Privacy Policy

1.Who we are

pmmRush, Inc., a Delaware corporation, is the data controller for the personal data described in this policy when you visit pmmrush.com or use the pmmRush platform. For content your company uploads into its workspace, your company is the controller and we are its processor; that relationship is governed by our Data Processing Addendum.

Questions and requests: privacy@pmmrush.com.

2.What we collect

Account data

Name, work email, profile picture (if you sign in with a provider that supplies one), workspace name, and your role. Identity is handled by our authentication provider.

Billing data

Billing name and address, tax identifiers you provide, subscription plan, seat count, and invoice history. Card numbers go directly to our payment processor and are never stored on our systems.

Terms acceptance

The version of the Terms you accepted, the time, and the IP address at checkout. We keep this as an audit record of the agreement.

Workspace content

Documents, roadmaps, product data, and other material your workspace uploads or connects, and the outputs the platform generates from them. This may incidentally include personal data your company chooses to include.

Usage data

Product events (pages viewed, features used, drafts approved or rejected), device and browser type, and approximate location derived from IP. Inside the app we collect this with our own first-party telemetry. On the marketing site we also use Google Analytics, only with your consent (see Cookies).

Support and marketing

Messages you send us, waitlist sign-ups (email, intent, and the tools you use today), and demo requests.

3.Why we use it

• To provide the Service: run your workspace, process your content, generate outputs, and deliver professional services you buy. Basis: performance of our contract with you.
• To bill you: charge subscriptions, collect tax, send invoices, and recover failed payments. Basis: contract and legal obligation.
• To keep the Service secure and working: authentication, abuse prevention, debugging, and capacity planning. Basis: legitimate interests.
• To improve the Service: understand which features are used and how drafts are corrected. We use structural signals for this, not your raw text. Basis: legitimate interests.
• To communicate: service notices, billing alerts, and, if you opt in, product news. You can unsubscribe from marketing at any time. Basis: contract, consent for marketing.
• To comply with the law: tax records, responding to lawful requests. Basis: legal obligation.

4.AI processing

The platform uses AI models to extract structure from documents, embed content for search, and draft marketing assets. These calls go only to providers contracted under Zero Data Retentionterms: they may not store your content beyond the request or use it to train their models. We do not log prompts in plaintext, and we do not use one customer’s raw content to train models for another.

5.Who we share it with

We do not sell personal data. We share it only with:

• Sub-processors that host and run the Service on our behalf (cloud hosting, database, identity, payments, AI providers, workflow infrastructure). The current list, with locations and purposes, is at /sub-processors.
• Consultants delivering a professional-services engagement you purchased, limited to what the engagement needs and bound by confidentiality.
• Members of your own workspace, who can see your name, email, and activity inside that workspace.
• Authorities and advisers where the law requires, or to protect our rights, and a successor in a merger or acquisition.

6.Cookies

Strictly necessary cookies keep you signed in and remember your interface preferences, such as light or dark mode. They are always on.

Analytics cookies are off until you accept them. On the marketing site we use Google Analytics to see which pages are useful. Before you choose, Google Analytics runs in a cookieless mode that stores nothing on your device and does not identify you. If you accept, it sets its own cookies (for example _ga) to recognize repeat visits; IP addresses are truncated. If you decline, it stays cookieless. You can change your cookie choice at any time. We do not use advertising cookies or cross-site tracking, and our product telemetry inside the app is first-party.

7.How long we keep it

• Account and workspace content: for as long as the workspace exists. When a workspace is deleted, or on written request within 30 days of termination, we delete it from active systems, subject to backup rotation.
• Billing records and terms-acceptance audit: for as long as tax and contract law require, typically seven years.
• Raw usage events: 18 months, after which only aggregated statistics remain.
• Support and marketing contacts: until you ask us to stop, or three years after our last contact.

8.International transfers

Our systems are hosted in the United States. If you are in the European Economic Area, the United Kingdom, or Switzerland, transfers of your personal data rely on the EU Standard Contractual Clauses (and the UK Addendum) with our sub-processors, and on our Data Processing Addendum with your company. We can provide copies on request.

9.Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to certain processing, and to withdraw consent. California residents have the rights set out in the CCPA, including the right to know and delete, and the right not to be discriminated against for exercising them. We do not sell or share personal data for cross-context behavioral advertising.

To exercise a right, email privacy@pmmrush.com from the address on your account. We respond within 30 days. If your data sits inside a company workspace, we may direct the request to that company as controller. You can also complain to your local data protection authority.

10.Security

Every workspace is isolated at the database layer with row-level security, so one customer’s data is never visible to another. Data is encrypted in transit and at rest. Access to production is limited to staff who need it and is logged. Details for security reviews are available from security@pmmrush.com. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you without undue delay.

11.Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.

12.Changes to this policy

We will post updates here with a new version number and date, and notify workspace administrators of material changes before they take effect.