Privacy Policy

Last updated: January 3, 2026

Note: This is a template privacy policy. Please have it reviewed by legal counsel before deploying to production.

1. Introduction

PM Smart ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our project management platform.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Name, email address, password
  • Profile Information: Job title, department, avatar
  • Content: Projects, programs, portfolios, documents, comments
  • Payment Information: Billing details (processed by Stripe)

2.2 Information We Collect Automatically

  • Usage Data: Pages visited, features used, time spent
  • Device Information: Browser type, IP address, operating system
  • Cookies: See our Cookie Consent banner for details

3. How We Use Your Information

We use your information to:

  • Provide and maintain our service
  • Process your transactions
  • Send you service-related communications
  • Improve our platform
  • Detect and prevent fraud
  • Comply with legal obligations

4. Third-Party Services (Subprocessors)

We use the following third-party services to operate our platform. See our Subprocessor List for full details:

  • Supabase (database & auth)
  • Vercel (hosting)
  • OpenAI (AI features - optional)
  • Stripe (payments)
  • Upstash (caching)
  • Meilisearch (search)

5. Your GDPR Rights

Under GDPR, you have the following rights:

  • Right to Access: Request a copy of your data (Settings → Privacy & Data → Export Data)
  • Right to Rectification: Update your information in Settings
  • Right to Erasure: Request account deletion (Settings → Privacy & Data)
  • Right to Data Portability: Download your data in JSON format
  • Right to Object: Object to data processing
  • Right to Withdraw Consent: Withdraw cookie consent anytime

6. Data Retention

We retain your personal data for as long as your account is active. After account deletion:

  • Personal data is anonymized within 30 days
  • Audit logs are retained for 7 years (legal compliance)
  • Backups are deleted within 90 days

7. Security

We implement industry-standard security measures:

  • Encryption in transit (TLS 1.3)
  • Encryption at rest (AES-256)
  • Row-Level Security (RLS) in database
  • Multi-Factor Authentication (MFA) available
  • Regular security audits

8. Data Residency

By default, data is stored in the United States. Enterprise customers can choose EU data residency.

9. Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email.

11. Contact Us

For privacy-related questions or to exercise your rights:

  • Email: info@pm-smart.app
  • Data Protection Officer: info@pm-smart.app