Privacy policy

PropoBox is operated by Kodfabrika LLC, a New Mexico limited liability company ("PropoBox," "we," "us," or "our"). Two roles matter in this policy.

Your account: for the information about you and your account (sign-in details, billing, how you use the Service, support requests), PropoBox is the controller.

The proposals you send: a proposal can hold personal data about your clients and about the people who open, read or sign it. You decide what goes into a proposal and who receives it, so for that data you are the controller and PropoBox is your processor. We handle it only to provide the Service to you, as described under "Data we handle for you".

If you received a proposal through PropoBox, see "If you received a proposal".

Account information: your name, email address and password (we keep a password only as a hash, never in plain text), profile details you add such as a company name, and your plan and usage. If you sign in with Google, we receive your name and email address from Google.

Payment information: payments are handled by Stripe. We receive your plan, subscription status and billing email. Card numbers stay with Stripe and we never see or store them.

What you create: proposals, templates, line items, terms, agreements you write or upload as a PDF, logos, drafts you paste or upload for import, and the details of your clients that you enter, such as names, email addresses, companies and phone numbers.

Signatures and decisions: when a recipient accepts or declines, we record their name, their typed or drawn signature, an email address if they give one for a copy, any note or reason they write, the wording they agreed to, the date and time, the IP address and browser details used, and a fingerprint of exactly what they accepted. This is kept as evidence for both sides.

Reading data about recipients: when someone opens a proposal page we record that it was opened, when the visit started and was last seen, how many seconds the page was visible in total and per section, and a broad device type (desktop, mobile or tablet). To tell one visit from another we store a one-way hash made from the IP address, the browser details and the proposal. We do not store the raw IP address or browser details for this, and no cookie is used for it. The sender's own previews are not counted.

Email delivery data: for the emails we send on your behalf (proposals, reminders, notes), our email provider tells us whether each one was delivered, opened, clicked or bounced.

Support and feedback: tickets, messages, ratings and comments you send us.

Technical data: IP address, browser, device, pages requested and error reports, used to run and secure the Service and to find bugs.

Analytics: product analytics and session recordings, only if you accept analytics cookies (see our Cookie Policy).

AI inputs: text you submit to AI drafting or draft import.

We use personal data to:

• Provide the Service: create, send and track proposals, record signatures, show you how proposals were read and send the emails you ask for. (Performing our contract with you.)
• Take payments, manage subscriptions and prevent fraud and abuse. (Contract and our legitimate interest in keeping the Service safe.)
• Keep the Service secure, fix errors, and keep records of signed proposals. (Legitimate interests and legal obligations.)
• Give support and respond to your questions. (Contract and legitimate interests.)
• Send service emails such as receipts, security and account notices, and product updates where you have asked for them. (Contract, and consent or legitimate interests as the law allows.)
• Measure and improve the Service with analytics. (Your consent.)
• Comply with the law. (Legal obligation.)

We do not make decisions about you by automated means that have legal or similarly significant effects.

When you put personal data about your clients or signers into PropoBox, we act as your processor. We:

• Process it only to provide the Service and on your instructions, which are what you create, send and delete in the product and what you tell us in writing.
• Keep it confidential and limit access to the people who need it to run and support the Service.
• Use only the service providers listed below, each bound by terms that limit its use of the data.
• Help you answer people who exercise their rights, for example by exporting or deleting a proposal.
• Tell you without undue delay if we learn of a breach that affects it.
• Delete it when your account is deleted, as set out under "Data retention".

You are responsible for having a lawful basis to enter that data and to send it to the people you choose, and for telling your recipients what you do with it where the law requires. If you need a data processing agreement, email hello@propobox.com.

A PropoBox user sent you a proposal and chose to send it to you; they entered your name and email address. The sender decides why and how your data is used.

The sender can see whether and when you opened the proposal, how long you read it and which sections you spent time on, whether you accepted or declined, and anything you typed when you did. We measure this without cookies and the proposal page shows no cookie banner. If you sign, we keep your name, your signature, your email address if you give one, and the IP address and browser used, as evidence of what you agreed to. You and the sender can download the signed copy.

To ask what the sender holds about you, or to have it corrected or deleted, contact the sender first. You can also write to hello@propobox.com and we will pass your request on or act on it, as the law allows.

We do not sell or rent your personal information, and we do not share it for advertising across other companies' sites. We share it with:

The people you choose: proposals, signed copies and emails go to the recipients you send them to. Anyone who has a proposal link can open that proposal, so share links with care.

Service providers that help us run the Service, each limited to providing its service to us:
• Supabase: database, sign-in and file storage
• Vercel: hosting, and cookieless traffic and page-speed statistics
• Stripe: payments and subscriptions
• Resend: sending email and reporting its delivery
• Anthropic: AI drafting and draft import, and the Claude connector if you use it
• Sentry: error monitoring
• Google: signing in with Google if you choose it, and Google Tag Manager with any measurement tags loaded through it, only with your consent
• PostHog and Microsoft Clarity: product analytics and session recordings, only with your consent

Legal requirements: when the law, a court order or a valid request requires it, or to protect the rights, property and safety of PropoBox, our users or others.

Business transfers: if PropoBox is part of a merger, acquisition or sale of assets, your data may be transferred as part of that deal, and we will tell you if it changes who handles it.

If you use AI drafting or import a draft, the text you submit (for example a description of a project, or a proposal you paste or upload) is sent to Anthropic's API, which returns the result. Anthropic processes it under its commercial terms, which do not allow it to train its models on this content. We do not use the content of your proposals to train AI models. The result is stored in your account like anything else you create.

AI output can be wrong or incomplete, so read it before you send it. Do not submit personal data you are not allowed to share with a service provider.

We use security measures that fit the risk:

• Data is encrypted in transit using TLS (HTTPS)
• Data at rest is encrypted using AES-256
• Access to production systems is restricted and logged
• Each account can only read its own data, enforced in the database
• Security reviews of the code and the database access rules
• Incident response procedures for security events

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. See our Security page for more.

Your account and what you created stay for as long as your account is active.

When a trial or a subscription ends, your account moves to the Free plan. We do not delete your data because a trial or subscription ended.

Deleting your account: email hello@propobox.com from the address on the account. We delete or anonymize your personal data and your content within 30 days, except what we must keep by law, such as billing records kept for tax and accounting. Copies already delivered to recipients, such as emails and signed PDFs, remain theirs.

Signature records and reading data are kept with the proposal they belong to, as evidence, until the proposal or the account is deleted.

Backups: deleted data can remain in encrypted backups until they expire in their normal cycle.

We use cookies and similar storage to keep you signed in, remember small preferences and, only if you accept, understand how the Service is used. Our Cookie Policy lists them and explains how to change your choice at any time.

Depending on where you live (for example under the GDPR, the UK GDPR or California law), you may have the right to:

• Access: get a copy of the personal data we hold about you
• Correction: have inaccurate or incomplete data corrected
• Deletion: have your personal data deleted
• Portability: receive your data in a machine-readable format
• Restriction and objection: limit or object to processing, including processing based on legitimate interests
• Withdraw consent: at any time, without affecting what happened before, for example by changing your cookie settings

To use any of these rights, email hello@propobox.com. We may need to confirm who you are, and we will respond within 30 days. We do not treat you differently for using your rights.

California: in the last 12 months we collected identifiers (such as name, email and IP address), commercial information (your plan and billing), internet activity (how you use the Service) and the content you provide, for the purposes above. We do not sell personal information or share it for cross-context behavioral advertising. You can ask to know, correct or delete your personal information, and an authorized agent can ask for you.

If you are not satisfied with our response, you can complain to your local data protection authority.

PropoBox operates globally and our providers may process data in the United States and other countries. If you are in the European Economic Area, the United Kingdom or Switzerland, we transfer personal data only with appropriate safeguards, such as the standard contractual clauses approved by the European Commission.

The Service is for business use and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If we learn we have, we will delete it promptly. If you believe we have collected data from a child, please contact us.

The Service may link to third-party sites, including payment pages you add to a proposal. We are not responsible for their privacy practices or content, and we encourage you to read their policies.

Where you have asked for them, we may send product updates and news. You can unsubscribe at any time with the link in the email or by writing to hello@propobox.com. We still send essential account and service messages.

If you connect PropoBox to Claude, an AI assistant made by Anthropic, you approve access on a PropoBox page and Claude receives an access token for your account. With it, Claude can read your proposals, clients, saved templates, follow-up list and reading data, create drafts (also from a saved template or a past proposal, with their terms and your agreement), and, when you ask, send proposals and follow-ups, extend a proposal's date, or record that a deposit arrived.

What we receive: only what Claude sends to a PropoBox tool to carry out your request, for example the title and prices of a draft, or the text of an agreement you ask it to attach. We do not receive or store your conversations with Claude.

Use and storage: the result is stored in your account like anything you create yourself, and each change made through the connector is recorded with the tool's name and time, for security and support.

Sharing: the data PropoBox returns to Claude is processed by Anthropic under its own terms and privacy policy. We do not share it with anyone else.

Retention: connector records are kept as long as your account and are deleted with it. Revoking the connection under Settings, Connected apps, ends Claude's access at once.

Contact: hello@propobox.com.

We may update this Privacy Policy to reflect changes in our practices or the law. For material changes we will tell you by email or in the Service before they take effect. The date at the top of this page shows when it was last updated.

If you have questions or requests about this Privacy Policy or your personal data, contact us at:

Email: hello@propobox.com
Address: Kodfabrika LLC, 1209 Mountain Road PL NE STE N, Albuquerque, NM 87110, USA

For EU/EEA and UK residents, you also have the right to lodge a complaint with your local data protection authority.