Privacy Notice

1. Who we are

This Privacy Notice describes how the PM app ("we", "us", "our") collects, uses, and shares personal data when you use our products and services (the "Service"). the PM app is the data controller responsible for your personal data in connection with the Service.

2. Personal data we collect

• Account data: name, email address, password (hashed), profile details.
• Workspace content: projects, feedback, vendors, notes, and other content you create in the Service.
• Support data: messages and attachments you send when contacting us.
• Usage and telemetry: pages visited, features used, performance and error data.
• Device and log data: IP address, browser type, operating system, device identifiers, timestamps.
• Cookies and similar technologies: see section 9.

3. Why we use your data

• To create and manage your account.
• To provide, maintain, and improve the Service.
• To provide customer support.
• To detect, prevent, and respond to fraud, abuse, and security incidents.
• To send service-related communications (e.g. updates, billing notices, security alerts).
• To send marketing communications, where you have consented or where permitted by law.
• To comply with legal obligations.

4. Legal basis

We rely on the following legal bases:

• Performance of a contract — to provide the Service you have signed up for.
• Legitimate interests — to operate, secure, and improve the Service.
• Consent — for optional marketing and non-essential cookies.
• Legal obligation — to comply with applicable laws.

5. Who we share data with

• Service providers / subprocessors — hosting, database, analytics, email, and customer support tooling, acting on our instructions. This includes PostHog (EU region), which we use for product analytics and session replay to understand product usage and diagnose UX issues. See PostHog's privacy notice.
• AI subprocessors — large language model providers (such as Google, OpenAI and Anthropic, accessed via the Lovable AI Gateway) that process workspace content you submit to AI features in order to return a response. See section 10 for details.
• Paddle — our Merchant of Record. Paddle handles payment processing, subscription management, tax compliance, invoicing, and refunds. See Paddle's privacy notice.
• Professional advisers — legal, accounting, and audit advisers, where necessary.
• Authorities — where required by law or to protect rights and safety.

We do not sell your personal data and we do not allow our AI subprocessors to train their foundation models on your workspace content.

6. Data retention

We keep personal data only as long as necessary to provide the Service and meet our legal obligations. Account and workspace data is retained while your account is active. After account closure, data is deleted or anonymized within a reasonable period unless a longer retention is required by law.

7. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. You may also have the right to lodge a complaint with your local data protection authority. To exercise any of these rights, contact us at info@thepm.app. We aim to respond within one month.

8. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, and regular review of our practices. No method of transmission or storage is fully secure, but we work hard to protect your data.

9. Cookies, analytics and session replay

We use essential cookies and local storage to operate the Service (e.g. authentication and session state). We also use PostHog, hosted in the EU (Frankfurt), for product analytics and session replay. PostHog collects:

• your user identifier and email (so we can tie usage back to your account when you are signed in);
• pageviews and in-app events (e.g. which features you use);
• device, browser and IP metadata; and
• session recordings that capture your interactions with our UI, so we can diagnose UX issues.

Session recordings have all form inputs masked by default — values you type into text fields, password fields and similar inputs are not captured. We do not use this data to build advertising profiles and we do not sell it. PostHog analytics and session replay are off by default and only run after you opt in via our cookie banner. You can change your choice at any time using Cookie settings, or by clearing your browser storage.

10. AI features and processing

The Service includes optional AI-powered features such as feedback clustering and triage, quick-capture routing, OKR and strategy suggestions, vendor and competitor enrichment, project summarisation, and competitor news summarisation. When you invoke an AI feature:

• The relevant workspace content (e.g. a feedback item, project brief, or vision statement) is sent to a third-party large language model provider via the Lovable AI Gateway solely to generate the requested output.
• We have contractual arrangements with our AI subprocessors that prohibit them from using your content to train their foundation models.
• Inputs and outputs may be retained transiently by the subprocessor for abuse-monitoring purposes in line with their published policies, then deleted.
• AI outputs are probabilistic and may be incorrect, incomplete, or biased. You remain responsible for reviewing and validating any AI output before relying on or acting on it.

By using AI features, you confirm that you have the right to submit the relevant content for processing and that doing so does not breach any obligation to a third party.

11. International transfers

Personal data may be processed in countries outside your own. Where required, we use appropriate safeguards such as Standard Contractual Clauses or rely on adequacy decisions.

12. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be communicated through the Service or by email.

13. Contact

Questions about your privacy? Contact us at info@thepm.app.