Privacy Policy

This Privacy Policy explains how ProposalBolt ("ProposalBolt", "we", "us" or "our") collects, uses, shares and protects personal data when you use our website, applications and services (the "Service"). We are committed to handling your data responsibly and in accordance with the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Information Technology Act, 2000 and its rules, and other Applicable Law. By using the Service you agree to this Policy. This Policy is part of, and should be read with, our Terms of Service.

In short: your data is yours. We collect what we need to run the Service, we do not sell your personal data, we use trusted processors to operate, and you have rights to access, correct, and delete your data. You can export or delete your workspace at any time.

1. Who we are and our role

ProposalBolt operates the Service and acts as a "Data Fiduciary" (controller) for the personal data of our account holders. When you upload or process the personal data of your own Clients or Recipients through the Service, you are the Data Fiduciary/controller for that data and we act as a Data Processor on your behalf and on your instructions. You are responsible for having a lawful basis and providing any required notices to those individuals.

2. Information we collect

• Account and profile data you provide: name, email address, password (stored only as a secure hash), workspace/organisation name, role, and optional business details such as logo, address, GSTIN and PAN.
• User Content: proposals, documents, templates, images and other content you create or upload, and the details of Clients and Recipients you add (such as their name, email and, where you choose, signature and identifiers).
• Signature and audit data: information generated when documents are signed, such as timestamps, IP address, email verification, and one-time passcode verification, used to build an audit trail.
• Payment-related data: billing details, plan, subscription and invoice records, and payout bank details you provide for receiving client payments (bank account numbers are stored encrypted). We do not collect or store full card numbers, CVV, UPI PINs or bank passwords — card and payment credentials are handled directly by our payment aggregator.
• Usage and device data: log data such as pages and features used, actions taken, approximate location derived from IP, browser and device type, and identifiers set through cookies and similar technologies.
• Communications: messages, support requests and feedback you send us.

3. How and why we use your information

We use personal data for the following purposes:

• to create and manage your account and workspace, and to provide, maintain and secure the Service;
• to enable core features you request, including creating, sending, e-signing and getting paid for documents, and AI-assisted drafting;
• to process Subscriptions, charge fees, issue GST invoices, prevent and detect fraud and abuse, and enforce limits and our Terms;
• to send transactional and service messages (such as verification, signing, payment, security and billing notifications);
• to provide support, respond to your requests, and improve, troubleshoot and develop the Service;
• to maintain records, audit trails, and comply with legal, tax, accounting and regulatory obligations; and
• to protect our rights, users and the public, and to establish, exercise or defend legal claims.

We may send you product updates and marketing about ProposalBolt where permitted; you can opt out at any time. We do not use your account for unrelated advertising, and we do not sell your personal data.

4. Legal bases and consent

We process personal data where you have given consent, where processing is necessary to provide the Service you have requested or to perform our contract with you, to comply with a legal obligation, or for our legitimate uses as permitted under the DPDP Act and other Applicable Law. Where we rely on consent, you may withdraw it at any time; withdrawal does not affect processing already carried out, and some features may not work without the related data.

5. Artificial intelligence processing

When you use AI Features, the prompts and relevant content you submit are sent to third-party AI model providers to generate output, and returned to you. This processing is to provide the feature you requested. We select providers that offer commercial terms intended to protect your data; where offered, we use configurations that do not permit the provider to use your content to train their general models. You remain responsible for the content you submit and generate. Do not submit sensitive personal data to AI Features unless necessary. See also our Terms of Service regarding AI output.

6. How we share information and our sub-processors

We do not sell your personal data. We share personal data only as needed to operate the Service:

• Service providers / sub-processors who process data on our behalf under contract, including: cloud hosting and application infrastructure; database, authentication and storage; payment aggregation and payouts; transactional email delivery; and AI model providers. These providers are permitted to use the data only to provide services to us.
• Your Recipients, who receive the documents and payment requests you send, and the information you include in them.
• Your workspace members, who can access shared workspace content according to their role.
• Legal and safety: where required by law, court order or regulator, or to protect the rights, safety and property of ProposalBolt, our users or the public, or to prevent fraud or abuse.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to appropriate confidentiality and continued protection of your data.

A current list of our principal sub-processors is available on request at privacy@proposalbolt.com.

7. Payment information

Payments are processed by a third-party payment aggregator that is certified to applicable security standards (such as PCI-DSS). When you pay us, or when your Clients pay you through the Service, your card, UPI, netbanking or other payment credentials are provided to and handled by that aggregator under its own terms and privacy policy. We receive limited confirmation and transaction data (such as payment status, amount, and an identifier) to operate the Service, reconcile payments and issue invoices. Payout bank account numbers you provide are stored in encrypted form.

8. Cookies and similar technologies

We use cookies and similar technologies that are strictly necessary to operate the Service (for example, to keep you signed in, secure your session, and remember preferences), and a limited amount of analytics to understand and improve usage. You can control cookies through your browser settings; blocking strictly necessary cookies may prevent the Service from working. We honour applicable choices regarding non-essential cookies.

9. Data retention

We retain personal data for as long as your account is active and as needed to provide the Service, and thereafter as necessary to comply with our legal, tax and accounting obligations, resolve disputes, maintain security and audit trails, and enforce our agreements. When data is no longer required, we delete or anonymise it. Financial records and tax invoices are retained for the periods required by law. Backups are retained for a limited period and then overwritten.

10. How we protect your data

We implement reasonable technical and organisational measures to protect personal data, including encryption in transit and at rest, encryption of sensitive fields such as payout account numbers, row-level access controls that isolate each workspace, hashed passwords, support for multi-factor authentication, least-privilege administrative access, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; you are responsible for keeping your credentials safe.

11. International data transfers and data residency

We primarily process and store data on infrastructure intended to serve users in India. Some of our sub-processors may process limited data outside India. Where data is transferred across borders, we do so in accordance with the DPDP Act and Applicable Law and take steps to ensure appropriate protection. By using the Service, you acknowledge such processing where it occurs.

12. Your rights

Subject to the DPDP Act and other Applicable Law, you have the right to:

• access a summary of the personal data we process about you and how we process it;
• correct, complete or update inaccurate or incomplete personal data;
• erase your personal data where it is no longer required, subject to legal retention;
• withdraw consent where processing is based on consent;
• nominate another individual to exercise your rights in the event of death or incapacity;
• grievance redressal — to have your complaint addressed by us; and
• export your workspace data in a portable format.

You can exercise many of these directly in your account settings, including exporting your data and deleting your account. To make any other request, contact us at privacy@proposalbolt.com. We may need to verify your identity, and we will respond within the timelines required by Applicable Law. If your request concerns data you uploaded about your own Clients, we may direct you to the relevant account holder, who is the controller of that data.

13. Children

The Service is intended for use by adults (18 years and older) and is not directed to children. We do not knowingly collect personal data of children. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

14. Data breach notification

If we become aware of a personal data breach that affects you, we will notify the appropriate authority and affected users as required by, and within the timelines set out in, the DPDP Act and Applicable Law, and take reasonable steps to mitigate it.

15. Third-party links and services

The Service may link to or integrate with third-party websites and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. Review their policies before providing them your data.

16. Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy with a new "Last updated" date and, where changes are material, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance.

17. Grievance Officer and how to complain

If you have any concern or complaint about how we handle your personal data, please contact our Grievance Officer / Data Protection contact at grievance@proposalbolt.com. Please include enough detail for us to identify you and understand your concern. We will acknowledge and address complaints within the timelines required by the DPDP Act and Applicable Law. If you are not satisfied with our response, you may have the right to escalate your complaint to the Data Protection Board of India or other competent authority.

18. Contact

For privacy questions or requests, contact privacy@proposalbolt.com. For general support, contact support@proposalbolt.com.