and security logs | up to 90 days |
| Error reports | up to 90 days |
| Usage analytics | up to 24 months, then aggregated or deleted |
| Campaign tags and click IDs | in your browser until you clear its storage or withdraw consent; with your account until you delete it |
| Billing and tax records | 7 years from the end of the financial year, as UAE tax law requires |
| Support correspondence | 24 months after the ticket closes |
| Backups | overwritten within 35 days |
When you delete your account we erase or anonymise your personal data within 30 days, instruct our sub-processors (including the memory provider) to do the same, and keep only what the law obliges us to keep.
10. Security
We apply measures appropriate to the risk (GDPR Art. 32), including TLS encryption in transit, encryption at rest, least-privilege access with multi-factor authentication, secrets held in a dedicated secret manager, separation of production and test environments, dependency and vulnerability monitoring, and a documented incident response process. Staff and contractors are bound by confidentiality and security obligations.
No system is perfectly secure. If a breach is likely to result in a risk to your rights, we notify the competent authority within 72 hours where the law requires it and inform you without undue delay when the risk is high.
Report a vulnerability to [email protected] with the subject "Security".
11. Cookies and similar technologies
Our websites and the web app use only what they need to work until you choose otherwise. On your first visit a cookie banner asks what else they may use, with Reject all as easy as Accept all, and you can allow each category on its own. Your choice is kept for 12 months, then we ask again. You can change it at any time: Change cookie settings. Withdrawing takes effect at once and removes the cookies that category set. A browser that sends the Global Privacy Control signal is treated as having rejected statistics and marketing.
The extension uses no cookies. It keeps your settings, session and local copies of your copilots in browser extension storage.
| Category | What it does | Cookies and storage | How long |
|---|---|---|---|
| Strictly necessary (always on) | sign-in, security, load balancing, checkout, and remembering your cookie choice | your sign-in in browser storage; nj_consent (your choice); Stripe's fraud prevention cookies at checkout; Cloudflare's security cookies when needed | until you sign out; 12 months; set by Stripe and Cloudflare |
| Statistics (your choice) | measuring how people use the websites and the web app, and which ads and links bring them | Google Analytics: _ga, _ga_FEGE4R9H88. Microsoft Clarity: _clck, _clsk, and Microsoft's MUID. Campaign tags: nj_attribution in browser storage | Google Analytics up to 13 months; _clck 12 months; _clsk 1 day; MUID 12 months; campaign tags until you clear your browser's storage or withdraw |
| Marketing (your choice) | measuring our ads on Facebook and Instagram | Meta Pixel: _fbp (Meta's browser ID), _fbc (the ad click, when you arrive from a Meta ad) | 90 days each |
Microsoft Clarity. our website and the web app (sign-up, onboarding and the dashboard) use Microsoft Clarity to understand how they are used: pages viewed, clicks and scrolls, device and browser. What you type is masked, and so are your name, your email and the content of your context profiles. Pages whose address carries your email or a sign-in link are not recorded. The extension does not use it. Until you allow statistics it sets no cookies and does not recognise you from one page to the next. Microsoft processes this data as an independent controller under the Microsoft Privacy Statement.
Google Analytics. every page of nject.ai, the dashboard included, uses Google Analytics 4 to count visits and sign-ups and to see which ads and links bring them. The extension does not use it. Until you allow statistics it sets no cookies, and Google receives only cookieless signals with no lasting identifier (Google Consent Mode). Page addresses reach Google without their query, apart from campaign tags and ad click IDs, so an email address or a reset link in an address never does. Google processes this data on our behalf under the Google Ads Data Processing Terms.
Campaign tags. When you arrive from an ad or a tagged link, the page reads its campaign tags (such as utm_source), the ad network's click ID, the page you landed on and the website that sent you. The tags go with you to the Chrome Web Store when you press Add to Chrome on that page, so the store's statistics credit the install to the campaign. With statistics allowed, your browser also keeps them in its local storage, and when you create an account we attach them to it, to learn which campaigns bring customers.
Meta Pixel. Only once you allow marketing, our websites and the web app tell Meta which page you are on, and when you create an account, choose how to start your first profile, open the checkout or start a subscription (with the plan's price), or reach the page shown after removing the extension. Meta receives these with your IP address, browser details and its cookie IDs, and uses them to measure and improve our ads on Facebook and Instagram. Pages whose address carries your email or a sign-in link send nothing, and we send Meta no email address or name. Meta Platforms Ireland Limited (Meta Platforms, Inc. outside Europe) and we are joint controllers for collecting and sending this data; Meta's own use of it is governed by the Meta Privacy Policy. Withdrawing marketing in Change cookie settings stops it at once and removes its cookies.
12. Your rights
12.1 Everyone
Whatever your country, you can:
- access and export your data (in the app where available, or by email);
- correct your account and copilot data in the app;
- delete individual items or your whole account (in the app where available, or by email);
- unsubscribe from marketing email at any time.
12.2 EEA, United Kingdom and Switzerland
Under the GDPR, UK GDPR and the Swiss Federal Act on Data Protection you have the right to access, rectification, erasure, restriction, data portability, to object to processing based on legitimate interests, to withdraw consent at any time, and not to be subject to solely automated decisions with legal or similar effects. You may lodge a complaint with your local supervisory authority (for example the ICO in the UK or the FDPIC in Switzerland). We respond within one month, extendable by two months for complex requests.
EU and UK representative. Where Article 27 GDPR or UK GDPR requires us to appoint a representative, we will publish their contact details in this section. Until then, contact us directly at [email protected].
12.3 United Arab Emirates
Under the PDPL you have the right to obtain information, to request transfer of your data, to correction and erasure, to restrict or stop processing, and to object to automated processing. You may complain to the UAE Data Office.
12.4 United States
Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Nebraska, Maryland, Minnesota, Rhode Island, Indiana, Kentucky and other states with comprehensive privacy laws have, subject to each law's thresholds, the right to know, access, correct, delete and port their personal information, to opt out of sale, sharing, targeted advertising and significant profiling (we do not sell your data or profile you; the Meta Pixel, which some of these laws treat as sharing for targeted advertising, runs only if you allow marketing cookies, and a Global Privacy Control signal keeps it off), to limit the use of sensitive personal information (we do not use it for inferences), to appeal a refused request, and not to be discriminated against for exercising these rights.
California notice at collection (CCPA/CPRA). In the past 12 months we collected: identifiers (email, name, IP address, account ID); commercial information (subscription and transaction history); internet or network activity (usage of the Service); approximate geolocation; and user content (prompts, copilots, memory). Sources: you and your device. Purposes: section 4. Recipients: the service providers in section 6, and, since October 2026 and only for visitors who allow marketing cookies, Meta (identifiers and internet activity, for measuring our ads). We have not sold personal information. Retention: section 9. You may use an authorised agent with written proof of authority. We respond within 45 days, extendable once by 45 days.
12.5 How to make a request
Email [email protected] with the subject "Privacy request", from the email address on your account, and tell us your country or state and what you are asking for. We may ask for information to verify your identity and will use it for nothing else. Requests are free unless manifestly unfounded or excessive. To appeal a decision, reply to our response with "Appeal" in the subject line.
13. Children
Nject is not directed to children. You must be at least 16 to use it (or the higher age of digital consent in your country), and at least 18 to buy a subscription. We do not knowingly collect data from children under 13 (COPPA) or under the applicable age of consent. If you believe a child has given us data, contact us and we will delete it.
14. Third-party sites and AI tools
Nject works alongside AI tools such as ChatGPT, Claude and Gemini. When you send a prompt to one of those tools, that provider processes it under its own privacy policy. We are not responsible for their practices.
15. Data Protection Officer
We are not required to appoint a Data Protection Officer under Article 37 GDPR or the PDPL given the nature and scale of our processing. Privacy matters are handled by our General Manager at [email protected].
16. Changes to this policy
We will post any change here and update the effective date. For material changes we give at least 14 days' notice by email or inside the Service before they take effect. Earlier versions are available on request.
17. Contact
PROMPT COPILOT - FZCO IFZA Business Park, Dubai Digital Park, PO Box 342001, Dubai, United Arab Emirates Email: [email protected]
© 2026 PROMPT COPILOT - FZCO. All rights reserved.