01Information we collect

We collect the information you give us directly (account info, invoice data) and a small amount of technical info collected automatically when you use the site.

Information you provide directly

When you create an account, contact us, or use the Services, we may collect:

• Account information: email address, password (hashed), and any name or job title you choose to provide.
• Invoice and project data: client names, billing addresses, phone numbers, project details, line items, rates, and any other information you enter into invoices, kit lists, or rate calculators. This data is stored locally in your browser (via localStorage). If you create an account and sign in — free or paid — it is also synced to our servers under your account, encrypted in transit, and accessible only to you, so it's available on any device you sign into.
• Communications: any email or message content you send to us.
• Marketing preferences: if you sign up for our newsletter or rate-update emails, we collect your email address and your preferences.

Payment information

If you purchase a paid plan, our payment processor Stripe collects and processes your payment details (card number, billing address, CVC). We never see, store, or have access to your full card number. Stripe's privacy practices are described at https://stripe.com/privacy.

Information collected automatically

Like most websites, we collect certain information automatically when you visit:

• Log and usage data: IP address, browser type and version, operating system, referring URLs, device characteristics, pages viewed, clicks, scrolls, session duration, and timestamps.
• Device data: hardware model, screen size, language preference, time zone.
• Approximate location: derived from your IP address (typically city or region level — not precise GPS).

For more on cookies and similar technologies, see our Cookie Policy.

Sensitive personal information

We do not collect sensitive personal information such as racial or ethnic origin, political opinions, religious beliefs, health information, biometric data, sexual orientation, or government-issued IDs (other than what may appear in invoice data you choose to enter).

Information from third parties

We do not collect personal information about you from third-party sources.

02How we use your information

To run the Services, communicate with you, prevent fraud, and comply with the law.

We process your information for the following purposes:

• Provide the Services: create and maintain your account, save and render your invoices, send you the documents you generate.
• Process payments: charge subscription fees through Stripe.
• Customer support: respond to your questions, troubleshoot issues, and act on your requests.
• Send service-related messages: account confirmations, password resets, billing notices, security alerts, and policy updates.
• Send marketing communications (only if you opt in): rate update emails, product news, and promotional offers. You can unsubscribe at any time.
• Improve the product: analyze how the Services are used, debug errors, measure feature performance.
• Prevent fraud and abuse: detect and respond to security incidents, prevent unauthorized access, and enforce our Terms of Service.
• Comply with the law: respond to legal requests, exercise legal rights, and meet regulatory obligations.

03Legal bases for processing (EU/UK users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal information under the following legal bases under the GDPR or UK GDPR:

• Consent: when you opt in to marketing emails or non-essential cookies. You can withdraw consent any time.
• Performance of a contract: to provide the Services you signed up for and process your payments.
• Legitimate interests: to run, secure, and improve the Services; to understand how customers use the product; to communicate with you about your account.
• Legal obligations: to comply with tax, accounting, and other applicable laws.
• Vital interests: in rare cases, to protect a person from serious harm.

04When and with whom we share information

Only with the service providers that help us run the app — never with advertisers, data brokers, or anyone else for money.

We share personal information only in these limited circumstances:

Service providers

We use the following third-party service providers, all of whom are contractually bound to protect your data and use it only for the purposes we instruct:

• Stripe — payment processing. Privacy policy
• Microsoft Clarity — anonymous analytics and behavior insights (heatmaps, session recordings with PII redaction). Privacy policy
• Vercel — website hosting and content delivery. Privacy policy
• Web3Forms — form submissions and email capture. Privacy policy
• Supabase — account authentication and encrypted data storage. Privacy policy
• Resend — transactional email delivery (e.g. payment reminders and signing links you initiate). Privacy policy
• Groq, Inc. — hosted document-parsing infrastructure. When you upload a document for automated field extraction and our on-device parser cannot complete the extraction, the document's text (and only its text — no file, no account identifiers) may be transmitted to this provider solely to complete the extraction you requested, and is not used for any other purpose. Privacy policy

Legal requirements

We may disclose your information when required by law (subpoena, court order, government request) or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers

If we are acquired, merged, or sell substantially all of our assets, your information may be transferred as part of that transaction. We will notify you of any such change and your choices.

What we don't do

We do not sell your personal information. We do not share your information with advertisers, data brokers, or marketing networks. We have no advertising partners.

05Cookies and tracking technologies

We use cookies, local storage, and similar technologies to keep the Services running, remember your preferences, and understand how the site is used. For full details — including a list of every cookie we use, what it does, and how to opt out — see our Cookie Policy.

06International data transfers

Our servers and the servers of our service providers are located in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the U.S. and other countries where our service providers operate.

For transfers of personal data from the EEA, UK, or Switzerland to the United States, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the legal mechanism. We have implemented appropriate safeguards with each of our service providers; further details are available on request.

07How long we keep your information

We keep your personal information only as long as we need it for the purposes described in this Policy:

• Account data: for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 90 days, except where we are required to retain it (e.g., for tax, billing, or accounting records — typically up to 7 years).
• Invoice and billing records: retained for up to 7 years to comply with tax and accounting laws.
• Analytics and usage data (Microsoft Clarity): retained for up to 1 year, then automatically deleted.
• Marketing email lists: until you unsubscribe.
• Support communications: up to 2 years.

08How we protect your information

We use industry-standard administrative, technical, and physical safeguards to protect your personal information, including:

• Encryption in transit via HTTPS/TLS.
• Encryption at rest by our service providers (Vercel, Stripe, Microsoft).
• Access controls limiting who on our team can access user data.
• Regular review of our service providers and security practices.

That said, no method of transmission or storage is 100% secure. We cannot guarantee absolute security, and you use the Services at your own risk. If we ever experience a data breach involving your personal information, we will notify you in accordance with applicable laws.

09Children and minors

The Services are not intended for or directed to anyone under 18 years of age. We do not knowingly collect personal information from children under 18. If you become aware that a child has provided us with personal information, please contact us at support@productionledger.com and we will delete it.

10Your privacy rights

You have the right to access, correct, delete, port, or object to our processing of your personal information.

Depending on where you live, you may have the following rights:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate or incomplete information.
• Deletion — request that we delete your personal information.
• Portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to limit how we use your information.
• Objection — object to certain processing (e.g., for direct marketing).
• Withdraw consent — for any processing based on consent.
• Lodge a complaint — with your local data protection authority (e.g., EEA, UK, or Switzerland).

How to exercise your rights

To make a request, email support@productionledger.com with the subject line "Privacy Request." We will respond within 30 days (or as required by your local law). We may need to verify your identity before fulfilling certain requests.

Marketing opt-out

You can unsubscribe from marketing emails any time by clicking the unsubscribe link at the bottom of any marketing email, or by emailing us. Unsubscribing from marketing emails will not affect service-related messages necessary to operate your account.

Account deletion

You can delete your account by emailing support@productionledger.com. We will deactivate your account and delete or anonymize your personal data within 90 days, subject to retention requirements described above.

11Do Not Track and Global Privacy Control

Do Not Track (DNT): there is no widely accepted standard for how websites should respond to DNT signals. We do not currently respond to DNT browser signals.

Global Privacy Control (GPC): we recognize and honor GPC signals. If your browser sends a GPC signal, we treat it as a valid request to opt out of any "sale" or "sharing" of your personal information for targeted advertising purposes under applicable U.S. state laws. Learn more at globalprivacycontrol.org.

12U.S. state privacy rights

If you live in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you have additional rights under your state's privacy law.

Categories of personal information we collect

In the past 12 months we have collected the following categories of personal information:

Sources of personal information

We collect personal information directly from you (when you sign up, contact us, or use the Services) and automatically through cookies and analytics tools.

How we use and share personal information

See sections 02 (How we use your information) and 04 (When and with whom we share information) above.

Sale or sharing of personal information

In the preceding 12 months we have not sold or shared your personal information for advertising purposes (as those terms are defined under the CCPA/CPRA and similar state laws). We do not engage in cross-context behavioral advertising.

Your rights under U.S. state laws

Subject to your state's law, you may have the right to:

• Know whether we are processing your personal data and access a copy.
• Correct inaccuracies in your personal data.
• Delete your personal data.
• Obtain a portable copy of your data.
• Opt out of the sale, sharing, or targeted advertising use of your personal data (we do not engage in any of these).
• Limit our use of sensitive personal information (we do not collect any).
• Not be discriminated against for exercising your rights.
• Appeal our decision if we deny your request.

How to exercise your rights

Email support@productionledger.com with "Privacy Request" in the subject line. We will respond within the timeframe required by your state's law (generally 45 days, with one possible extension). You may also designate an authorized agent to make a request on your behalf; we will require proof of authorization.

Appeals

If we deny your request, you may appeal by emailing support@productionledger.com with "Privacy Appeal" in the subject line. If the appeal is denied, you may file a complaint with your state attorney general.

California "Shine the Light"

California residents may request a list of third parties to whom we have disclosed personal information for direct marketing purposes during the prior calendar year. We have not disclosed personal information to any third parties for their own direct marketing purposes.

13Updates to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent version. If we make material changes, we will notify you by email or by posting a prominent notice on the Services before the changes take effect. We encourage you to review this Policy periodically.

14Contact us

If you have questions, concerns, or requests about this Privacy Policy or our handling of your personal information, please contact us:

Email: support@productionledger.com