Privacy Policy

This Privacy Policy explains how PMCollab ("PMCollab," "we," "our," or "us") collects, uses, shares, and protects personal information when you use the PMCollab platform, applications, integrations, agents, and APIs (together, the "Service," as defined in our Terms of Service), visit our website, or communicate with us.

"Personal information" means information that identifies, relates to, or could reasonably be linked to an individual. It does not include de-identified or aggregated information that cannot reasonably be linked to you (see Section 10).

This Policy describes our practices. It is not a consent form: we process personal information on the legal bases described in Section 6, which include performing our contract with you, our legitimate interests, legal obligations, and consent where we ask for it. Our Terms of Service govern your use of the Service, and the Acceptable Use Policy sets out your obligations toward the people whose information you bring into it.

PMCollab acts in two different roles, and your rights and our obligations differ between them.

PMCollab as a processor or service provider. When a customer organization or its users submit, connect, or generate content in the Service, such as documents, specifications, source code, transcripts, tickets, messages, prompts, AI output, and other workspace and product content ("Customer Content"), PMCollab processes that content on behalf of the customer and according to its instructions, which include the Terms of Service, the settings the customer configures, and the features it uses. The customer organization is the controller (or business) of the personal information in its Customer Content: it decides what is collected and who may access it, and it controls retention and deletion within the options and contractual retention periods provided by the Service (Section 11). If you are an individual whose personal information appears in a customer's Customer Content, including as a Participant, interviewee, meeting attendee, support requester, or someone mentioned in an imported ticket or transcript, that customer's privacy notice governs, and requests about that information should go to the customer (see Section 15).

PMCollab as a controller or business. PMCollab decides how and why it processes personal information about account holders, website visitors, and the people it does business with for its own purposes: creating and securing accounts, billing, operating and improving the Service, security and abuse prevention, support, analytics about how the Service is used, and marketing. The rest of this Policy applies in full to that information.

Most people use PMCollab through an organization: an employer, a client, or another customer that administers a PMCollab organization. If your account was created or provisioned by an organization, you joined through its invitation or single sign-on, or you use the Service in its workspaces, that organization's administrators can manage your account and access. They may add, remove, or suspend users; assign roles; view, export, modify, and delete workspace and product information, including content you created; connect and disconnect integrations and agents; set organization policies such as the telemetry content level and which AI model providers are used; and receive usage and security information about activity in their organization.

We may share information about you with your organization for these purposes, and we act on the organization's instructions regarding its Customer Content. Questions about your organization's policies, and requests about information it controls, should be directed to its administrators.

The categories of personal information we collect depend on how you use the Service.

Account and profile information: name, email address, display name, job title or role if you provide it, profile picture, authentication identifiers from your sign-in provider (such as Microsoft Entra ID, GitHub, or your organization's single sign-on), credentials, personal access tokens and OAuth grants, and the organization you belong to.

Organization and workspace membership: the organizations, workspaces, products, and teams you belong to, your roles and permissions in them, who invited you, seat and collaborator status, and the settings your organization applies to you.

Subscription and billing information: plan, subscription status, seats, usage-credit balances and consumption, invoices, and transaction history. Payment-card and bank details are collected and processed by our payment provider, which acts as merchant of record, and are not stored on our systems.

Customer Content: content, documents, files, prompts, specifications, source code, transcripts and recordings, communications, feedback, interview and survey responses, votes and contributions, integration data, AI output, and other information submitted to, imported into, or generated through the Service by you or your organization. Customer Content may contain personal information about you and about others, including Participants, customers, colleagues, and people mentioned in imported content. We process Customer Content as a processor on the customer's behalf (Section 2).

Integration and connected-service information: when you or your organization connects a third-party service (Section 8), we receive the information that service makes available under the permissions granted, such as account identifiers, repository and project metadata, channel and ticket content, meeting transcripts, calendar availability, and analytics events. We also store the credentials needed to maintain the connection.

Participant information: when you join a workspace, interview, session, document set, or live-results page by link without an account, we collect the name you enter, an email address if the session requires one, a browser identifier used to recognize your device and enforce workspace rules, and the contributions you make.

Usage, device, log, and security information: pages and features used, actions taken, session timing, referring pages, IP address, approximate location derived from IP address, browser and device type, operating system, language, identifiers such as cookies and push-notification tokens, crash and error reports, API and agent activity, authentication events, and security logs. On the web application this includes session-analytics data that records how you interact with pages (Section 13).

AI interaction information: the prompts and content you provide to AI features, the output they generate, the actions autonomous features take, and operational telemetry about those interactions. The level of content retained in telemetry is set by your organization (Section 7).

Communications and support: the content of messages you send us, support requests, feedback, survey responses, and records of calls, chats, emails, and text messages with our support channels, including transcripts.

Information supplied by your organization: information your organization provides about you when it creates your account, invites you, syncs its directory, or administers your access, such as your name, email address, role, and group membership.

Marketing and website information: how you interact with our website, emails, and events, your communication preferences, and information you provide when you request a demo or sign up for updates.

We collect personal information: directly from you, when you create an account, use the Service, submit content, or contact us; from your organization and its administrators, when they provision, invite, or manage your account; automatically from your use of the Service and our website, through logs, cookies, and similar technologies; from third-party services you or your organization authorize us to connect; from the sign-in provider you use to authenticate; from our service providers and partners, such as payment, email-delivery, and analytics providers; and from publicly available sources, where a feature collects public information at a customer's direction.

We use personal information to: provide, operate, secure, and maintain the Service and perform our contract with you or your organization; create and administer accounts, organizations, and workspaces; process payments, manage subscriptions, and send invoices and billing notices; provide AI features and run the agents and integrations you enable; deliver notifications, invitations, and service communications; respond to support requests and communicate with you; monitor, analyze, and improve the Service, including by evaluating AI output quality; detect, prevent, investigate, and respond to security incidents, fraud, abuse, and violations of our Terms and Acceptable Use Policy; send marketing communications, subject to your choices; comply with legal obligations and enforce our agreements; and for any other purpose we describe when we collect the information or that you direct.

Where the General Data Protection Regulation, the UK GDPR, or a similar law applies, our legal bases are: performance of a contract, for providing the Service, administering accounts, billing, and support; our legitimate interests, for securing the Service, preventing abuse, understanding and improving how the Service is used, operating our business, and sending business-to-business marketing where permitted, in each case balanced against your interests and rights; compliance with legal obligations, for tax, accounting, and responding to lawful requests; and consent, where we ask for it, such as for non-essential cookies where required and for marketing where the law requires opt-in. Where we rely on consent you may withdraw it at any time without affecting processing that occurred before withdrawal (Section 15). Where we process Customer Content as a processor, the customer organization determines the legal basis.

PMCollab is built on artificial intelligence. Many features send content to third-party AI model providers to generate output or take actions you request: for example, when you ask an agent to draft a specification, summarize a transcript, review code, research a market, generate an image or speech, or act in a connected system. The content sent is the content needed for the feature, which may include Customer Content and personal information in it.

Model providers process that content to return a response to us, under our agreements with them or, for bring-your-own credentials, under your organization's agreement with the provider. Which providers are used for which features is determined by the model panel your organization selects. The model providers we use are listed on our Subprocessors page at /subprocessors (Section 9).

Bring-your-own credentials. An organization may configure the Service to use its own model-provider accounts. Content sent through an organization's own credentials is governed by that organization's agreement with the provider, including the provider's retention and training practices, and not by our agreements.

Our training position. We do not use Customer Content, prompts, or AI output to train or fine-tune artificial-intelligence models that are made available to other customers or to the public. We may use Customer Content and AI interaction information to operate and improve the Service for your organization, including to evaluate the quality of AI output, debug problems, provide support, and detect abuse, subject to the telemetry content level your organization selects.

Telemetry content levels. We record operational telemetry about AI interactions so that we can run, support, and improve the Service. An organization's administrators choose how much content that telemetry retains: full content, digests, or no content. Telemetry is retained for a limited period described in Section 11.

AI output and decisions. AI output may be inaccurate or incomplete, and the Service is not designed to make decisions that produce legal or similarly significant effects on individuals without human review. Customers are responsible for the human oversight required by law for their use of AI features, as described in the Acceptable Use Policy.

You or your organization can connect the Service to third-party services, including source-control hosts, work-tracking and support tools, messaging and meeting platforms, calendars, customer-relationship and feedback tools, product-analytics systems, knowledge bases, low-code platforms, and sign-in providers such as Microsoft and GitHub. When a connection is made, we receive and store the information the third-party service makes available under the permissions you grant, which may include personal information about you and about other people in that service, such as your colleagues, customers, and meeting attendees.

The information we receive depends on the permissions you grant and the features you use. We use it to provide the feature you connected it for, to keep the connection working, and as your organization directs. Some features also write to connected services on your instruction. Your use of a connected service is governed by that service's own terms and privacy policy, and you can disconnect it at any time in the Service, which stops further collection but does not delete information already imported into Customer Content.

We do not sell personal information, and we do not share personal information with third parties for cross-context behavioral advertising or targeted advertising. We share personal information in the following circumstances.

Subprocessors and service providers. We use third-party providers that process personal information on our behalf to help us deliver the Service, including for cloud hosting and storage, AI models and inference, transactional and marketing email delivery, voice and messaging, meeting-audio and transcription services, analytics and session analytics, error and performance monitoring, and sandboxed code execution. These providers are contractually required to protect the information, to process it only to provide their services to us and consistent with our instructions and applicable law, and to maintain appropriate security. Our current subprocessors, and the model providers available on the platform, are listed on our Subprocessors page at /subprocessors; we update that page when providers change and notify customers as our agreements require.

Independent third-party providers. Some providers act as independent controllers of the information they receive, under their own privacy policies rather than on our instructions: our payment provider, Paddle, which as merchant of record sells subscriptions to you and processes your payment information; the sign-in provider you authenticate with (such as Microsoft or GitHub); and, where your organization brings its own model-provider credentials, that provider. We share with them only the information needed for the purpose, and we encourage you to review their privacy policies.

Your organization. We share information with the organization that administers your account, as described in Section 3.

Other users and Participants. Information you add to a workspace, product, or session is visible to the other members and Participants with access to it, according to the permissions your organization sets. Content that an administrator publishes to a public page, embeds in another site, or shares through a live-results or capability link is visible to anyone with access to that page or link.

Connected services. When you or your organization instructs the Service to write to a connected service, such as by opening a pull request, posting a comment, sending a message, or booking a meeting, the information in that action is shared with that service.

Legal and safety. We may disclose personal information if we believe it is reasonably necessary to comply with a law, regulation, legal process, or governmental request; to enforce our Terms and Acceptable Use Policy; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of PMCollab, our customers, or others. Where we are a processor, we will refer requests for Customer Content to the customer where legally permitted.

Business transfers. If PMCollab is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, personal information may be transferred as part of that transaction. It will remain subject to the protections of the privacy policy in effect at the time, and we will inform you if the successor's practices materially differ.

At your direction or with your consent. We share information for other purposes when you direct us to or consent.

We create de-identified and aggregated information from the operation of the Service, such as feature usage statistics, performance metrics, and AI-quality measurements, in a form that does not identify you, your organization, or your Customer Content. We may use and share such information for analytics, security, research, benchmarking, and improving the Service, subject to applicable law, and we commit to maintaining it in de-identified form and not attempting to re-identify it except to test our de-identification.

We keep personal information for as long as needed for the purposes described in this Policy, which generally means for as long as your account or your organization's account is active and for a limited period afterward, and for as long as necessary to comply with legal obligations, resolve disputes, maintain security, and enforce our agreements.

Customer Content is retained according to the customer organization's instructions and the Terms of Service, which describe export and deletion after an account is closed or the Terms are terminated. Ending a subscription does not by itself delete Customer Content. Workspaces may be archived and then deleted after periods of inactivity that depend on the plan; the current periods are shown in the Service and in our documentation, and your organization's administrators receive notice before archival and deletion. Administrators can delete workspaces, products, and content at any time, subject to a short pending period during which deletion can be reversed.

Operational logs and security records are retained for 30 days and AI usage telemetry for 90 days, after which they are deleted or de-identified. Where a feature keeps a longer record for a specific purpose, such as a usage ledger kept for billing, the period is stated in the Service or the Terms of Service. Billing and usage records are kept for as long as accounting and tax law require.

Backups. Deleted information may remain in backups for a limited period until those backups are overwritten or expire under our normal retention cycle. Backups are used only to restore the Service and are not accessed for other purposes.

We maintain reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and loss, including encryption in transit and at rest, access controls and role-based permissions, controls designed to isolate data between organizations, and logging and monitoring.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials and tokens confidential. If you suspect unauthorized access to your account or to Customer Content, please contact us immediately using the information in Section 19.

We use cookies, local storage, and similar technologies on our website and in the Service. Essential technologies keep you signed in, maintain your session, remember the access code or invitation you entered, recognize a Participant's browser so workspace rules can be enforced, and protect against abuse. Preference technologies remember settings such as your selected workspace, language, and interface options. Analytics and session-analytics technologies help us understand how the Service is used, including page views, feature usage, and recordings of how users interact with pages, so that we can diagnose problems and improve the product. Session-analytics tools do not see your passwords or payment details: you sign in with your identity provider and pay through our payment provider, on their pages rather than ours. The providers we use for analytics are listed on our Subprocessors page at /subprocessors. We do not use advertising cookies or tracking for targeted advertising.

You can control cookies through your browser settings, including by refusing or deleting them, and through any cookie-preference control we make available in the Service. Refusing essential technologies may prevent parts of the Service from working.

PMCollab is based in the United States, and we process and store personal information in the United States and in other countries where we or our subprocessors operate. These countries may have data-protection laws that differ from those of your country.

Where we transfer personal information from the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction that restricts international transfers, we will enter into a lawful transfer mechanism where one is required, such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, and we require our subprocessors to provide protections for onward transfers. You can request more information about the mechanism applicable to your transfer by contacting us.

Depending on where you live, you may have the right to: access the personal information we hold about you and receive a copy; correct inaccurate or incomplete information; delete your personal information; receive your information in a portable format; object to or restrict certain processing, including processing based on our legitimate interests; withdraw consent where our processing is based on consent, without affecting processing that occurred before withdrawal; opt out of marketing communications; and not be discriminated against for exercising your rights.

How to exercise your rights. Contact us using the information in Section 19. We may need to verify your identity and, where you act through an authorized agent, the agent's authority, before we fulfill a request, and we may ask for information needed to do so. We will respond within the time required by applicable law.

Appeals. If we decline to act on your request, you may appeal our decision by contacting us and stating that you are appealing. We will respond to your appeal within the period required by applicable law. If your appeal is denied, you may contact your state attorney general or, where applicable, your data-protection supervisory authority, and we will tell you how.

If you use the Service through an organization. Where the information you ask about is Customer Content that we process on behalf of a customer organization, we may refer your request to that organization, or ask you to submit it to that organization directly, because it controls the information. We will assist the organization in responding, as our agreement with it requires.

Marketing choices. You can unsubscribe from marketing email using the link in each message or by contacting us. We will continue to send transactional and service messages about your account.

Complaints. If you are in the European Economic Area, the United Kingdom, or another jurisdiction with a data-protection authority, you have the right to lodge a complaint with that authority. We would appreciate the chance to address your concern first.

The Service is a business product intended for professionals and is not intended for anyone under the age of 18. You must be at least 18 years old, or the age of majority where you live, to create an account, and customers may not invite anyone under 18 as a Participant. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information to us, please contact us and we will delete it.

The Service and our website may link to, embed, or interoperate with third-party websites and services that we do not operate, including the connected services described in Section 8 and the clients, such as AI assistants and code editors, through which you may reach the Service. This Policy does not apply to those third parties, and we encourage you to review their privacy policies.

We may update this Policy from time to time. When we do, we will post the revised Policy on this page and update the "Last Modified" date. If a change materially reduces your rights or changes how we use personal information we have already collected, we will provide additional notice, such as by email to account holders or a notice in the Service, before the change takes effect. We encourage you to review this Policy periodically.

If you have questions about this Policy or our privacy practices, or wish to exercise your rights, please contact us at:

Email: support@updates.pmcollab.ai

Mailing Address: 2301 E Pikes Peak Ave Ste 317, Colorado Springs, CO 80909 (El Paso County, Colorado)

Our Terms of Service govern your use of the Service, including how disputes between you and PMCollab are resolved. Nothing in this Policy or the Terms limits the rights you have under applicable privacy and data-protection law.