1. Overview
This Privacy Policy explains how Hyperledger IT Pvt Ltd ("Prapl", "we", "us"), the company behind the Prapl software brand, handles personal data when you visit our website, create an account, or use our software. We are the data controller for the personal data described here. For personal data we process on behalf of business customers, see our Data Processing Agreement.
2. Local-first by design
Many Prapl tools (such as our file transfer, migration and backup software) are designed so that your files, server credentials, database contents and backups stay on your own machines and storage, under your own encryption keys. We build our software so that we cannot see that content — even if asked. Where a tool works this way, that data is never transmitted to us.
3. What we collect
We collect only what we need to run our business and provide the Services:
- Account data — name, email address and password (hashed) when you register.
- Billing data — for paid products, billing name, address and payment identifiers. Card details are handled by our payment processors; we do not store full card numbers.
- Licence & usage data — product, version, licence status, and basic diagnostic/telemetry data (such as crash reports) where you have not opted out.
- Support data — the contents of messages you send to support@prapl.com.
- Website data — IP address, browser type, pages visited and similar analytics data collected via cookies (see our Cookie Policy).
We do not collect your transferred files, backup contents, server passwords or database records for local-first tools.
4. How we use your data
- To provide, maintain and secure the Services and your account.
- To process payments, manage subscriptions and licences, and prevent fraud.
- To provide support and respond to your requests.
- To send service, security and (where permitted) marketing communications — you can opt out of marketing at any time.
- To improve our products through aggregated, diagnostic and analytics data.
- To comply with legal obligations and enforce our terms.
5. Legal bases for processing (EEA/UK)
Where GDPR or UK GDPR applies, we process personal data on the basis of: performance of a contract (to provide the Services), legitimate interests (to secure and improve the Services and for direct marketing to existing customers), consent (for non-essential cookies and certain marketing), and legal obligation (for tax and accounting records).
6. Cookies and tracking
We use strictly necessary cookies to run the site, keep you signed in and provide live chat. With your consent we also use analytics cookies — Google Analytics, Microsoft Clarity and Yandex Metrika. Until you agree, none of them is loaded and none sets a cookie.
Two of these record your session. If you accept analytics cookies, Microsoft Clarity and Yandex Metrika (Webvisor) capture how you use a page — mouse movement, clicks, scrolling and navigation — and replay it to us as an anonymous session so we can find and fix confusing parts of the site. Text you type into forms is masked and not captured. Choosing "Reject all" prevents this entirely.
Yandex Metrika processes data in the Russian Federation, which is not covered by a UK or EU adequacy decision. If you would rather your usage data did not go there, choose "Reject all" or switch Analytics off in Cookie Settings.
Our live chat widget (Tawk.to) loads on every page so support is always reachable, so its cookies are set regardless of your banner choice. We list them as strictly necessary in the Cookie Policy rather than imply the banner turns them off.
You can change your choice at any time from the Cookie Settings link in the footer. Full details are in our Cookie Policy.
7. Who we share data with
We do not sell your personal data. We share it only with:
- Service providers / processors — payment processors, hosting, email delivery, analytics and support tools, bound by contract to protect your data.
- Professional advisers and authorities — where required by law, court order, or to protect our rights.
- Successors — in connection with a merger, acquisition or sale of assets, subject to this Policy.
8. International data transfers
We operate globally and are based in India. Your data may be processed in countries other than your own. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
In practice, the places your data may reach are: India (our own operations), the United States (Google Analytics, Microsoft Clarity, and our hosting and payment providers), and — only if you accept analytics cookies — the Russian Federation, where Yandex Metrika processes site usage data. Neither India nor the Russian Federation is covered by a UK or EU adequacy decision. You can prevent the transfer to Yandex entirely by choosing "Reject all" on the cookie banner or switching Analytics off in Cookie Settings.
9. How long we keep data
We keep personal data only as long as needed for the purposes above: account data for as long as your account is active, billing records for the period required by tax law, and support data for a reasonable period after resolution. We then delete or anonymise it.
10. Security
We use technical and organisational measures — including encryption in transit, access controls and least-privilege practices — to protect personal data. No system is perfectly secure, but our local-first architecture means the most sensitive data usually never reaches us. Learn more on our Security page.
11. Your rights (GDPR / UK GDPR)
If you are in the EEA or UK, you have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing; data portability; and withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority. To exercise any right, email support@prapl.com. We will respond within the timeframes required by law.
12. US state privacy rights (California and others)
If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another US state with a comprehensive privacy law, you have the right to know what personal information we collect and why, to get a copy of it, to have it corrected, to have it deleted, and to opt out of any "sale" or "sharing" of personal information for targeted advertising. We will not treat you differently for exercising any of these rights.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We run no advertising cookies and build no advertising profiles.
Sensitive personal information. We do not collect or use sensitive personal information (such as government identifiers, precise location, health or biometric data) for any purpose that would require an opt-out.
Global Privacy Control. If your browser or an extension sends a GPC signal, we automatically treat it as an opt-out of analytics cookies for that browser. You do not need to do anything else.
Your privacy choices. To turn analytics and session recording on or off, use the Cookie Settings link in the footer of any page. To make any other request — a copy of your data, correction, or deletion — email support@prapl.com and we will respond within 45 days, as the law requires. We may need to confirm your identity before we act, and an authorised agent may make a request on your behalf with proof of permission.
Appeals. If we refuse your request and you live in a state that provides a right of appeal, you may reply to our decision and ask us to reconsider. We will respond in writing with our reasons.
13. Children's privacy
The Services are not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
14. Changes to this Policy
We may update this Policy from time to time. Material changes will be reflected in the "Last updated" date and, where appropriate, notified to you.
15. Contact us
For any privacy question or to exercise your rights, contact Hyperledger IT Pvt Ltd at support@prapl.com or via our contact page.