Privacy Policy

1. Information we collect

When you use PaloWorks, we collect:

• Account information: email, name, and password (hashed). If you sign in with Google, we receive your name, email address, and profile picture from Google.
• Workspace data: the clients, projects, intake answers, scopes, revisions, change orders, contracts, time entries, and invoices you create — including your clients' names, email addresses, and the briefs they submit through your links.
• Signing and approval records: when a client approves a scope or change order or signs a contract, we record their typed name, the time, their IP address, their browser's user agent, and a hash of the document text, so the record can be checked later. For new signatures we also retain the document and submission URLs, electronic-signature consent, and approximate city, region and country when supplied by our hosting platform from the network address. This is not GPS location or verified identity. The workspace can download this evidence alongside its signed records.
• Account text messages: if you add a security phone, we store the number, verification status and your optional event preferences. We track monthly text usage to enforce the account limit. Provider delivery reports and STOP requests help us manage delivery and opt-outs.
• Usage data: product events (a workspace created, an intake submitted, an invoice sent — the amount in cents, never the client’s name) and which pages were opened. A page view records the page's path with share-link tokens and anything after the ? removed; section 8 lists everything it carries. Server logs stay with us so we can keep the product working.
• Payment information: handled by Stripe. We do not see or store full card numbers.
• Free kit: if you ask for a free kit on the site, we store your email address, the page you asked from, and when, and email the kit to that address. It does not add you to a newsletter. We keep the address until you ask us to delete it at support@paloworks.com.

2. How we use it

• To run PaloWorks and show your documents to the clients you share them with
• To process subscriptions and your clients' payments
• To send essential service mail (sign-in links, invoice and reminder emails you trigger, receipts)
• To send optional product mail, which you can turn off in Settings → Notifications or from the unsubscribe link
• To answer support
• To understand which parts of the product are actually used

3. Who receives data

We do not sell personal information for money. We share data with the processors below, each to operate PaloWorks, and with authorities when the law requires it or to protect our rights. One of them, OpenAI, may also use what it receives from our ads in ChatGPT for its own advertising, as section 8 describes; you can opt out of that under Your privacy choices.

• Vercel — hosts the application and serves every page.
• Supabase — stores your account and workspace data.
• Stripe — subscription billing, and card payments from your clients through your own connected Stripe account.
• Resend — delivers the email the product sends: sign-in links, documents and reminders you send to clients, receipts, and notifications.
• PostHog — product analytics, and session replays of the public marketing pages, in the United States. Our servers send the event name, a timestamp, and the workspace id (the user id for a new sign-up) when something happens in the product, with details such as a record’s id or an invoice’s amount in cents. The browser sends which page was opened — the path only, with ids, share-link tokens and the query string removed — plus the referring site, campaign tags, how long a page was open and how far it was scrolled, and the browser’s user agent, language, time zone and screen size, and on the public marketing pages which links, buttons and form fields are used. On those pages only, it also sends session replays: what the page shows and how the pointer moves, clicks and scrolls, with what is typed into a form field, any search text shown back on the page, and the text, links and images outside the page’s own content masked before anything leaves the browser, and the address cut to its path; replays never record the signed-in product, the sign-in and sign-up pages, or a share link. After a click on one of our ads in ChatGPT, the browser also reports whether that ad’s measurement reached OpenAI. Once you are signed in, the browser’s events carry your user id, plan, role and workspace id. It keeps nothing on your device, and it never receives a document, a client’s name, or an email address.
• Google Ads — advertising measurement on the public site, the sign-up page included, from Google LLC in the United States. The browser loads Google's tag, which sets Google's own cookies and local storage on the device, including the click id after an ad click, so that click can be tied to a later workspace. The tag is sent the address of the page the visitor arrives on with the query string cut to campaign tags and Google's click id, the address the visitor came from without its query string, and the page's title; after a move between public pages without a reload, Google's tag reports each new address itself, and our own links carry only which button or filter was used, or which plan was chosen. Once the click id is stored, the tag is told that no user data may be used for advertising, so it does not send an email address or phone number it finds on the page, and advertising personalisation is off. When a workspace is created, the next page of the site or the workspace opened within half an hour loads a blank page of ours in the background, which sends the workspace conversion: the click id, the title "PaloWorks", a random one-time number so it is counted once, and the address of the page it was opened from, without its query string; that page holds nothing but the tag and sends the conversion with Google's user-data signal on, which the click id needs. Our Google Ads account also counts a visit to the sign-up page as a conversion, from that page's own page view. Apart from the blank page, the tag does not load on the sign-in pages, inside a workspace, on a client's link, or on an invitation's sign-up page, and opening a public page from any of those does not send Google their address; moving from the public site into a workspace reloads the page without it, though Google may already have been sent that page's address, without its query string or title. It never receives a document or a client's name.
• ChatGPT Ads — advertising measurement and personalisation for our ads in ChatGPT, from OpenAI in the United States, and only for a visitor who arrives from one of those ads, whose link carries OpenAI's reference for the click; the browser keeps that reference in a first-party cookie. OpenAI's code never runs in one of our pages: a blank page of ours loads it in the background, and the browser keeps that page sandboxed, so the code cannot read the page you are on, our cookies or storage, and cannot store anything on the device itself; OpenAI's servers may set or read a cookie for their own address when the browser sends them the event, where the browser allows that. It runs on the page the ad opens, if that is one of our product pages, and, if a workspace is created within 30 days, on the next page of the site or the workspace opened within half an hour, until OpenAI has received it. The click reference is kept for those 30 days so a later workspace can be credited, and cleared once the workspace has been reported. OpenAI is sent the event (the ad's page was opened, or a workspace was created) and when it happened, the click reference, the blank page's address, a random one-time number so a workspace is counted once, and its code's own start-up and diagnostic notes; as with any request, it also sees the browser's network address and user agent. Because the click reference ties the event to the ChatGPT account that clicked, OpenAI may use it on its own account, under its own privacy policy, to measure our ads, to decide where to show them, and to personalise the ads that account is shown; for that it is not our processor, and you can opt out under Your privacy choices in our Privacy Policy. It is never sent an email address, a name, a document, anything typed, or the address of the page you are on. A browser that has opted out, by Global Privacy Control or under Your privacy choices, never loads it, and keeps no click reference.
• Microsoft Clarity — heatmaps and session replays of the public marketing pages only, from Microsoft Corporation in the United States. The browser sends what the page shows, how the pointer moves, clicks and scrolls, the page's full address (query string included: campaign tags, an ad network's click id, or a template filter), the referring site, and the browser's user agent, language and screen size. Every form field, and any search text shown back on the page, is masked before anything leaves the browser; the free tools and the demo, which show back what a visitor types, and any page whose address carries more than campaign tags, ad click ids or template filters, are not recorded. It keeps nothing on your device, and it never runs in the signed-in product, on the sign-in and sign-up pages, or on a share link.
• OpenAI — the model provider behind the AI-assisted drafts and reads, which are on Pro and Studio. When you press a button that asks for a draft (a scope from a brief, a verdict on a revision request, a payment chase email, a plain-language contract summary), we send the text that draft needs, which can include your client’s brief and name and the scope or contract text, to OpenAI and show you the result to edit. Three run without a button: when a revision round is logged, the round is read against the scope and a verdict is filed on the project; when a client submits an intake, it is summarised for the email that tells you; and the Friday review’s paragraph is written from the week’s totals, with no client or workspace names. A client you mark as not allowing AI is never read by the first two. Nothing is sent on the Free plan, or when AI is not set up. OpenAI’s API terms govern its handling of that text. Optional logo background cleanup. Only when you request a preview, the selected logo is sent to OpenAI. You review and approve the result before it replaces your saved logo. No client documents or other workspace data accompany the image request.
• Amazon Web Services — stores files you attach — proofs, signed PDFs, receipts — in a private S3 bucket in us-east-1. Objects are not public. A download uses a short-lived signed URL. When file storage is not configured, uploads are refused and this processor receives nothing.
• Google — only if you choose to sign in with Google. Google then knows you signed in to PaloWorks.

If you subscribe a calendar app to your PaloWorks calendar feed, that app's provider (for example Google or Apple) fetches the feed from us: the due dates, amounts, and client names of your unpaid invoices. That happens only after you add the feed, and resetting the feed link in the product stops it.

4. Your clients' data

The people you send links to never need an account. What they type into an intake form, approve on a scope, or sign on a contract is stored in your workspace and shown only to you, your workspace members, and anyone holding that document's link. You are responsible for having the right to put their details into PaloWorks; we process them on your behalf under these terms and the Data Processing Addendum.

When a shared invoice, scope, contract, change order, portal or statement is opened, PaloWorks records that it was opened and when, so the person who sent it can see it. It does not record who opened it or their IP address for this, and repeat opens within 30 minutes count once. Each of those pages says so in its footer.

A client can also sign in, optionally, to see every project and document studios have shared with their email address in one place. There is no password: we email a one-time code that expires after 10 minutes. For this we store the email address, a keyed hash of the code (never the code itself) and of the requesting IP address, and, once they sign in, a keyed hash of the token in their session cookie, their browser's user agent, and when the session was last used. A session lasts 30 days or until they sign out. Expired codes are deleted within 1 day and expired sessions within 7 days. Signing in shows only what your share links already show and gives no access to your workspace.

5. Retention and deletion

We keep your data while the account is open. A project you delete sits in Settings → Recently deleted for 30 days, where you can restore it, and is then purged. When you close your account (Settings → Account → Close account), we delete your personal information and your workspace data within 30 days, except where the law requires us to keep a record — for example invoices tied to processed payments, which Stripe also retains under its own policy. Backups roll off on the same schedule.

Uploaded files are available for download for 90 days from upload. We retain the private storage objects for up to 120 days for operational recovery before scheduled deletion. The additional retention period does not extend download access. File metadata and document-signing records may remain with the project for recordkeeping. Download and keep your own copies before access expires.

Inquiry conversations include messages submitted through private reply links. When an inbound email service is configured, we also process replies addressed to an inquiry-specific address, their sender, message content and provider reference so the studio can continue the conversation. Anyone with a private conversation link can access that conversation; keep these links confidential.

Some records are swept automatically while the account is open:

• The text of an AI draft — the brief or contract text sent and the draft returned — is erased 30 days after the draft was made; the remaining record (its kind, status, and time) is deleted after 365 days.
• The email delivery log, which records the address a message was sent to and whether it arrived, is deleted after 90 days.
• Expired sign-in sessions are deleted 7 days after they expire.

6. Security

Data is encrypted in transit (HTTPS) and at rest by our hosting providers. Passwords are hashed. Share links use long random tokens and can be rotated or revoked from the project. No method of transmission or storage is completely secure, and we will tell you if we learn of a breach affecting your data.

Report a security vulnerability to security@paloworks.com. A person who works on the code reads every report. Please give us a reasonable chance to fix a problem before you disclose it publicly, and do not access, change, or delete data that is not yours while you test. The same contact is published at /.well-known/security.txt.

7. Your rights

• Update your name and password in Settings → Account
• Export your workspace data as JSON from Settings → Your data
• Turn off non-essential mail in Settings → Notifications or with the unsubscribe link in any such email
• Close your account from Settings → Account → Close account; a workspace owner can close the workspace with it
• Ask us at support@paloworks.com to access, correct, or delete anything the product does not let you change yourself
• We do not sell personal information for money. If you arrive from one of our ads in ChatGPT, we share that visit, and a workspace you then create, with OpenAI, which may use it to personalise the ads you are shown in ChatGPT (section 8). Some US state privacy laws treat this as sharing for cross-context behavioral advertising, as targeted advertising, or as a sale, and give their residents a right to opt out. We offer that opt-out to everyone: use Your privacy choices below, or send Global Privacy Control, which we treat as an opt-out of selling and sharing. California residents may also ask privacy@paloworks.com to know, correct, or delete personal information we hold. We will not discriminate for exercising a privacy right.

8. Cookies and analytics

We use essential cookies to keep you signed in and to remember preferences.

On the public site, the sign-up page included, the browser also loads Google's advertising tag, from Google LLC in the United States. It sets Google's own cookies and local storage on your device, including the click id when you arrive from one of our ads, so that click can be tied to a workspace created later. It is sent the address of the page you arrive on with the query string cut to campaign tags and Google's click id, the address you came from without its query string, and the page's title. If you then move between public pages without the page reloading, Google's tag reports each new address itself; our own links carry only which button or filter was used, or which plan was chosen. Once the click id is stored, the tag is told that no user data may be used for advertising, so it does not send an email address or phone number it finds on the page, and advertising personalisation is off. When a workspace is created, the next page of the site or your workspace that you open within half an hour loads a blank page of ours in the background, which sends the workspace conversion: the click id, the title “PaloWorks”, a random one-time number so it is counted once, and the address of the page it was opened from, without its query string. That page holds nothing but the tag, and sends the conversion with Google's user-data signal on, which the click id needs. Our Google Ads account also counts a visit to the sign-up page as a conversion, from that page's own page view. Apart from the blank page, the tag does not load on the sign-in pages, inside a workspace, on a client's link or document, or on an invitation's sign-up page, and opening a public page from any of those does not send Google their address. Moving from the public site into your workspace reloads the page so the tag does not come along, though Google may already have been sent the address of the page you moved to, without its query string or title. The tag is never sent a document or a client's name.

We also advertise in ChatGPT. If you arrive from one of those ads, whose link carries OpenAI's reference for the click, your browser keeps that reference and may load OpenAI's advertising code, from OpenAI in the United States; nobody else's browser does. It never runs in one of our pages: a blank page of ours loads it in the background, and your browser keeps that page sandboxed, so the code cannot read the page you are on, our cookies or storage, and cannot store anything on your device itself; OpenAI's servers may set or read a cookie for their own address when the browser sends them the event, where your browser allows that. It runs on the page the ad opens, if that is one of our product pages, and, if you create a workspace within 30 days, on the next page of the site or your workspace that you open within half an hour, until OpenAI has received it. We keep the click reference in a cookie of ours, pw_oai_click, for those 30 days so a later workspace can be credited, and clear it once the workspace has been reported; for that half hour a second cookie, pw_oai_conv, holds a random one-time number. OpenAI is sent the event (the ad's page was opened, or a workspace was created) and when it happened, the click reference, the blank page's address, that one-time number so a workspace is counted once, and its code's own start-up and diagnostic notes; as with any request, it also sees your network address and your browser's user agent. Because the click reference ties the event to the ChatGPT account that clicked the ad, OpenAI can use it, under its own privacy policy, to measure our ads, to decide where to show them, and to personalise the ads that account is shown in ChatGPT. It is never sent your email address, your name, a document, anything you type, or the address of the page you are on. You can turn this off under Your privacy choices; if your browser sends Global Privacy Control it is off already. Either way the code never loads, and any click reference your browser holds is cleared the next time you open one of our pages.

Our analytics provider is PostHog, in the United States. It receives page views from your browser, and from our servers the product events described in section 1. A page view carries the page's address, the site that referred you, campaign tags, how long the previous page was open and how far it was scrolled, and what your browser reports about itself: its user agent, language, time zone and screen size. The query string (anything after the ?) and the secret part of a share link are removed before it is sent, and it never includes what you typed. On our public marketing pages the browser also reports which links, buttons and form fields you use, never what you type into them. After a click on one of our ads in ChatGPT, it also reports whether that ad's measurement reached OpenAI. PostHog may derive an approximate location, such as the country, from the network address. It is not device location.

On the same public marketing pages, PostHog also records session replays, so we can see how those pages are read: what the page shows and how the pointer moves, clicks and scrolls. It records the same pages as Microsoft Clarity, described below: what you type into a form field, any search text shown back on the page, and the text, links and images outside the page's own content are masked in your browser before anything is sent, and it never records the product once you sign in, the sign-in and sign-up pages, or a share link. The replay carries the page's address without its query string, as a page view does. It records no console messages or network requests, keeps nothing on your device, and ends when the page is reloaded or closed.

Our analytics keep nothing on your device: no cookie, and nothing in local or session storage. The random id a visit gets lives only in the open page's memory, so reloading or opening a new tab starts a new one, and a return visit is not recognised unless you sign in. When you are signed in, what your browser sends is attributed to your account (its user id, plan and role) and to your workspace, never to your name or email address.

On our public marketing pages we also use Microsoft Clarity, in the United States, to see how those pages are read: it records what the page shows and how the pointer moves, clicks and scrolls, as heatmaps and replays of the visit, with the page's full address (including anything after the ?, such as the campaign tags on a link you followed), the referring site, and the same browser details as above. It runs without cookies and keeps nothing on your device, so each page view is recorded on its own and a return visit is not recognised. Every form field, and any search text shown back on the page, is masked in your browser before anything is sent. It does not record our free tools or the demo, which show back what you type, or a page whose address carries anything but campaign tags, an ad network's click id or a template filter. It never runs in the product once you sign in, on the sign-in and sign-up pages, or on a share link. Microsoft Clarity may derive an approximate location, such as the country, from the network address.

When you arrive on our public site from a link, we may also set first-party cookies that remember how you found us, so a referral or campaign is credited when you sign up: cr_ref and cr_aref (the page, partner, AI assistant or ad in ChatGPT that referred you, 90 days), cr_rcode (a customer's referral code, 90 days), cr_utm (the campaign tags in the link you followed, 30 days) and cr_draft (a draft you started in one of our free tools, 7 days). They hold no name or email, are read only by our own servers, and the sign-up ones are cleared once your workspace is created. The campaign tags, which kind of page or which AI assistant referred you, whether you came from one of our ads in ChatGPT and whether the browser still held its click reference, and whether a referral code was used are then saved with the workspace and sent to PostHog with the event that records its creation. A page view from such an ad is marked as one, without the click reference.

9. Children

PaloWorks is not for people under 18. We do not knowingly collect information from children.

10. International

Your data may be stored and processed in the United States or other countries where the processors above operate. Using PaloWorks means you accept that transfer. If you are in the EEA, UK, or Switzerland, Ferrier Industries LLC is controller of your account and billing data and processor of data about your clients, as the Data Processing Addendum describes. Standard Contractual Clauses are available on request at legal@ferrierindustries.com.

11. Changes

We may update this policy. If the change is material, we will tell you by email or in the product, and the date at the top will change.

12. Disputes

Disputes about this policy are resolved under the Terms of Service, including the binding individual arbitration, jury waiver, class waiver, limitation of liability, and Massachusetts governing law in those terms. This policy does not enlarge our liability.

13. Contact

Questions about this policy: support@paloworks.com. Ferrier Industries LLC is a Wyoming limited liability company. PaloWorks by Ferrier Industries LLC. Mailing address: 30 N Gould St #69044, Sheridan, WY 82801, USA. Write to legal@ferrierindustries.com.