This Policy explains how APPWZRD LLC, doing business as PPMWizard (“PPMWizard,” “we,” or “us”), collects, uses, discloses, and protects personal information through ppmwizard.com and the PPMWizard application.

Information we collect

Account and profile information: name, email address, company name, optional phone number, authentication identifiers, and account preferences.
Billing information: Stripe customer and subscription identifiers, purchase status, plan, and billing dates. Stripe processes payment-card and bank details; we do not store full card numbers.
Customer content: information you enter or upload, including offering, issuer, sponsor, property or business, financial projection, fee, risk, jurisdiction, image, and document information.
Communications: messages, attachments, and other information you send when requesting sales, support, privacy, or security assistance.
Device and usage information: IP-derived region, browser and device type, pages and features used, referring pages, timestamps, diagnostic logs, and security events. Vercel Web Analytics is configured without analytics cookies and reports aggregated usage information. If you opt in, Google Analytics may also process a privacy-filtered page path, referrer without query parameters, strictly validated campaign-attribution parameters, consented client and session identifiers, and a limited set of allowlisted product events.

How we use information

Provide, personalize, maintain, secure, and troubleshoot the Service.
Authenticate users and keep each account’s content logically separated.
Generate previews, PDFs, spreadsheets, questionnaires, and related exports you request.
Process purchases, subscriptions, renewals, cancellations, and fraud checks.
Send account, security, billing, and support communications.
Send optional drafting tips and product updates only when you choose to receive them.
Measure performance and improve features, usability, and reliability.
Enforce our Terms, prevent abuse, comply with law, and establish or defend legal claims.

How we disclose information

We disclose information only as needed to operate the Service, complete a transaction, comply with law, protect rights and safety, or complete a corporate transaction. Current categories of service providers include:

Supabase, database, authentication, storage, and authentication email.
Vercel, application hosting, delivery, logs, and cookieless Web Analytics.
Google, optional Google Analytics 4 measurement and linked Google Ads campaign attribution, only after the visitor’s applicable consent.
Stripe, checkout, payment processing, subscriptions, receipts, fraud prevention, and customer billing portal.
Browserless, temporary browser rendering of customer-requested PDF exports.
Amazon SES, delivery of optional product email when enabled.

These providers may process information only to provide services to us or as otherwise described in their agreements and privacy notices. We may also disclose information when required by legal process or to prevent fraud, abuse, security incidents, or harm. If our business is involved in a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, information may be transferred subject to appropriate protections.

What we do not do

We do not sell personal information.
We do not share personal information for cross-context behavioral advertising.
We do not use customer offering content to train general-purpose machine-learning models.
We do not send offering IDs, arbitrary or private URL query parameters, or private form content to Google Analytics or Google Ads.
We keep Google personalized-ad signals disabled and do not use third-party behavioral advertising trackers.

Optional product email

Drafting tips and product updates require a separate opt-in. The signup choice starts unchecked, and accepting the Terms or selecting a paid plan does not enroll you. We record your preference, the consent version, and related consent or unsubscribe times. Email delivery uses your account email address and records message and delivery status. Automated product emails do not include private offering content or open-tracking pixels.

Change your choice in Email preferences or use the unsubscribe link in an optional product email. We retain the suppression information needed to honor your choice. Turning these emails off does not stop account, security, billing, or support messages needed to operate your account.

Free resource downloads do not require an email address or app account. If you separately request resource tips, we record your email, the resource campaign, the consent version and time, confirmation or unsubscribe times, and delivery status. We do not create an app account from this request. You must confirm your email before the resource followups begin. Resource emails have their own unsubscribe link and do not change your account email preference.

Resource signup uses keyed fingerprints of the requesting IP and email for abuse limits. The signup tables do not store raw IP addresses, and rate-limit records are removed after two days. Confirmation links expire after 48 hours. A new request can renew an expired, unconfirmed link when no delivery attempt is awaiting review. Unconfirmed requests are removed 30 days after the most recent request unless a delivery attempt requires review. Followup messages expire after 14 days; sent or skipped queue records are removed 90 days after their expiry. Confirmed preferences, unsubscribe records, and uncertain delivery records remain until deletion or resolution so we can honor consent and avoid repeat messages. Contact privacy@ppmwizard.com for access or deletion requests without an app account.

Analytics and advertising measurement

Vercel Web Analytics provides cookieless aggregate site measurement. Google Analytics 4 is optional. Google’s tag is not downloaded until you opt in to Analytics or Advertising measurement. Before any Google tag can load, Google Consent Mode v2 is set to deny analytics storage, advertising storage, advertising user data, and ad personalization.

If you enable Analytics, we may send redacted page paths and a small allowlist of events, such as signup intent, account creation, checkout start, and public resource download or email-request events. Resource events include only fixed kit or file names, never your email or confirmation token. Analytics consent can preserve strictly validated utm_source, utm_medium, utm_campaign,utm_content, and utm_term values for campaign reporting. Advertising measurement also enables Analytics and can preserve a validated gclid,gbraid, or wbraid click identifier for attribution to our linked Google Ads account. All other query parameters are removed. Personalized-ad signals remain disabled. For a checkout that follows consent, we may pass Google’s client and session identifiers through Stripe metadata so the completed purchase can be measured server-side. We do not include customer content, offering IDs, names, email addresses, or arbitrary query parameters in those analytics events.

On dashboard, wizard, generated-document, Form D, questionnaire, and billing routes, PPMWizard forces Google storage consent to denied and does not send Google page views or client product events. This route-level safeguard applies even when you previously opted in on the public marketing site. To preserve consented purchase attribution without contacting Google from a private route, the public site may retain Google’s client and session identifiers in local storage for up to 30 minutes. The cache is removed when Analytics consent is withdrawn.

Security

We use safeguards designed to protect information, including encrypted transport, access controls, authenticated sessions, and database row-level security. These controls limit ordinary users to their own records; authorized infrastructure providers and personnel may process information when necessary to operate, secure, support, or comply with law. No security measure eliminates all risk, so please use a unique password and do not upload information the Service does not request.

Retention

We generally retain account and customer content while your account remains open so drafts remain available. We retain billing, security, and transaction records as necessary for accounting, fraud prevention, dispute resolution, and legal obligations. Following a verified deletion request, we delete or deidentify covered information from active systems within a reasonable period, subject to backups, legal holds, security records, and records we must retain by law. Retention periods vary by record type and applicable legal or operational requirements.

Your choices and privacy rights

Depending on where you live, you may have rights to request access, correction, deletion, portability, or restriction of personal information, or to object to certain processing. You may also have a right to appeal a denied request or complain to a privacy regulator. To submit a request, email privacy@ppmwizard.com. We may verify your identity and authority before completing a request. Authorized agents may be required to provide written authorization. We will not discriminate against you for exercising a privacy right.

Cookies and local storage

We use authentication cookies and limited browser storage required for account sessions and preferences. Vercel Web Analytics does not use analytics cookies. Optional Google cookies are disabled unless you consent, and you can change or withdraw that choice at any time through “Cookie settings” in the site footer. See the Cookie Policy for cookie names, durations, and controls.

International visitors

PPMWizard is operated from the United States, and information may be processed in the United States and other countries where our providers operate. Those countries may have different data-protection laws. Where required, we rely on contractual or other approved transfer safeguards. If European data-protection law applies, our processing bases may include performance of our contract, legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where requested.

Children

The Service is intended for business users who are at least 18 years old. We do not knowingly collect personal information from children. Contact us if you believe a child provided information to the Service.

Changes

We may update this Policy and will post the new effective date. We will provide additional notice when a change materially affects privacy rights or our use of personal information.

Contact

Privacy questions and requests: privacy@ppmwizard.com. PPMWizard is operated by APPWZRD LLC in Phoenix, Arizona. A physical notice address will be supplied on request until a public business mailing address is designated.

Privacy Policy