Privacy Policy

We collect only what we need to run the product, keep it secure and bill for it.

• Account information: work email address, password (stored as a one-way hash), name, company name, role, team membership and the six-digit confirmation codes we send to verify your email.
• Proposal content: briefs, meeting notes, uploaded RFPs and past proposals, company style settings, content library blocks, pricing items, comments and version history.
• Your clients' details inside proposals: names, email addresses, job titles, company names and any other details you choose to include, plus signer names, signatures, signing timestamps and IP addresses recorded for the audit trail.
• Proposal tracking data: when a sent proposal is opened, time spent per section, forwarded views and the device type and approximate location derived from the viewer's IP address.
• Billing information: plan, billing period, invoices and payment status. Full card numbers are handled by our payment processor and never reach our servers.
• Usage and log data: IP address, browser and device type, pages visited, actions in the app, AI draft and rewrite counts, error logs and security events.
• Hero demo inputs: the client name, offer, scope and tone you type into the free proposal preview on the homepage, the generated preview and the IP address used for abuse prevention.
• Signup source: referring page, landing page and campaign tags attached to the visit that led to your signup.
• Support messages: the content of emails you send to [email protected].

We use personal information for the purposes below. For people in the European Union and the European Economic Area, each purpose rests on the legal basis shown.

• To create and run your account, generate drafts, send and track proposals and collect e-signatures (performance of a contract).
• To process subscription payments, keep invoices and meet tax and accounting duties (performance of a contract and legal obligation).
• To verify your email, prevent fraud, abuse and spam, and keep the service secure (legitimate interests).
• To enforce plan limits on AI drafts and rewrites and to show usage in your panel (performance of a contract).
• To send service emails such as confirmation codes, receipts, security notices and changes to these documents (performance of a contract and legal obligation).
• To understand how the product is used in aggregate and improve it, without advertising profiles (legitimate interests).
• To respond to support requests and exercise or defend legal claims (legitimate interests and legal obligation).
• Where a law requires consent for a specific processing activity, we ask for it first and you can withdraw it at any time.

When you generate a draft or rewrite a section, the relevant text (your brief, selected library blocks, style notes and the section being edited) is sent to an AI model provider that processes it on our behalf only to return the result to you. We do not train AI models on your proposals, and our agreements with the provider do not allow your content to be used to train their models. AI output is generated for your account only and is never shown to other customers.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We share it only with service providers that process it on our behalf under written agreements, in these categories.

• Hosting provider that stores and runs the application and its databases.
• Payment processor that handles card payments, subscriptions and fraud screening.
• Email delivery provider that sends confirmation codes, proposal links, notifications and receipts.
• AI model provider processing text on our behalf to produce drafts and rewrites.
• Analytics without advertising cookies, used to measure site and product usage in aggregate.
• Integrations you connect yourself, such as HubSpot, Salesforce, Pipedrive, Zapier, webhooks or Slack, receive the data you choose to sync, under the terms of those services.
• Authorities or other parties when the law requires it, or when needed to protect the rights, safety or property of our customers, the public or the service.
• A successor operator in case of a transfer of the service, which remains bound by this policy for data collected under it.

Our providers may process information in the United States and other countries. When personal information of people in the EU or EEA is transferred outside it, we rely on recognized safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

We keep personal information only as long as needed for the purposes above.

• Account and proposal content: for as long as your account is active. After you delete a proposal it leaves your workspace immediately and is removed from backups within 30 days. After you close your account, its content is deleted within 30 days.
• Signed proposals and audit trails: kept for the life of the account so you can prove what was signed. Enterprise workspaces can set their own retention periods.
• Billing records: kept for the period required by tax and accounting laws.
• Logs and security events: kept for up to 12 months.
• Hero demo inputs and previews that are not attached to a confirmed account: deleted within 30 days.
• You can export your proposals at any time before closing your account.

If you are a California resident, you have the right to know what personal information we collect, use and disclose, to access a copy of it, to request correction, to request deletion, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use or disclose sensitive personal information for purposes that would trigger the right to limit. You may use an authorized agent, and we will not discriminate against you for exercising any of these rights.

If you are in the EU or EEA, you have the right to access your data, rectify it, erase it, restrict or object to its processing, receive it in a portable format and withdraw consent at any time where processing relies on consent. You also have the right to lodge a complaint with your local data protection authority.

Email [email protected] from the address on your account and say which right you want to use. We verify the request against your account and respond within 30 days for GDPR requests and within 45 days for CCPA requests, extended where the law allows. If your client asks us about details you placed in a proposal, we will pass the request to you, because you control that content.

The service uses only strictly necessary cookies, so there is no cookie banner. We do not use advertising cookies, tracking pixels or cross-site trackers.

• Session cookie that keeps you signed in.
• CSRF token cookie that protects forms against cross-site request forgery.
• Preference cookie that remembers settings such as the annual or monthly pricing view.
• Our analytics measure usage without advertising cookies and without building profiles across sites.

Data is encrypted in transit and at rest. Access inside a workspace follows roles, Enterprise workspaces can require SSO and keep an audit log, and our staff access production data only when needed to support you or keep the service running. No system is perfectly secure, so if we learn of a breach that affects your personal information, we will notify you and the authorities as the law requires. Read more about our controls on the ProposalCreation security page.

The service is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, email [email protected] and we will delete it.

We may update this policy when the product or the law changes. We will post the new version on this page with a new date and, for material changes, notify account owners by email before the change takes effect. Related documents are our Terms of Service and our refund policy, and plan details are on ProposalCreation pricing.

Questions about this policy or your data go to the administrator of the proposalcreation.com service at [email protected].