Privacy notice

1. Who is responsible

Madiaz, established in the United States, is the data controller for personal data processed to operate ProposalKit. For privacy questions or requests, email madiaz.404@gmail.com. Paddle separately handles payment-related information as Merchant of Record under its own Privacy Notice.

2. Data and why we use it

• Account and authentication: email address, account ID, authentication credentials managed by our auth service, session information and OAuth connection/consent details. Used to create accounts, sign you in, connect ChatGPT and secure access. Basis: contract performance and legitimate interests in security.
• Access and billing records: entitlement status, customer and subscription identifiers, verified transaction identifiers, paid periods and billing-event records. Used to manage subscriptions, verify access, handle billing issues and meet recordkeeping obligations. Basis: contract performance and legal obligations.
• Proposal inputs and documents: content you submit may contain client names, contact information or project details. Used only to validate, format, edit and export the proposal you request. Basis: contract performance. You must have permission to submit other people’s data.
• Technical information: IP addresses, device/browser information, request metadata and operational or error logs may be processed by hosting and service providers to deliver the service, diagnose failures and prevent abuse. Basis: legitimate interests in reliability and security.
• Support messages: messages and contact details you provide when seeking help. Used to answer requests and resolve issues. Basis: contract performance or legitimate interests in customer support.

ProposalKit does not call an AI model to generate proposals. Content drafted in ChatGPT is also governed by the privacy terms of the ChatGPT service.

3. Data sharing

We share data only as needed with hosting, authentication, infrastructure and support service providers, including Lovable Cloud; with Paddle for product sales, subscription management, payments, tax compliance and invoicing; with professional legal or accounting advisers where necessary; and with authorities when required by law. Your approved ChatGPT connection can call ProposalKit tools as you and receive their results. We do not sell personal data.

4. Storage and retention

Proposal content is processed in memory and in your editor session; it is not stored in a ProposalKit proposal-content database. Editor links carry proposal data in the URL fragment, so treat those links as confidential. Your browser, ChatGPT and operational providers may retain data under their own settings or retention policies; we do not promise zero provider log retention.

We determine retention by the purpose of the record rather than applying one period to all data. Account and connection information is retained while your account is active and subsequently only as necessary for security, unresolved disputes or legal obligations. Billing and transaction records are retained for the applicable US accounting and tax recordkeeping requirements and any unresolved payment disputes. Support records are retained while a request is being resolved and as necessary for related follow-up or disputes. Technical records are retained as necessary to diagnose incidents and prevent abuse, subject to provider retention settings. When records are no longer needed for these purposes, they are deleted or anonymised, except where a legal obligation requires continued retention. You can ask about retention or request deletion at madiaz.404@gmail.com.

5. Your rights

Email madiaz.404@gmail.com to exercise your privacy rights. Subject to the law that applies to you, these may include access, correction, deletion, restriction, portability and objection to processing. Where processing relies on consent, you may withdraw it without affecting prior lawful processing. We may need to verify your identity before acting; do not send passwords or full payment-card details.

US residents may have additional rights under applicable state privacy laws, including appealing a denied request where that right applies. We respond within the time required by applicable law and do not discriminate against you for exercising protected privacy rights. Where UK/EEA data-protection law applies, we respond within one month, subject to legally permitted extensions, and you may complain to your supervisory authority. You may also complain to the relevant privacy regulator in your jurisdiction.

6. Security and international processing

We use appropriate technical and organisational measures, including encryption in transit, authentication and access controls. No system is completely secure; keep your credentials and proposal links private. Madiaz is established in the United States, and we and our providers may process information in the United States and other countries outside your country of residence, including outside the UK/EEA.

Where applicable data-protection law requires safeguards for an international transfer, the transfer must use a lawful mechanism, such as an applicable adequacy decision or standard contractual clauses with any required supplementary measures. Contact madiaz.404@gmail.com for information about the safeguards applicable to your data. This notice does not claim that Madiaz or any particular provider holds a specific transfer certification.

7. Cookies and browser storage

Essential cookies or browser storage support sign-in, session continuity and OAuth. Paddle checkout uses its own storage and cookies to provide payment and fraud-prevention services. ProposalKit does not intentionally add optional analytics or marketing cookies. Optional tracking must not be introduced without any legally required consent. You can clear or block cookies and site storage in your browser, but doing so may sign you out or prevent checkout or account features from working.