Skip to content

Privacy policy

Last updated 15 October 2026

This policy explains what personal data Proposora collects, why, where it is kept and what you can do about it. Proposora is operated by AATTRL (“we”), India. It is written in plain English on purpose; if anything is unclear, ask us from the contact page.

1. What we collect

  • Account data: your name, email address and password hash when you sign up; your profile settings.
  • Organisation data: business name, legal name, GSTIN, PAN, address, contact details, logo, bank details, brand colours and document settings that you enter.
  • Content you create: customers, quotations, line items, prices, your private costs, invoices, templates, follow-ups, notes and files you upload.
  • Customer data you enter about others: names, companies, emails, phone numbers and GSTINs of your customers. You are responsible for having a lawful basis to enter it; we process it on your behalf.
  • Usage and technical data: pages visited within the app, actions taken (for the audit log), approximate device and browser type, and a salted hash of your IP address used for rate limiting and abuse prevention. We do not store raw IP addresses in application tables.
  • Share-link events: when a customer opens a quotation link, we record the time and a hashed IP to show you view counts and to limit abuse.
  • Support messages: what you send through the contact form or by email.
  • Billing records: plan, payment reference, invoice details. We do not collect or store card numbers; there is no card on file.

2. Why we use it

  • To provide the service: creating, storing, rendering and sharing your documents and running your account.
  • To compute entitlements and AI quotas for your plan or the Founders' Offer.
  • To send transactional emails: confirmations, share notifications, acceptance alerts, due follow-ups, billing reminders and invoices.
  • To prevent abuse and keep the service available, using rate limits based on hashed identifiers.
  • To respond to support requests.
  • To understand aggregate usage so we can improve the product. We use privacy-conscious analytics that do not build cross-site profiles.

We do not sell personal data, and we do not share it with advertisers.

3. The AI copilot

When you ask the AI copilot to draft or improve text, the requirement, the current document's sections, item descriptions and summary totals are sent to our AI provider (Anthropic) to generate the draft. Your private costs are not sent. The provider processes the request to return a response and, under our agreement, does not use it to train models. We record the number of tokens and the cost per generation to manage quotas. The AI never calculates money and never receives card or bank details.

4. Where data is stored

Application data is stored in a managed Postgres database and object storage provided by Supabase, with row-level security so that each organisation can only read its own rows. Generated PDFs and uploaded proofs of payment are in private storage; logos are in a public-read image bucket so they can appear on the pages your customers open. The application runs on Vercel. Email, when enabled, is sent through Resend. Each of these providers processes data on our behalf under their terms and security commitments. Data may be stored or processed outside India by these providers; we choose regions and providers with strong security practices and contractual safeguards.

5. Who can see your data

  • Members of your organisation, according to their role.
  • People you share a link with can see the quotation or invoice at that link, never your costs or margins. You can revoke a link at any time.
  • A small number of AATTRL staff with administrative access, for support and operations, under confidentiality obligations and with actions logged.
  • Service providers listed above, only to the extent needed to run the service.
  • Authorities, if required by law.

6. How long we keep it

For as long as your account or organisation exists. When you request deletion, we complete it within 7 days; data is then removed from live systems and leaves provider backups within their retention window. Billing records for payments you made are kept as required by Indian tax law. Audit and security logs are kept for up to 12 months. Support messages are kept for up to 24 months.

7. Your choices and rights

  • Access and export: Settings → Profile → Export my data downloads a JSON file of your profile and your organisations' data immediately.
  • Correction: edit your profile and organisation settings at any time.
  • Deletion: Settings → Profile → Delete account creates a request that we complete within 7 days, or write to us from the account email. We verify identity before acting.
  • Marketing email: we send very little. Every such email has an unsubscribe link; transactional emails about your account continue.
  • Cookies: we use strictly necessary cookies for sign-in, the current organisation, and a 30-day referral cookie when you arrive through a referral link. No advertising cookies.

We honour the rights available under India's Digital Personal Data Protection Act, 2023 and, for users elsewhere, comparable rights under their local law.

8. Billing and payments

Paid plans are billed manually during launch. You pay by UPI or bank transfer and we activate the plan after verifying the payment. We do not take card details and nothing is charged automatically. Payment references you share with us are kept with billing records.

9. Security

Data is encrypted in transit (TLS) and at rest by our providers. Access is controlled by row-level security in the database, role-based permissions in the app and multi-factor authentication for staff. Share tokens are stored only as hashes. If we become aware of a breach affecting your data, we will tell you and the relevant authority as required.

10. Children

Proposora is for businesses and is not intended for anyone under 18.

11. Changes

We will post changes here with a new date and, for material changes, notify account owners by email.

12. Contact

AATTRL, India. Write to us from the contact page or by email at the address shown there. Please mention “Privacy” in the subject for data requests.