This Privacy Policy describes how Prebreak Inc. (“Prebreak,” “we,” or “us”) collects, uses, and discloses personal information in connection with prebreak.com, inquiries, demos, subscriptions, business interactions, accounts, support, and the Prebreak services that are made available to you. It also explains our role when processing customer project information and information about invited reviewers or outside stakeholders. Features described here apply only when offered and used; a description is not a representation that every feature is generally available.
We determine the purposes of processing our own website, sales, account-administration, security and business-contact information. For personal information a customer places in a project workspace or directs us to process, we act under its agreement and, where applicable, as its processor or service provider. Permitted internal improvement remains subject to those role restrictions. Shared learning uses eligible nonpersonal or properly de-identified information and rights-cleared materials as explained below. This policy does not convert customer-directed personal information into unrestricted data for independent purposes. The customer determines project purposes, permissions, recipients and retention instructions, subject to law. Employment and recruiting information may be covered by a separate notice.
Information we collect
Information you provide includes your name, business email, telephone number if supplied, company, role, inquiry, meeting details, subscriptions, support correspondence, and preferences. If you establish an account, it also includes account identifiers, authentication information, organization membership, permissions, and administrative settings. For transactions, we process business billing and purchase records; payment details submitted directly to a payment provider are handled by that provider through its designated interface.
Necessary technical information includes IP address, device and browser information, requested pages, referral information, timestamps, errors, and security events. Approximate location may be inferred from an IP address; this is different from precise device location. When you use an application or review room, records may also include invitations, identity checks, access, views, downloads, comments, changes, approvals, and revocations. These records support accountability and security; they are not behavioral session replay. Our current website configuration does not use optional behavioral analytics, advertising tags, or session replay, as explained in the Analytics and Cookies Policy.
Customer project information may contain names and business contact details of owners, applicants, consultants, agency staff, counterparties, and other participants; parcel and case identifiers; plans, title and survey material, studies, applications, signatures, professional certifications, financial assumptions, email and attachments, meeting notes, comments, submissions, decisions, and outcomes. You or your organization select the records and authorized integrations. Connecting a mailbox or drive authorizes only the scope presented and approved, not unrestricted collection from every account.
Other sources include your organization and authorized collaborators, scheduling or service providers, counterparties, and lawfully obtained public or licensed records. Public-record analysis may resolve project identities, participants, dates, agency actions, and response intervals from official sources. Sources and derived information may be incomplete or incorrect. We do not assume that every record found on the internet is exempt from privacy protection.
These activities can involve the following statutory categories: identifiers; personal information described in California Civil Code § 1798.80(e), such as contact information and signatures; commercial information; internet or network activity; approximate geolocation; professional or employment-related information; and project or service-related inferences. Audio, images, or video may be present in records you submit. We do not automatically record meetings; a recording feature requires separate notice and any legally required consent.
Sensitive personal information can be present in account credentials and customer-supplied communications or attachments. We do not request unrelated government identifiers, full payment credentials in project files, health records, biometric identifiers, or precise device location for ordinary entitlement analysis. We use sensitive information only as reasonably necessary to provide requested services, secure them, follow lawful customer instructions, or comply with law; we do not use it to infer sensitive personal characteristics. Submit privileged material only where the relevant agreement and processing controls permit it.
How we use information
We use contact and business information to respond to inquiries, arrange demos, provide support, administer relationships and purchases, and send requested communications. We use account and technical information to authenticate users, apply permissions, operate and troubleshoot services, prevent misuse, and maintain auditable records.
At a customer’s direction, project information supports document processing, source-linked analysis, requirement and evidence management, pathway and yield scenarios, schedule forecasts, financial comparisons, collaboration, reviewable communication drafts, submission records, exports, and outcome evaluation. We distinguish project analysis from decisions about an individual’s access to housing, credit, employment, insurance, or other essential services. Prebreak is not offered for those individual eligibility decisions.
AI services may process authorized portions of files, prompts, correspondence and metadata. Authorized personnel and contracted reviewers may access information as necessary for service delivery, review, support, security and eligible product improvement, under appropriate confidentiality and access restrictions.
Product improvement is enabled by default for eligible projects under the Platform Terms and Data Use and Model Improvement Policy, unless the customer opts out or a stricter agreement or legal restriction applies. Eligible materials, usage, corrections and outcomes may develop, train, fine-tune, test, evaluate, calibrate and improve Prebreak-controlled software, models, mappings, rules, forecasts and reusable knowledge. Improvements can benefit other customers; those customers do not receive your private source files or identifiable confidential details. Preparation may include annotation, minimization, de-identification and qualified human review.
An authorized organization administrator may disable improvement use in Settings > Data Controls > Improve Prebreak. Authorized project administrators may also exclude a project. Organization Off controls all its projects; project Off controls that project even when the organization is On. The Data Use and Model Improvement Policy explains the effective date, staged data, retained generalized learning and deletion. Essential services and security continue after opt-out; the project’s materials and attributable usage are excluded from new optional shared-improvement use. Individual privacy rights operate independently of administrator settings.
Private customer records are not licensed to providers for training their unrelated or general-purpose models. Approved providers may process them on Prebreak’s behalf, including for authorized Prebreak-controlled training, under purpose, confidentiality, security, retention and onward-use restrictions. Legacy data covered by a no-training commitment is not enrolled merely by posting this policy. Required additional consent, source rights and lawful purposes must exist before affected use begins.
Improvement and evaluation remain subject to purpose, role, access, settings and source-rights restrictions. Removing names is not necessarily de-identification: addresses, parcel/case numbers and unusual project facts can identify people or confidential projects. Where we rely on de-identified data, we take reasonable measures to prevent association with an individual or household, publicly commit to maintaining and using it in de-identified form, and contractually require recipients to comply. We do not attempt re-identification except to test those measures where legally permitted. Confidentiality review is separate. Independently acquired public and licensed sources remain subject to their own rights; an upload does not enlarge them.
We also process information to comply with legal duties, respond to valid legal demands, protect rights and safety, resolve disputes, and maintain necessary business records. We do not acquire ownership of customer project materials through this policy.
Legal bases and your choices
Where a law requires a legal basis, we rely on the applicable basis for the activity: steps requested before a contract or performance of a contract with you; legitimate interests in business communications, operation, support, and security, subject to your rights; legal obligations; or consent where required. Customer-directed processing follows the customer’s lawful instructions and applicable processing agreement. Consent can be withdrawn without affecting processing that was lawful before withdrawal.
You may unsubscribe using the link in a marketing email or email hello@prebreak.com. We will honor marketing opt-outs within the legally required period. We may still send service, account, security, or transactional communications when needed. Requesting a demo does not subscribe you to a newsletter. We do not use individual email-open or link-click tracking in the current website and email configuration.
The Analytics and Cookies Policy explains necessary technologies, third-party destinations, Global Privacy Control, and Do Not Track. Browser sale/sharing signals are separate from the product-improvement setting and do not substitute for choices concerning recordings or connected accounts. Disconnecting an integration stops future access within that connection’s scope; it does not automatically erase previously imported project records.
Disclosure of information
We disclose contact, account, commercial, and technical information to providers that help us with hosting, authentication, communication delivery, scheduling, support, billing, and security, as needed for those functions. Under customer instructions, authorized hosting, storage, document-processing, AI, and specialist-review providers may also process project content and associated personal information. Applicable contracts limit their processing to authorized purposes. Contact us for information about providers applicable to your service; the customer processing agreement governs subprocessor disclosures and changes.
Your organization’s authorized administrators and project participants can access information within their assigned permissions. Administrators may manage accounts, retain business records, and review service activity. Invited external reviewers receive the documents and versions the customer authorizes. Review activity and comments may be visible to the project owner and permitted participants. Private financial assumptions, strategy, drafts, and counsel-restricted records require separate authorization; an invitation does not authorize access to the entire project.
Recipients of an authorized download, email, or export may retain copies outside Prebreak. Revoking a link cannot recall those copies. Information shared with a public agency may become subject to public-record, retention, or disclosure laws; a confidentiality label does not decide whether a legal exemption applies. We do not promise that using Prebreak creates or preserves attorney-client privilege.
We may disclose relevant categories of information to professional advisers, authorities, or affected parties when reasonably necessary for legal compliance, security, or protection of rights; and to parties involved in a merger, financing, acquisition, or similar transaction, with appropriate confidentiality and legal safeguards. A transaction does not automatically authorize incompatible new uses of personal information.
We do not sell personal information or share it for cross-context behavioral advertising, and have not done so during the preceding 12 months or, if shorter, since operations began. This statement applies to the information categories described above. We do not knowingly sell or share the personal information of children under 16. We do not use or disclose sensitive information for purposes requiring a right-to-limit choice under the CCPA in our stated operating configuration.
Privacy requests and California rights
You may contact us to request access to or correction or deletion of personal information we control. Depending on your location, the applicable law, and our role, you may also have rights to obtain a portable copy, object to or restrict processing, withdraw consent, opt out of certain processing, appeal a refusal, or complain to the appropriate regulator. We will not unlawfully discriminate or retaliate against you for exercising a privacy right.
Where the California Consumer Privacy Act (CCPA), as amended, applies to our processing, California residents may request the categories and specific pieces collected; sources; purposes; categories of recipients; deletion; correction; and applicable sale/sharing or sensitive-information limitations. These rights are subject to statutory exceptions and do not require us to disclose another person’s information or protected trade secrets. Availability of particular statutory rights depends on the law’s coverage; we do not represent that every provision applies solely because a person is in California.
Email hello@prebreak.com with “Privacy Request,” or write to Prebreak Inc., 700 E Redlands Blvd U172, Redlands, CA 92373. Explain the request and your relationship to the service. We do not require you to create an account. We may verify identity and authority proportionately to the request’s risk; we will not ask for unnecessary sensitive documents. Authorized agents may submit requests with appropriate evidence of authorization. Opt-out signals do not require an identity-verification process.
For CCPA requests to know, delete, or correct where applicable, we acknowledge receipt within 10 business days and generally respond within 45 calendar days. If a permitted extension is needed, we explain the reason and timing; the extension will not exceed a further 45 days. Applicable sale/sharing opt-outs and limitation requests follow their separate legal deadlines, rather than the access-request timetable. Other applicable laws may require different deadlines or an appeal process; contact the same address with “Privacy Appeal” to request reconsideration.
If the request concerns information processed on behalf of a customer, we will assist or direct it to the responsible customer as appropriate under law and the agreement. For a public-source error, identify the project, source, and disputed field so we can investigate our derived record; correction by Prebreak does not amend an agency’s original record. Lawful public-record exclusions and legal retention duties may limit deletion. Contact us if you need a privacy notice or request process in an accessible format.
Retention
We retain information only as long as reasonably necessary for the disclosed purpose, applicable customer instructions, legal duties, security, or establishment and defense of claims. The criteria differ by information class:
Inquiries, meetings, and business contacts: the active relationship, requested follow-up, and a reasonable period for related business records, assessed by recency and purpose.
Marketing preferences: while subscribed, with limited suppression records retained to honor opt-outs.
Accounts, authentication, billing, and support: the service relationship and applicable account-security, transaction, recordkeeping, and dispute needs.
Customer working records: the agreed project lifecycle, customer retention settings, and lawful deletion instructions.
Issued packages, transmittals, receipts, decisions, claim histories, and source snapshots: the agreed archive and retention period, underlying source rights, and applicable legal duties. “Immutable” protects version integrity; it is not a claim of permanent retention or exemption from privacy law.
Technical, access, and security logs: documented operational, audit, incident-response, and legal needs, with content and duration limited to those purposes.
AI processing and improvement records: the minimum needed for their authorized purpose and documented useful life, considering preferences, rights, risk, necessity and legal duties. Attributable opted-out data is excluded from subsequent optional improvement; lawfully retained generalized learning is treated separately under the Data Use and Model Improvement Policy. No universal zero-retention promise is made.
Backups and legal holds: the documented backup-expiry schedule and specific preservation duties. Active-system deletion may precede expiry of backup copies; protected copies are restricted and deletion obligations are reapplied if restored.
Customer agreements specify applicable export, archive, offboarding, deletion, and backup periods before live project processing. Source rights or law may constrain an export or require earlier deletion. We do not keep an unrestricted duplicate simply because a record once supported an analysis.
Security, children, and international processing
We use reasonable administrative, technical, and organizational safeguards appropriate to the information and service. No security method is perfect. Detailed controls, incident-notice commitments, and any service levels are governed by the applicable agreement and law; this policy does not claim a certification, uninterrupted availability, or an unverified recovery target.
The Services are intended for business users and are not directed to children under 16. We do not knowingly solicit personal information from children under 16. If you believe a child has provided information, contact us so we can assess and take appropriate action, including lawful deletion where required.
Prebreak operates from the United States. Information may be processed in the United States and other countries where authorized providers operate, subject to applicable law and service arrangements. Where a restricted international transfer requires a legal mechanism, the relevant transfer safeguards must apply; merely visiting the Site is not consent to waive those requirements. Contact us about applicable processing locations, safeguards, or rights under European or UK data-protection law, including complaints to the competent supervisory authority.
Changes and contact
We will post revisions with an updated effective date and provide additional notice of material changes where appropriate or legally required. Where a new use requires consent or other authorization, posting a new policy alone will not supply it. We review the policy at least annually and when practices materially change.
Contact: hello@prebreak.com, subject “Privacy”; Prebreak Inc., 700 E Redlands Blvd U172, Redlands, CA 92373.
All policies