Privacy Policy

This Privacy Policy explains how PM Rewired ("we", "us") handles information when you use our websites and apps (the "Service"). It works together with our Terms of Service.

We wrote it for product managers and teams who want a clear picture of their data—not a wall of legal jargon. If anything here is unclear, email us at the address at the bottom of this page.

Account information: email address, authentication identifiers, and profile fields from our identity provider (Supabase Auth), including MFA enrollment status when you enable it.

Usage and billing: subscription tier, generation usage, workflow metadata, seat and workspace membership, and payment-related identifiers processed by Stripe (we do not store full payment card numbers on our servers).

Content you provide: text you submit to AI workflows, saved outputs, templates, and team-visible artifacts when you choose team visibility.

Demo and preview use: when you run an unauthenticated demo, we process the notes you paste and may store a pseudonymous visitor identifier (derived from network and browser signals, not your email) to enforce weekly demo limits.

Technical and security data: device and browser type, IP address, timestamps, and logs needed for security, rate limiting, debugging, and fraud prevention.

Product analytics: event names and properties you trigger in the app (for example billing page views or workflow completions) stored in our analytics tables.

Optional integrations: if you connect Jira Cloud via OAuth, we store access tokens and site metadata needed to perform actions you request until you disconnect.

To generate outputs, we send the prompts and context necessary for your request to configured large-language-model providers (for example OpenAI and/or Cohere, depending on plan and workflow).

We use these providers as subprocessors under our agreements with them. Their handling of data is also governed by their policies. We configure the Service to fulfill your requests; we do not use your submitted content to train our own models.

Do not submit special-category, health, or highly confidential personal data unless your organization has approved cloud AI tools for that material.

Marketing demos may be used without an account. Notes you submit in a demo are transmitted to our API and AI providers for generation. We retain a hashed visitor key and week identifier in our database to enforce fair-use limits—not your email unless you later create an account.

Demo outputs are not saved to your account history unless you sign in and run workflows under your plan.

Provide, maintain, and secure the Service; authenticate users; enforce plan and demo limits; process payments; deliver team invites; and comply with law.

Run AI workflows by sending necessary prompts to configured LLM providers.

Send transactional messages (for example sign-in links, password reset, billing notices, or team invites) through our email configuration (typically Supabase Auth SMTP and/or other providers we configure).

Monitor reliability and abuse using logs and error reporting (for example Sentry when enabled in an environment).

Improve the product using aggregated usage patterns and product analytics—not by selling your workflow content.

We share data with service providers that help us operate the Service—such as hosting, authentication, database, payments, AI, email, and observability—under contractual safeguards appropriate to their role.

Team-visible content is shared with other members of your workspace by design when you save with team visibility.

We may disclose information if required by law, to respond to valid legal process, or to protect rights, safety, and security.

We do not sell your personal information. We do not share personal information with third parties for their independent advertising purposes.

We rely on trusted partners to run PM Rewired. Depending on what you use, your data may be processed by: Supabase (sign-in and database); Stripe (payments); OpenAI and/or Cohere (AI generation); Sentry (error monitoring, when enabled); our cloud hosting providers; and Atlassian (only if you connect Jira).

Sign-in links, password resets, billing notices, and team invites may be sent through email providers configured in Supabase Auth or our API (for example Brevo).

If we add or change a major service provider, we will update this policy and note the change date at the top.

If you use a Team plan, account and usage metadata are associated with the workspace. Content you mark as team-visible is stored so other members of that workspace can access it per product design.

Team admins can see membership and aggregated usage analytics; they do not automatically receive the full text of every private Pro save unless you choose team visibility.

When you leave a team or are removed, your access to team-visible content ends; personal Pro content saved as private remains governed by your individual account settings.

Need help with security questions or a vendor review? Email support@pmrewired.com and we will point you to the right information.

We use cookies and similar technologies for authentication sessions (via Supabase Auth), security, and basic site functionality.

Free-tier workflow history stored only in your browser (local storage) is not synced to our servers until you upgrade and save new runs to your account.

Creating an account or signing in does not upload or migrate existing browser-only saves to the cloud.

We retain account, billing, and usage data while your account is active and as needed for billing, security, dispute resolution, and legal obligations. You may request deletion of your account by contacting support; some records (for example payment history) may be retained where required by law or Stripe record-keeping.

Cloud history begins when you upgrade to a paid plan and save new runs to your account. Older local-only saves remain on your device unless you export them yourself before upgrading or clearing browser storage.

Demo quota records use pseudonymous identifiers and are kept only as long as needed to enforce limits.

We use industry-standard measures including encrypted connections (HTTPS), access controls, and authenticated API access. Paid workflow routes and billing are protected by authentication and plan checks.

No method of transmission or storage is completely secure. Use judgment with highly sensitive material and follow your organization’s policies.

We may process and store information in the United States and other countries where we or our subprocessors operate. Those locations may have different data-protection laws than your country.

Where required, we rely on appropriate safeguards (such as standard contractual clauses or equivalent mechanisms offered by subprocessors) for cross-border transfers.

You can ask us to access, correct, delete, or export personal data we hold about you. Depending on where you live, you may also have rights to restrict certain processing or object to how we use your data.

We do not sell your personal information, and we do not share it with third parties for their own advertising.

To make a request, email support@pmrewired.com with "Privacy request" in the subject line and the email address on your account. We aim to respond within 30 days, or sooner where your local law requires it.

The Service is not directed to children under 16, and we do not knowingly collect their personal information. Contact us if you believe a child has provided personal data and we will take appropriate steps.

We may update this policy; we will post the revised version with an updated date. Material changes may be notified in-product or by email where appropriate.

Privacy questions or requests: support@pmrewired.com. Include "Privacy request" in the subject line and the email address associated with your account.