1. Website data
The ProvokeAI public website does not include third-party advertising trackers, behavioral advertising pixels, or marketing trackers at launch. Our hosting provider may process standard request metadata needed to deliver and secure the website, such as IP address, requested URL, browser/network information, and timestamps.
We do not intentionally set advertising cookies on this website.
2. Client Portal account data
If you claim or use a ProvokeAI Client Portal account, we process information needed to authenticate you and connect the account to an existing customer and license. This can include your email address, customer and subscription identifiers, account creation and update timestamps, session records, device/browser metadata associated with security events, and security audit events.
Passwords are not stored in plaintext. The portal stores a salted password hash. Multi-factor authentication is required for portal access. Authenticator-app secrets are stored encrypted, and recovery codes are stored as one-way hashes after they are issued. Session tokens are stored in hashed form on the server and are delivered to the browser using secure, HTTP-only cookies.
To claim an existing license or recover access, the portal may verify information against the licensing records already associated with your customer account, including your email address and activation key. Security controls may also process IP address and request metadata for rate limiting, abuse prevention, and authentication monitoring.
3. Support and feature-request data
If you contact ProvokeAI or submit a request through the authenticated Client Portal, we receive the information you provide. This can include your email address, message, support category, feature-request title or description, and related customer, subscription, and request identifiers. Authenticated support requests may be marked as licensed-customer priority and associated with your customer record so we can respond and troubleshoot effectively.
The public support page can also format a support message for you to copy into the webmail service of your choice; that public copy tool does not itself submit the message to ProvokeAI.
4. Security and fraud prevention
We process limited account, session, network, rate-limit, and audit information to authenticate users, enforce multi-factor authentication, protect license records, detect abuse, investigate security incidents, and maintain service integrity. Sensitive portal actions may require a recent second-factor verification.
5. Product-specific policies
ProvokeAI products may handle information differently from the public website and Client Portal. Provoke Deck has a dedicated Privacy Policy explaining local extension storage, licensing requests, device identifiers, portal-linked licensing information, and user choices.
6. Payments
The Client Portal is designed so ProvokeAI does not collect or store full payment-card numbers or card security codes. When payment management is enabled, billing changes are intended to be handled through the applicable payment provider's hosted payment or customer-portal experience. ProvokeAI may retain provider customer/subscription identifiers, plan and subscription status, billing-period information, and other limited billing metadata needed to provide the service.
7. Sharing and sale
ProvokeAI does not sell personal information collected through this website or Client Portal. Service providers may process limited information on our behalf to host, secure, authenticate, bill, or operate the service and support systems. Information may also be disclosed when required by law or reasonably necessary to protect users, services, or legal rights.
8. Retention
Technical hosting and security data is retained according to operational and security needs. Portal account, session, audit, licensing, support, and feature-request records are retained for as long as reasonably necessary to operate the account and service, resolve requests, maintain security and fraud-prevention history, enforce licensing, and meet applicable obligations. Expired or revoked security records may be deleted or retained in limited form when needed for abuse prevention or audit purposes.
9. Contact and requests
Privacy questions or requests can be submitted through the ProvokeAI support page. Licensed customers may also use the authenticated Client Portal.