This Policy explains how APPWZRD LLC, doing business as PPMWizard (“PPMWizard,” “we,” or “us”), collects, uses, discloses, and protects personal information through ppmwizard.com and the PPMWizard application.

Information we collect

Account and profile information: name, email address, company name, optional phone number, authentication identifiers, and account preferences.
Billing information: Stripe customer and subscription identifiers, purchase status, plan, and billing dates. Stripe processes payment-card and bank details; we do not store full card numbers.
Customer content: information you enter or upload, including offering, issuer, sponsor, property or business, financial projection, fee, risk, jurisdiction, image, and document information.
Communications: messages, attachments, and other information you send when requesting sales, support, privacy, or security assistance.
Device and usage information: IP-derived region, browser and device type, pages and features used, referring pages, timestamps, diagnostic logs, and security events. Vercel Web Analytics is configured without analytics cookies and reports aggregated usage information. If you opt in, Google Analytics may also process a privacy-filtered page path, referrer without query parameters, strictly validated campaign-attribution parameters, consented client and session identifiers, and a limited set of allowlisted product events.

How we use information

Provide, personalize, maintain, secure, and troubleshoot the Service.
Authenticate users and keep each account’s content logically separated.
Generate previews, PDFs, spreadsheets, questionnaires, and related exports you request.
Process purchases, subscriptions, renewals, cancellations, and fraud checks.
Send account, security, billing, and support communications.
Measure performance and improve features, usability, and reliability.
Enforce our Terms, prevent abuse, comply with law, and establish or defend legal claims.

How we disclose information

We disclose information only as needed to operate the Service, complete a transaction, comply with law, protect rights and safety, or complete a corporate transaction. Current categories of service providers include:

Supabase — database, authentication, storage, and authentication email.
Vercel — application hosting, delivery, logs, and cookieless Web Analytics.
Google — optional Google Analytics 4 measurement and linked Google Ads campaign attribution, only after the visitor’s applicable consent.
Stripe — checkout, payment processing, subscriptions, receipts, fraud prevention, and customer billing portal.
Browserless — temporary browser rendering of customer-requested PDF exports.

These providers may process information only to provide services to us or as otherwise described in their agreements and privacy notices. We may also disclose information when required by legal process or to prevent fraud, abuse, security incidents, or harm. If our business is involved in a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, information may be transferred subject to appropriate protections.

What we do not do

We do not sell personal information.
We do not share personal information for cross-context behavioral advertising.
We do not use customer offering content to train general-purpose machine-learning models.
We do not send offering IDs, arbitrary or private URL query parameters, or private form content to Google Analytics or Google Ads.
We keep Google personalized-ad signals disabled and do not use third-party behavioral advertising trackers.

Analytics and advertising measurement

Vercel Web Analytics provides cookieless aggregate site measurement. Google Analytics 4 is optional. Google’s tag is not downloaded until you opt in to Analytics or Advertising measurement. Before any Google tag can load, Google Consent Mode v2 is set to deny analytics storage, advertising storage, advertising user data, and ad personalization.

If you enable Analytics, we may send redacted page paths and a small allowlist of events, such as signup intent, account creation, and checkout start. Analytics consent can preserve strictly validated utm_source, utm_medium, utm_campaign,utm_content, and utm_term values for campaign reporting. Advertising measurement also enables Analytics and can preserve a validated gclid,gbraid, or wbraid click identifier for attribution to our linked Google Ads account. All other query parameters are removed. Personalized-ad signals remain disabled. For a checkout that follows consent, we may pass Google’s client and session identifiers through Stripe metadata so the completed purchase can be measured server-side. We do not include customer content, offering IDs, names, email addresses, or arbitrary query parameters in those analytics events.

On dashboard, wizard, generated-document, Form D, questionnaire, and billing routes, PPMWizard forces Google storage consent to denied and does not send Google page views or client product events. This route-level safeguard applies even when you previously opted in on the public marketing site. To preserve consented purchase attribution without contacting Google from a private route, the public site may retain Google’s client and session identifiers in local storage for up to 30 minutes. The cache is removed when Analytics consent is withdrawn.

Security

We use safeguards designed to protect information, including encrypted transport, access controls, authenticated sessions, and database row-level security. These controls limit ordinary users to their own records; authorized infrastructure providers and personnel may process information when necessary to operate, secure, support, or comply with law. No security measure eliminates all risk, so please use a unique password and do not upload information the Service does not request.

Retention

We generally retain account and customer content while your account remains open so drafts remain available. We retain billing, security, and transaction records as necessary for accounting, fraud prevention, dispute resolution, and legal obligations. Following a verified deletion request, we delete or deidentify covered information from active systems within a reasonable period, subject to backups, legal holds, security records, and records we must retain by law. Retention periods vary by record type and applicable legal or operational requirements.

Your choices and privacy rights

Depending on where you live, you may have rights to request access, correction, deletion, portability, or restriction of personal information, or to object to certain processing. You may also have a right to appeal a denied request or complain to a privacy regulator. To submit a request, email privacy@ppmwizard.com. We may verify your identity and authority before completing a request. Authorized agents may be required to provide written authorization. We will not discriminate against you for exercising a privacy right.

Cookies and local storage

We use authentication cookies and limited browser storage required for account sessions and preferences. Vercel Web Analytics does not use analytics cookies. Optional Google cookies are disabled unless you consent, and you can change or withdraw that choice at any time through “Cookie settings” in the site footer. See the Cookie Policy for cookie names, durations, and controls.

International visitors

PPMWizard is operated from the United States, and information may be processed in the United States and other countries where our providers operate. Those countries may have different data-protection laws. Where required, we rely on contractual or other approved transfer safeguards. If European data-protection law applies, our processing bases may include performance of our contract, legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where requested.

Children

The Service is intended for business users who are at least 18 years old. We do not knowingly collect personal information from children. Contact us if you believe a child provided information to the Service.

Changes

We may update this Policy and will post the new effective date. We will provide additional notice when a change materially affects privacy rights or our use of personal information.

Contact

Privacy questions and requests: privacy@ppmwizard.com. PPMWizard is operated by APPWZRD LLC in Phoenix, Arizona. A physical notice address will be supplied on request until a public business mailing address is designated.

Privacy Policy