Privacy Policy

This policy explains what Prochar AI ("the Service"), operated by Royal Bengal AI ("we", "us", "our"), collects about you, why we collect it, and who else sees it. It applies to the Prochar AI website, dashboard, and the WhatsApp and Telegram bots.

It covers two groups of people. The first is account holders — the businesses who sign up and use the Service. The second is the people who interact with those businesses on social media, whose comments and messages arrive in the Inbox. Section 4 is about that second group specifically.

When you sign up we store your name, username, email address and, if you set one, a password — held only as a bcrypt hash, never in a readable form. If you sign in with Google we store the Google account identifier and profile picture URL that Google returns instead of a password.

From your profile and settings we store a display name, phone number, city and country. Country is used to show the right public holidays on your calendar.

We keep a record of account security events: sign-up, sign-in, Google sign-in, linking Google to an existing account, email verification, password changes and password reset requests. Each record includes the time, your IP address and your browser's user-agent string. This exists so that unauthorised access can be investigated, and so a password reset cannot be used quietly.

We also store your plan, your current usage against its limits, whether your account is suspended and why, and the time of your last sign-in.

Everything you put into your Brand profile: what the business does, its audience, products, brand colours, tone of voice, contact details, logo and any photos you upload. If you ask Prochar AI to research your business, the report it produces from publicly available sources is stored alongside it.

When you connect a social channel we store which platform it is, the account identifier and display name on that platform, its avatar, and whether the connection is currently active. Publishing access is held by our publishing provider (see section 6) rather than by us directly.

We store the content the Service produces for you and the content you approve: prompts, captions, hashtags, generated images and video, banners, schedules, and the result of each publish attempt including any error a platform returned.

If you use Promote, we store the campaigns you create, their budgets, their status and the spend figures the advertising platform reports back.

When you connect a channel and use the Inbox, comments and direct messages sent to that channel are retrieved and stored so you can read and reply to them in one place. That content is written by members of the public, not by you, and can include their name, their profile picture and whatever they chose to write.

If you switch on automated replies, those messages are also sent to an AI provider in order to draft a response. You decide whether that happens, per post or per page.

We hold this data on your behalf, because you are the business those people chose to contact. You are responsible for handling it lawfully under whatever rules apply to you. Removing a conversation from your Inbox hides it from your view; it does not delete the message from the social platform it was sent on, and it does not erase the sender's own copy.

To run the Service: writing and designing posts from your brand profile, scheduling and publishing them, drafting replies, reporting results, and running the boosts you approve.

To keep accounts secure and enforce plan limits, which is what the usage counters and security events are for.

To contact you about your account — verification codes, password resets, and notices about your plan or a failure that needs your attention. These are operational messages, not marketing.

We do not sell your data, and we do not use the content of your posts or your customers' messages to train our own models.

The Service is built on third parties, and using it means data passes through them. Each is used for a specific job:

Supabase — hosts the database and stored media, and brokers Google sign-in. Railway — hosts the application servers. Zernio — publishes posts to your connected channels and retrieves comments and messages from them. Google — provides Sign-In when you choose it. Crea, Google Gemini and OpenAI — generate captions, images and video from the brief your brand profile produces. DeepScope — researches a business profile when you ask for one. Stripe — processes payments; card details go to Stripe and are never held by us. Meta — runs the paid boosts you create in Promote. Telegram and WhatsApp — carry the bot conversations if you use them. An email provider delivers verification and notification mail.

Prompts, brand details and the images you supply are sent to the AI providers above in order to generate content. Do not put anything into the Service that you would not be willing to share with them.

Signing in sets two cookies, prochar_at and prochar_rt. Both are httpOnly, meaning JavaScript on the page cannot read them, and they exist only to keep you signed in — the first for about fifteen minutes, the second for up to thirty days. There are no advertising or tracking cookies.

Your browser also stores small conveniences locally: your light or dark theme preference, unsent drafts, and similar. These stay in your browser and are never sent to us.

Account and business data is kept while your account is open. Closing your account removes your profile and brand data and cancels anything scheduled but not yet published.

Posts already published to a social platform are not retracted by closing your account — they live on that platform and only you can remove them there.

Security event records are kept after closure for a limited period, because deleting them would remove the audit trail that makes investigating account abuse possible. Billing records are kept for as long as tax and accounting rules require.

You can edit or remove your brand profile, products and uploaded images at any time from the dashboard. You can disconnect a channel at any time, which stops future posts to it. You can turn automated replies off per post or per page.

You can request a copy of your data, or ask us to delete it, by writing to support@prochar.ai. We will ask you to confirm the request from the email address on the account before acting on it.

Depending on where you live, you may have additional rights over your personal data, including the right to object to certain processing or to complain to a data protection authority.

Passwords are stored as bcrypt hashes and are never recoverable in readable form, by us or by anyone else. Session cookies are httpOnly and, in production, marked Secure. Changing your password or having your account promoted invalidates every existing session immediately.

No service can promise perfect security. If a breach affects your data we will tell you, and the authorities where we are required to.

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will remove it.

Our providers operate in several countries, so your data is processed outside Bangladesh, including in the United States and the European Union. By using the Service you accept that this is necessary to provide it.

We will update this policy as the Service changes, and the date below will change with it. If a change materially affects how your data is used we will give you notice rather than relying on this page alone.

Questions about this policy, or a request about your data, can be sent to support@prochar.ai.