Privacy Policy

1. Information we collect

Account and support information: your name, email address, authentication identifiers, account preferences, agreement acceptances, subscription status, and messages you send to support. Our authentication provider handles password-based and connected sign-in.

Project and portal information: project records, field mappings, source references, plans, tasks, issues, deliverables, asset links, progress updates, invitations, team membership, and other information you or authorized users submit.

Connected services and assessments: authorization tokens, selected file or sheet identifiers, project fields, meeting metadata, participant information, transcripts you upload or authorize us to retrieve, and resulting reports, corrective actions, and optional learning recommendations. What we access depends on the connection, permissions, and features you enable.

Payments and operations: payment-provider customer and transaction references, subscription and Service Credit records, usage records, timestamps, IP addresses, browser or device information, and security and diagnostic logs. Stripe processes payment details; Project Sherpa does not store your full payment-card number.

2. How we use information

We use information to authenticate users, synchronize the sources you configure, provide project and portal features, generate assessments, deliver requested recommendations, process payments, send service emails, respond to support requests, prevent misuse, maintain reliability, and meet legal obligations. Source updates are limited to the permissions and write-back features you authorize.

We do not sell personal information or transcript content, or use it for targeted advertising. We use de-identified, aggregated outcomes and operational information for internal quality, safety, education, and service improvement. Manual review of identifiable transcript content for improvement requires your separate, explicit permission.

3. Connected accounts and Google user data

Connections are optional. Google Workspace, Microsoft, Salesforce, Smartsheet, Zoom, and other supported services provide only the access you authorize, subject to your organization's controls. We use that access for the features you request, not to collect unrelated account content. You can remove a configured source or revoke access through the provider. Revocation stops future authorized access but does not automatically delete previously imported project records or completed reports.

Project Sherpa's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. Google user data is not used to train generalized AI or machine-learning models.

4. AI processing

When you request a Project Health assessment, relevant transcript content and project context are sent to OpenAI through its API to generate the report. Reports may contain personal information and short quotations from the input. Optional learning features process relevant findings to provide recommendations.

We do not opt in to sharing API inputs or outputs for OpenAI model training or improvement, and customer transcripts are not added to our methodology knowledge base. Service providers may retain limited information for service delivery, security, abuse prevention, or legal compliance under their applicable terms. Transient processing in Project Sherpa does not mean that every provider offers zero data retention.

5. When we share information

We use service providers to operate the product, including Vercel and Cloudflare for hosting and delivery, Supabase for database and authentication services, OpenAI for AI processing, Stripe for payments, and Resend for service emails. They receive information needed for their roles, subject to applicable contractual and data-protection obligations.

Project information is shared with portal members and other recipients according to the access and actions authorized by the project owner or account user. Connected providers receive requests and authorized updates needed for their integrations. We may also disclose information when required by law, to protect rights and security, or in connection with a business transfer subject to appropriate protections. We do not disclose transcript content to unrelated third parties for their own purposes.

6. Storage and retention

For personal-account transcript viewing and assessments, transcript bodies are processed transiently rather than retained as a transcript archive after processing finishes. Provider references, meeting metadata, custom titles, completed reports, and corrective actions can remain stored. Reports can include excerpts from their inputs. Other enabled ingestion workflows may temporarily store content while processing is pending.

Project, portal, account, and report data are retained as needed to provide the features you use, until deleted through the available controls or an applicable retention process. Removing a connection is different from deleting imported data. Decommissioning a Project Health service removes its project-specific actions and reports that are no longer used by another project. Shared reports and separate learning, billing, or audit records may remain. It does not delete the original transcript at its provider.

Limited billing, security, and legal records may need to be retained after deletion or account closure. Backups and service-provider records may persist for their applicable retention cycles. We do not promise immediate deletion from every backup or a single fixed retention period for all data.

7. Cookies and security

We use cookies and similar browser storage for authentication, session continuity, security, and requested interface functionality. Blocking these may prevent sign-in or other features from working. We do not use personal or transcript data for cross-site targeted advertising.

We use reasonable technical, administrative, and organizational safeguards, including access controls and protected integration credentials. No system or transmission method is completely secure. You are responsible for protecting your account and assigning appropriate project access.

8. Your choices and privacy requests

You can manage connections, project access, and available deletion controls in the application. To request access, correction, export, restriction, objection, deletion, or withdrawal of consent where applicable, email support@psprinciples.com. We may need to verify your identity and consider legal retention requirements before fulfilling a request.

If your information was supplied through an organization or Customer Portal, contact its project owner or administrator as well: they determine what information to share and who may access it. Depending on your location, you may have additional rights, including the right to complain to your local data-protection authority.

9. International processing and legal bases

Our service providers may process information in the United States and other countries. Applicable privacy protections can differ from those in your location. Where required, we use appropriate contractual or other safeguards for international transfers. Where data-protection law requires a legal basis, processing depends on the purpose and may be necessary to provide the service, meet legal obligations, pursue legitimate interests such as security, or rely on your consent.

10. Children and changes to this policy

Project Sherpa is a business service and is not directed to children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

We may update this policy as our service or obligations change. The effective date above identifies the current version. We will provide additional notice of material changes where required. Our User Terms describe the account and service agreements.