Privacy Policy

1. Overview

PM Stage ("we," "our," "us") is a project management and workflow platform for marketing and creative professionals. We are based in California, USA, and our Service is designed for users in the United States. This Privacy Policy explains how we collect, use, and protect your information when you use our website (pmstage.com) and service (collectively, the "Service").

By using PM Stage, you agree to the collection and use of information as described in this policy. If you don't agree, please don't use the Service.

1.1 Our Relationship With You

Who is responsible for your information depends on how you use PM Stage:

• If you use PM Stage through an organization (for example your employer or university), that organization controls the data in its workspace, including information about you, and PM Stage processes it on the organization's behalf. Your organization's administrators can see your activity in the workspace, manage your access, and access or export workspace data. Questions about how your organization uses PM Stage should go to your organization first
• If you use PM Stage on your own, outside any organization, PM Stage is responsible for the personal information in your account
• Account and security information we collect to run and protect the Service (for example login records, device data, and support requests) is controlled by PM Stage in every case
• People who are not PM Stage users whose information an organization collects through the Service (for example form submitters and reviewers) are described in Section 2.9; that information is controlled by the organization

2. What We Collect

We follow a principle of data minimization—we only collect what we need to provide the Service.

2.1 Account Information

When you create an account, we collect:

• Email address - For account access, notifications, and support
• Name - To personalize your experience
• Password - Stored securely using industry-standard hashing
• Organization details - If you create or join an organization

2.2 Workflow & Project Data

To provide the Service, we store:

• Project names, descriptions, and structures
• Task metadata (titles, due dates, assignees, status)
• Team and organization configurations
• Form structures and submissions (if you use our forms feature)

2.3 Files You Upload and Files We Generate

Depending on the features you use, we store files you upload to the Service (for example documents, images, logos, and attachments to form submissions) and files the Service generates from them (for example rendered pages, branded graphics, and packaged downloads). The specific file types depend on the features your organization uses and may change as the Service evolves.

Where you have connected Google Drive, the Service may also file copies of what it produces into your own Google Drive. Those copies are controlled by your Google account and governed by Google's terms, not by this policy.

2.4 Usage & Device Data

We automatically collect:

• Device information (browser type and version, operating system, device type)
• IP address (for security, fraud prevention, and approximate geographic location)
• Pages visited and features used
• Timestamps of activity
• User agent strings

2.5 Security & Session Data

To protect your account and detect unauthorized access, we collect:

• Session information - Active sessions, login times, last activity timestamps
• Device fingerprinting - Browser type, operating system, and device characteristics
• Geolocation data - Approximate location derived from IP address
• Login attempts - Successful and failed login attempts

2.6 Activity Logs

For security, troubleshooting, and organizational audit purposes, we maintain activity logs that may include:

• Actions performed within the Service (creating, updating, deleting resources)
• IP addresses and user agents associated with actions
• Timestamps and affected resources
• Organization administrators may access activity logs for their organization

2.7 Public Feature Analytics

If you use our public-facing features (forms, QR codes, business cards), we collect analytics data from visitors:

• Form submissions - IP address, user agent, and submission timestamps for spam prevention
• QR code scans - IP address, user agent, device type, approximate location, and scan timestamps
• Business card views/clicks - IP address, user agent, device type, approximate location, and interaction timestamps

2.8 Email You Send Through the Service

If you connect an email account so the Service can send from your address, we store the sending credentials you provide (encrypted) and a record of each message sent through the Service: recipients, subject, content, delivery status, and in some cases whether the message was opened or a link in it was clicked. These records are part of your organization's workspace and are visible to authorized members of your organization. You can disconnect the account at any time.

2.9 Information About People Who Are Not PM Stage Users

Organizations use the Service to work with people who do not have PM Stage accounts: people who submit forms or requests, reviewers and approvers they invite, recipients of messages they send, and visitors to their public pages. For those people we may hold the information the organization collects or enters (for example name, email address, submission content, comments, and approval decisions) and limited technical data for security and spam prevention (for example IP address and browser type). We process this information on behalf of the organization, which controls it. If you are one of these people and want to exercise your privacy rights, contact the organization that collected your information; you can also contact us and we will refer your request to them and assist as required by law.

3. What We Don't Store

• The rest of your Google Drive. We can only see files the Service created or files you picked, through the permission you granted
• Passwords for other services. Access tokens for Google and other integrations and any email-sending credentials you give us are stored encrypted and are never shown back to anyone
• Payment card numbers. Billing is not yet live; when it is, card details will go directly to our payment processor and never touch our servers
• Biometric data. We do not create biometric identifiers unless a feature that does so is explicitly enabled by your organization's administrator, in which case we will describe it to you before it is turned on

4. How We Use Your Data

We use the data we collect to:

We do not:

• Sell your personal data
• Use your data for advertising purposes
• Share your data with data brokers
• Train AI models on your content without consent
• Use content you submit to optional, experimental AI features for anything other than returning the result to you (such content is processed by a third-party AI provider under its terms; we do not train our own models on it)

5. When We Share Data

We share data only in these limited circumstances:

5.1 With Your Organization

If you're part of an organization, your Organization Admin and team leads may see your activity within the organization's workspace.

5.2 Service Providers

We use trusted third-party service providers (sub-processors) to help operate the Service. They only access your data as necessary to perform services on our behalf and are contractually obligated to protect it. Our current sub-processors are listed below and on our sub-processors page, which we update when providers change. Organization administrators may ask us to be notified of changes.

• Supabase — database, authentication and multi-factor authentication
• Vercel — application hosting
• Cloudflare — file storage, content delivery, network security and bot protection on public forms
• iDrive e2 — file storage for asset library features
• Upstash — rate limiting
• Google — Workspace for the email we send from our own addresses, Gemini for optional AI features, and the Drive, Sheets, Calendar and Gmail integrations you choose to connect
• Other tools you connect — for example a project management tool you import from or sync with, only if your organization connects it
• Your email provider — only if you choose to send email from your own address through the Service
• Stripe — payment processing, once billing launches

5.3 Legal Requirements

We may disclose data if required by law, court order, or to protect the rights, safety, or property of PM Stage, our users, or the public.

5.4 Business Transfers

If PM Stage is acquired or merged, your data may be transferred. We'll notify you of any such change.

6. Cookies & Tracking

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using the Service. We do not use advertising or targeting cookies, we do not sell or share personal information for cross-context behavioral advertising, and we do not use session-replay tools. Our browsers' "Do Not Track" signals have no standard meaning, so we do not respond to them; where the law requires it, we honor the Global Privacy Control (GPC) signal as an opt-out of any sale or sharing of personal information.

6.1 Emails We Send You

We send transactional and service emails such as sign-in codes, invitations, notifications, and important notices about your account or these policies. You cannot opt out of those while you have an account, because the Service depends on them. We may also send product news and marketing email; every such email includes an unsubscribe link, and you can opt out at any time without affecting service emails. Our emails may include standard delivery and open tracking so we can tell whether a message arrived.

7. Third-Party Services

PM Stage integrates with external services you choose to connect. When you authorize an integration:

• We access data from that service only as needed for the feature you are using, and only within the permissions you granted
• Your access tokens are stored encrypted and are used only to act on your behalf inside the Service
• The third party's privacy policy also applies to your data
• You can disconnect an integration at any time from Settings → Integrations, which revokes our access
• You are solely responsible for how you configure and authorize integrations

7.1 Google

When you connect a Google account we request only the permissions the features need: creating and reading files the Service created or you picked in Google Drive, reading and writing the Google Sheets you link, creating calendar events, and, where you enable it, sending email from your address. We use Google user data only to provide those features to you. PM Stage's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not allow humans to read it except with your consent, for security purposes, or as required by law.

8. Data Security

We use reasonable security practices to protect your data, such as:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for sensitive data, where applicable
• Secure password hashing
• Access controls and logging

8.1 Access by PM Stage Personnel

PM Stage personnel access customer data only when needed to provide support you request, to investigate security incidents or abuse, to operate and maintain the Service, or as required by law. Such access is limited and logged.

8.2 Security Incidents

If we become aware of a security incident that affects your personal data, we will notify affected organizations and, where required, affected individuals and regulators without undue delay and in the manner required by applicable law.

9. Data Retention

We keep your information for as long as your account or your organization's account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Our general retention practices are:

• Organization data after termination: we intend to keep it for up to 90 days so administrators can export it, then delete it from live systems and, in the ordinary course, from backups within a further 30 days. An administrator may request earlier deletion in writing
• Personal accounts: we aim to delete or anonymize account data within 30 days of a verified deletion request, except data your organization is entitled to keep as the controller of its workspace and data we must retain by law
• Data you collect through public features (for example form submissions): kept until your organization deletes it, because your organization controls that data
• Security, audit, and activity logs: generally kept for up to 12 months
• Files deleted in the Service: may be recoverable from a trash area for a limited period shown in the Service, after which they are permanently deleted
• Backups and anonymized data: deleted data may persist in backups for a limited time, and we may keep anonymized or aggregated data indefinitely

These periods are targets, not guarantees. We may retain information longer where required by law, for security or fraud prevention, to resolve disputes, to enforce our agreements, or while a legal hold is in place, and we may delete information sooner where we are not required to keep it.

9.1 Your Responsibility for Backups

PM Stage is not a backup, archival, or disaster recovery service. You are responsible for maintaining independent backups of your data and content, including files the Service has filed in your Google Drive, and for any deletions made by you or by users of your organization.

10. Your Rights

We believe in giving you control over your data. All PM Stage users have the right to:

10.1 Access Your Data

Request a copy of the personal data we hold about you.

10.2 Correct Your Data

Update or correct inaccurate information through your account settings or by contacting us.

10.3 Delete Your Data

Request deletion of your account and associated data. We aim to complete verified requests within 30 days, or as the law requires. Data that belongs to your organization's workspace (for example tasks you created) stays with the organization, which controls it.

10.4 Export Your Data

Request a copy of your personal data in a commonly used, machine-readable format. We aim to provide it within 30 days, or as the law requires, free of charge. Organization-level exports are described in our Terms of Service.

10.5 Withdraw Consent

Where we rely on your consent, you can withdraw it at any time.

10.6 U.S. State Privacy Rights

Depending on where you live, your state's privacy law may give you additional rights (for example, California, Colorado, Connecticut, Texas, Virginia, and other states with comprehensive privacy laws). These can include the right to access, correct, delete, or obtain a portable copy of your personal information, and to opt out of its sale or sharing. We honor these rights for all U.S. users regardless of state. The California-specific details below also describe how these rights work in practice.

To exercise any of these rights, contact us at support@pmstage.com with "Privacy Request" in the subject line. We aim to respond within 45 days, and sooner where the law requires it; if we need more time we will tell you why.

10.7 How We Handle Requests

• Verification. We will verify your identity before acting, usually by confirming the email address on your account or on the record in question, and may ask for more information where the request is sensitive
• Authorized agents. You may have an authorized agent submit a request for you. We will ask for signed written permission and may still verify your identity directly
• Organization accounts. If your information is in an organization's workspace, we may refer the request to that organization, which controls the data, and assist it as the law requires
• Appeals. If we deny a request in whole or in part, we will explain why, and you may appeal by replying to our decision with "Privacy Appeal" in the subject line. We will respond to appeals within the time the law requires. You may also contact your state attorney general or privacy regulator
• No discrimination. We will not treat you differently for exercising your rights

11. California Privacy Rights (CCPA/CPRA)

As a California-based company serving US users, we comply with the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). California residents have the following rights:

11.1 Right to Know

You can request information about the categories and specific pieces of personal information we've collected, the sources, our business purposes, and who we share it with.

11.2 Right to Delete

You can request deletion of your personal information, subject to certain exceptions (such as completing a transaction or complying with legal obligations).

11.3 Right to Correct

You can request correction of inaccurate personal information we hold about you.

11.4 Right to Opt-Out of Sale/Sharing

We do not sell or share your personal information for cross-context behavioral advertising. We never have and never will.

11.5 Right to Limit Use of Sensitive Information

We only collect sensitive personal information (like account login credentials) as necessary to provide the Service, not for profiling or advertising.

11.6 Right to Non-Discrimination

We won't discriminate against you for exercising your privacy rights.

12. Children's Privacy

PM Stage is not intended for children under 16. We do not knowingly collect personal information from children under 16. If we learn we've collected such information, we'll delete it promptly.

If you believe a child under 16 has provided us with personal information, please contact us at support@pmstage.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by:

• Posting a notice on the Service
• Sending an email to the address associated with your account
• Updating the "Last Updated" date at the top of this page

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us.