Privacy Policy

Last updated: 2026-09-24

This English version is provided for information. The Polish version is binding.

The data controller is Damian Prochaska, a sole trader registered in the Polish CEIDG business register, ul. Długa 38, 43-419 Hażlach, Poland (tax ID 5482766067, REGON 540819443), referred to below as "we" or "Proposals".

For anything concerning personal data, write to support@proposals.co. We respond within one month of receiving a request at the latest.

This document covers three different groups of people: users of the application, recipients of proposals sent by those users, and visitors who use the free tools and the draft generator on our website. The data and the legal bases differ, so they are described separately.

1. Application users

When you create an account and use the application, you give us data that we process in order to provide the service.

Account data: E-mail address, first and last name, a cryptographic hash of your password, role in the organisation, verification status. Basis: performance of a contract (GDPR art. 6(1)(b)).
Organisation and billing data: Organisation name, plan, trial dates, customer and subscription identifiers at our payment provider. Basis: performance of a contract and legal obligations relating to accounting (art. 6(1)(b) and (c)).
Content you enter: Call transcripts, notes, price lists, scopes, client details, generated proposals. We process these solely to prepare and share the proposal. Basis: performance of a contract.
Connected mailboxes: Address, server, port and username. The password is stored encrypted (Fernet) and is never displayed again after saving. It is used only to send and receive correspondence about your proposals.
Technical data: Server logs, IP addresses and browser information to the extent necessary for security and abuse detection. Basis: legitimate interest (art. 6(1)(f)).
Where you signed up from: If the link that brought you to sign-up carries campaign parameters (such as utm_source or utm_campaign) or a note of where on our website you came from, we store those parameters with your account so we know which channels bring customers. They travel only in the link's address: we use no cookies or browser storage for this. Basis: legitimate interest (art. 6(1)(f)).

2. Proposal recipients

If you received a link to a proposal built in Proposals, the controller of your data within that proposal is the company that sent it to you. We act as a processor on their behalf.

On a published proposal page we collect information about how it is read, so that the sender knows whether and when it was opened:

event type (open, scroll, time spent on a section, button click),
a page-view identifier that exists only in the memory of the open tab, it is never written to your device or to browser storage, so it disappears when the page is closed,
browser information and a hash of the IP address (keyed with a server secret, not a plain digest),
a timestamp.

Recognising a returning reader: So that the sender can tell that five visits are, say, two people rather than five, we group events on the server side using the hash of the IP address and coarse browser information (family, major version, operating system, device type). The result is computed separately for each proposal, so it cannot be used to link the same person across different proposals. It is an approximation: two people on one company network using the same browser may count as one, and one person on a phone and a laptop may count as two. Legal basis: the legitimate interest of the sender (Art. 6(1)(f) GDPR).
What we do NOT do: We neither store nor read anything on your device for these statistics, no cookies, no browser storage, no device fingerprinting. The sender can switch these statistics off for a given proposal; no events are collected then.

3. Website tools and the draft generator

The free tools on proposals.co work without an account. What you paste into them is not stored in our database, it is passed to a language model to produce the result.

If you ask us to generate a proposal draft for your company, we additionally process:

E-mail address and company website: In order to build the draft and send it to you. Basis: steps taken at your request (art. 6(1)(b)), this is not marketing consent.
Publicly available content of your website: We fetch it to tailor the draft to your company and reproduce your visual identity. We do not fetch pages behind a login.
Proof of consent: The wording you accepted, its version, the date and time, IP address, browser information and language. We keep this so we can demonstrate the basis on which we contact you. Basis: legitimate interest (art. 6(1)(f)), accountability.
Marketing consent (optional): If you tick it, we may send you commercial messages. It is optional, it is not a condition of receiving the draft, and you can withdraw it at any time using the link in every message or by writing to us. Basis: consent (GDPR art. 6(1)(a) and art. 398 of the Polish Electronic Communications Law).

4. Who we share data with

We use third-party providers that process data on our behalf. The list below covers everyone who may come into contact with personal data or content entered into the application:

OpenRouter: Routing requests to AI models (generating and editing proposal content, analysing context and research) only to model providers that neither retain the data nor train models on it, including Anthropic, Google Cloud and Amazon Web Services; OpenRouter does not store request content, United States
Anthropic (Claude API): Generating and editing proposal content, analysing context and research (directly, when requests do not go through OpenRouter), United States
Firecrawl: Fetching publicly available content of websites indicated by the user, United States
Resend: Sending e-mail (verification, notifications, follow-ups, drafts from the landing page), United States
Polar (Merchant of Record): Payments, subscriptions, tax and invoicing, Polar acts as the merchant of record, United States / EU
Mux: Hosting and playback of video embedded in proposals, United States
Vercel (hosting, Web Analytics): Website hosting and cookieless visit analytics (@vercel/analytics), United States / EU
Hetzner Online GmbH: Backend application and database hosting, [REGION, e.g. Germany (EEA)]

5. Transfers outside the European Economic Area

Some of the providers listed above are established in the United States, which means data may be processed outside the EEA. Transfers rely on standard contractual clauses or on an adequacy decision of the European Commission, depending on the provider.

You can ask us which mechanism applies to a specific provider.

6. How long we keep data

Account data and application content: For the lifetime of the account and, after deletion, for the limitation period of any claims.
Billing data: For the period required by tax and accounting law.
Proposal reading data: For as long as the sender needs it for their sales process, and no longer than the proposal exists in the system.
Draft-generator leads: Until consent is withdrawn; without marketing consent, no longer than 12 months from generating the draft.
Proof of consent: For as long as we may need to demonstrate the basis of contact, and for the limitation period of claims.

7. Your rights

You have the right to access your data, to rectify it, to erase it, to restrict processing, to data portability, and to object to processing based on legitimate interest. You can withdraw consent at any time, which does not affect the lawfulness of processing before withdrawal.

We handle requests sent to support@proposals.co, there is currently no self-service account deletion button, so we process such requests manually and confirm once done.

You also have the right to lodge a complaint with a supervisory authority: President of the Personal Data Protection Office, Poland (ul. Stawki 2, 00-193 Warsaw).

8. Cookies and browser storage

proposals.co uses Vercel Web Analytics, visit statistics that set no cookies and build no persistent user identifier. It records which pages were viewed, the referrer, and approximate location and device type. We do not use cookies for marketing.

In the application we store a session token in the browser, which is necessary to keep you signed in, that is the only thing written to your device, and sign-in could not work without it. On published proposal pages we store and read nothing on the recipient's device: the page-view identifier lives only in the memory of the open tab (section 2), which is why a proposal page shows no cookie consent banner.

9. Security

passwords are stored only as cryptographic hashes, never in plain text,
passwords for connected mailboxes are encrypted with a symmetric key,
access to a published proposal requires a random token in the URL; without the token there is no access,
all communication with the application uses HTTPS.

10. Changes

We may update this document. The date of the last change is shown at the top of the page. We will notify account holders by e-mail of material changes.