Privacy Policy

1. Introduction

pmmAgent is a B2B SaaS platform that elevates raw product marketing briefs into structured, PMM-grade AI Briefings. Our platform helps product marketers produce higher-quality outputs from AI tools by transforming their briefs before they reach any AI model.

We take privacy seriously. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have. If you have any questions, please contact us at privacy@pmmagent.ai.

2. Information We Collect

We collect the following categories of information:

Account information

• Your name, email address, and profile picture, collected when you sign in via Google or LinkedIn OAuth
• Your organisation name and job title, if provided during onboarding

Content you submit

• Product marketing briefs, documents, and any other content you submit for analysis or elevation through the platform
• Brand voice documents and corporate guidelines you upload to configure your workspace
• AI Briefings generated by the platform and stored in your history

Technical data

• IP address, browser type, device type, and operating system
• Pages visited, features used, and timestamps of interactions
• Error logs and performance data

We do not collect payment card information directly. Any payment processing is handled by our third-party payment processor under their own privacy terms.

3. How We Use Your Information

• To provide the service: Your briefs and documents are processed to produce AI Briefings. This is the core function of the platform.
• To maintain your account: Account information is used to authenticate you, manage your workspace, and store your generation history.
• To improve our service: We may use aggregated, anonymised usage patterns to understand how the platform is used and to improve AI model performance and briefing quality. We do not use your personally identifiable content to train AI models without your explicit consent.
• To communicate with you: We send transactional emails (account activity, access notifications, service updates). We do not send marketing communications without your explicit consent.
• To comply with legal obligations: We may process data to meet applicable legal or regulatory requirements.

4. Google API Services

pmmAgent's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. When you connect Google services (such as signing in with Google or accessing Google Docs), we only access the specific files and data necessary to provide the requested features. We do not share Google user data with third parties except as strictly necessary to provide the service. We do not use Google user data for advertising purposes.

Specifically: Google OAuth is used solely for authentication. If you grant access to Google Drive or Docs, we access only the documents you explicitly select. We do not scan, index, or access any files you have not directly shared with the platform.

5. Data Storage and Security

• User account data and generation history are stored in Supabase (PostgreSQL), hosted in the United States.
• Authentication tokens and identity data are managed by Firebase Authentication, operated by Google LLC.
• All data is encrypted in transit using TLS 1.2 or higher. Data at rest is encrypted using AES-256 or equivalent standards as provided by our hosting infrastructure.
• Access to production data is restricted to authorised personnel only, governed by least-privilege principles.

6. Data Retention

• Account data: Retained while your account is active. If you close your account, account data is permanently deleted within 30 days.
• Uploaded documents and brand files: Retained until you delete them or close your account.
• Generation history (AI Briefings): Retained while your account is active. Items moved to trash are permanently deleted within 30 days, consistent with our in-app restore window.
• Usage and access logs: Retained for 90 days for security, debugging, and operational purposes.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data and close your account
• Export your data in a portable format
• Object to or restrict certain types of processing
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at privacy@pmmagent.ai. We will respond within 30 days.

8. Third-Party Services

We work with the following third-party providers to operate the platform. Each processes data only as necessary for the specific purpose listed:

• Google — Authentication (OAuth 2.0), Google Docs integration
• LinkedIn — Authentication (OAuth 2.0)
• Supabase — Database hosting (PostgreSQL, US-based)
• Firebase / Google — Authentication and identity management
• Resend — Transactional email delivery
• Google Gemini / Vertex AI — AI model processing. When you submit a brief for elevation, its content is sent to Google's AI models. Google's data processing terms apply. We do not send personally identifying information as part of the AI prompt beyond what you include in your own brief.

9. Cookies

We use session cookies and local storage tokens solely for authentication (to keep you signed in). We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice in the platform. Continued use of the service after notice constitutes acceptance of the updated policy.

11. Contact

For privacy enquiries or to exercise your rights: privacy@pmmagent.ai