Privacy Policy

Account: your email address and password credentials (passwords are hashed; we never see them). Company profile: business details you enter — name, industry, services, markets, deal sizes, certifications, and your business description used to tailor AI drafts. Work product: clients, opportunities, proposals, quotations, signatures, and knowledge-base entries you create. Client signatures: when your client signs a proposal we store their name, email, signature image, and signing timestamp as the acceptance record.

AI generation: when you generate a proposal, rewrite a section, or extract your profile, the relevant project details and company context are sent to our AI provider (OpenRouter, serving current models across tiers) solely to produce your output. Your content is not used to train models. Anonymous token counts are logged for cost monitoring.

Payments: handled by Stripe. We receive subscription status and invoice records — never your card numbers.

Emails: sign-in links, verification codes, and workspace invitations are delivered via Resend.

Uploads: documents, images, and signature files you provide are stored on our hosting platform and used only to operate the features you invoke.

Analytics: anonymous page-view measurement (Google Analytics and Vercel Analytics) loads only after you accept the cookie banner; declining leaves the product fully working with zero measurement.

We use a secure session cookie to keep you signed in, local storage for demo data and UI preferences (theme, onboarding progress), and Cloudflare Turnstile (a privacy-preserving human check) on sign-in and the public demo. No advertising trackers.

We share data only with the processors above (hosting on Convex, payments via Stripe, email via Resend, AI via OpenRouter, bot protection via Cloudflare), each limited to operating the service. We do not sell personal data or share it for marketing.

Your data is kept while your account is active. Delete individual clients, proposals, and opportunities anytime from the dashboard. To erase your entire account and workspace, use Billing → Danger zone → “Delete account and server data” (takes effect immediately). Prefer email? Write to support@apearl.co — we confirm and remove it within 30 days, except records we must retain for billing or legal compliance.

You may request access, correction, export, or deletion of your personal data at any time via the email above. EU/EEA users hold these rights under the GDPR; Malaysian users under the PDPA 2010. We respond within 30 days.

Data is encrypted in transit (TLS) and at rest on our hosting platform, with scoped access controls per workspace. No system is perfectly secure — tell us promptly of any suspected breach. Apearl is a business tool and is not directed at children under 13.

Material changes will be announced in-app or by email before taking effect. Continued use after the effective date constitutes acceptance.