Privacy Policy
Last updated: October 6, 2026
1. Introduction
Penumbra Systems, Inc. ("Penumbra," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our cognitive platform, including our web app, APIs, and connected assistant features.
Our approach to your data
Penumbra is designed for sensitive intellectual work — strategic thinking, proprietary analysis, and organizational knowledge. We use service providers to host and operate the platform, process AI requests, send email, and handle feedback. Their roles are described below. We do not sell your personal information or use your content to train our own models. Access by teammates and connected assistants depends on the permissions you and your organization grant.
2. Information We Collect
Account Information
When you create an account, we collect:
- Email address
- Name (if provided)
- Organization information
- Authentication and session information managed through our authentication provider
Content and Usage Data
We collect information you provide when using Penumbra:
- Projects, documents, and knowledge graphs you create
- AI interactions and conversations
- Files and data you upload
- Collaboration and sharing activities
- Usage patterns and feature interactions
- Feedback, support messages, optional screenshots, and privacy requests you submit
Technical Information
- IP address
- Browser type and version
- Device information
- Log data and analytics
3. How We Use Your Information and Legal Bases
We use your information for the purposes below. For users in the European Economic Area and other jurisdictions that require a legal basis for processing, we have identified the applicable basis for each purpose.
| Purpose | Data Involved | Legal Basis |
|---|---|---|
| Provide and operate the Penumbra platform, including your account, projects, and knowledge graphs | Email, name, organization, content you create | Contract |
| Process AI requests, document extraction, and search using our AI model providers | Your inputs and the AI-generated outputs | Contract |
| Enable collaboration within your organization | Content, organization membership, role | Contract |
| Process payments and manage subscriptions | Payment information, billing records | Contract |
| Operate usage metering and improve the platform | Feature usage, operation outcomes, model usage, and credit records | Legitimate interest |
| Detect, prevent, and address security issues and abuse | IP address, device information, access logs | Legitimate interest |
| Diagnose errors and maintain service reliability | Error logs, device and browser information | Legitimate interest |
| Communicate product updates and service announcements | Email address | Legitimate interest |
| Respond to feedback, support, and privacy requests | Account identity, message, optional screenshot, page, and technical context | Contract and legitimate interest |
| Comply with legal and regulatory obligations | As required by applicable law | Legal obligation |
Usage and diagnostics: We record operation outcomes, model usage, credit activity, and technical logs to run the service, account for usage, and investigate problems. Our infrastructure providers process some of these records on our behalf. We do not use advertising trackers in the app.
4. AI and Data Processing
Penumbra uses AI models to process your content and generate insights. To deliver features such as extraction, generation, document processing, and semantic search, your data is sent to one or more of these AI model providers:
- Google Cloud (Gemini models through Vertex AI)
- OpenAI
- Anthropic
- Perplexity
This can include file content, prompts, relevant project context, and generated results. We use these providers' business API services. Under their terms, they do not use the data we send them to train their models unless we opt in, and we have not opted in. Provider retention and abuse-monitoring terms still apply; this is not a promise of zero retention.
Important: Your content is used solely to provide services to you. We do not use your proprietary data to train AI models for other customers. We do not train our own models on your data.
If you connect an external assistant or other client, information returned to it is also handled under that provider's terms and privacy practices. Review the access shown during connection, choose the permissions you need, and revoke connections you no longer use.
5. Services You Connect
You can connect other services to a Penumbra project so their files stay in sync with it, for example Google Drive or a folder on your computer. Connecting is always your choice, and you can disconnect at any time.
What we access. Only the files and folders you choose to sync, read-only. To keep track of the connection we also store the email address of the account you connected and an access credential the service gives us. We never change or delete anything in the connected service.
How we use it. We copy the files you chose into your project and keep them up to date when they change. From then on they are treated like any other file in your project: the people and tools you give access to the project can see them, and Penumbra's features process them only when you or your organization use those features, including the AI processing described in section 4.
What we don't do. We don't sell this data, use it for advertising, or use it to train AI models. People at Penumbra don't read it unless you give us permission, it is needed to investigate security or abuse, the law requires it, or it is aggregated and anonymized for operating the service.
Disconnecting and deleting. Disconnecting a folder stops syncing it. Removing the connection itself revokes Penumbra's access at the service and deletes the credential we stored. Files already copied into your project stay there until you delete them. You can also remove Penumbra's access from the service's own account settings (for Google, at myaccount.google.com/permissions). To delete everything, delete the files or the project, or email privacy@pnbr.io.
Google user data. Penumbra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Data Sharing and Disclosure
We may share your information with:
- Your organization members: Content you share within your organization is accessible to authorized team members
- Service providers: Third parties who assist in operating our platform (hosting, AI model providers)
- Legal requirements: When required by law or to protect our rights
- Business transfers: In connection with a merger, acquisition, or sale of assets
We do not sell your personal information to third parties.
7. Data Security
We use technical and organizational measures to protect your data, including:
- Encryption in transit (TLS/SSL)
- Encryption at rest for sensitive data
- Access controls and authentication
- Organization and project permissions, scoped credentials, and access revocation
- Managed hosting, database, and secret-storage services
However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
8. Data Retention
We retain your information for as long as your account is active or as needed to provide services. You can request deletion from Account settings or by emailing privacy@pnbr.io. Our team verifies and processes requests; sending a request does not immediately erase data. We may retain records needed for security, accounting, legal obligations, and disputes. Backup copies may remain until their retention period expires. Content belonging to an organization may remain under that organization's control after an individual leaves. Contact us about a particular record or retention requirement.
9. Your Rights
Depending on the law that applies and any relevant exceptions, you may ask us to:
- Access your personal information
- Correct inaccurate data
- Request deletion of your data
- Export your data
- Opt-out of certain data processing
- Withdraw consent where applicable
To exercise these rights, contact us at privacy@pnbr.io
11. Third-Party Services
The hosted app uses these service providers for the purposes shown:
- Supabase (authentication and database)
- Google Cloud (runtime hosting, file storage, logging, and AI processing)
- OpenAI, Anthropic, and Perplexity (AI processing)
- Vercel (web application hosting and request processing)
- Cloudflare (API routing, network security, and authenticated file delivery)
- Google (authentication when you choose to sign in with Google)
- Resend (authentication, invitation, and privacy-request email delivery)
- Linear (feedback messages, optional screenshots, and support context)
- Google Drive (only if you connect it, to sync the files you choose)
If you purchase a plan through a Stripe checkout or manage it through a Stripe billing portal, Stripe processes your payment information. Availability of paid checkout is separate from creating an account. Service providers receive the information needed for their role; for example, feedback includes your account identity, the page, app version, message, and any screenshot you choose to attach.
12. International Data Transfers
Your information may be transferred to and processed in countries other than your own. We use service-provider agreements and applicable transfer mechanisms to address these transfers. Contact privacy@pnbr.io for information about the arrangements that apply to your use of the service.
13. Children's Privacy
Penumbra is not intended for users under 18 years of age. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. Where an updated notice or consent is required, we will provide it. The app may ask you to acknowledge the updated policy alongside the Terms of Service.
15. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
Penumbra Systems, Inc.
Email: privacy@pnbr.io
Website: https://pnbr.io
16. GDPR Compliance (EU Users)
If you are located in the European Economic Area, you have additional rights under GDPR:
- Right to data portability
- Right to object to processing
- Right to lodge a complaint with supervisory authorities
- Right to restrict processing
Our legal basis for processing your data includes contract performance, legitimate interests, and your consent.
17. CCPA Compliance (California Residents)
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information.
Categories of Personal Information We Collect
- Identifiers: Name, email address, IP address, account credentials
- Commercial information: Subscription and billing records
- Internet or network activity: Usage data, feature interactions, log data
- Professional information: Organization name and role
- Inferences: AI-generated insights derived from your content at your direction
Your California Rights
- Right to know: You may request the categories and specific pieces of personal information we have collected about you
- Right to delete: You may request deletion of your personal information, subject to certain exceptions
- Right to correct: You may request correction of inaccurate personal information
- Right to opt-out of sale: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising
- Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights
How to Exercise Your Rights
To submit a request, email us at privacy@pnbr.io. We will verify your identity before processing your request. We will respond within the time required by applicable law, including any permitted extension we explain to you.
Shine the Light (CA Civil Code § 1798.83)
We do not disclose personal information to third parties for their direct marketing purposes.
This Privacy Policy is effective as of the date stated above and will remain in effect except with respect to any changes in its provisions in the future, which will be in effect immediately after being posted on this page.