How we collect, use, and protect your personal data
Last updated: March 2026
Who we are
This service, available at proposal.expert, is operated under the name Proposal Expert. Proposal Expert acts as the data controller for the personal data described in this policy and determines how and why that data is processed.
Data We Collect
We collect information necessary to provide our proposal creation service. Here is what we collect and why:
Account Data (Legal basis: Contract)
Name, email address, and password (for authentication)
Profile picture (optional, for personalization)
Language and timezone preferences
Proposal & Client Data (Legal basis: Contract)
Proposal content, pricing, and attachments
Client names, companies, and contact information
Digital signatures (name, email, IP address for legal validity)
Usage Data (Legal basis: Consent / Legitimate Interest)
Page views and feature usage (only with your consent)
Session information (device type, browser, approximate location)
Proposal view analytics (for proposal senders to track engagement)
How We Use Your Data
To provide and improve our proposal creation service
To authenticate your identity and secure your account
To send essential emails (verification, password reset, signature notifications)
To provide analytics on proposal engagement (to proposal senders)
To process payments through Stripe (we never see your full card number)
To sync data with CRM platforms you connect (only with your authorization)
When you download a proposal example or template as a Word file, we use your e-mail address to send you the link. Only with your explicit consent do we then send up to three tips e-mails, each with an unsubscribe link. Without that consent we delete the address after 180 days.
For those download e-mails we record whether the message was delivered, whether it was opened (through an invisible image) and which link was clicked, so we can tell whether the mails are useful. We keep that for 13 months and delete it together with the address.
Data Retention
We retain your data only as long as necessary. Default retention periods:
Account data: until you delete your account
Analytics data: 180 days, then anonymized
Activity logs: 90 days, then anonymized
Chat conversations: 1 year, then deleted
Audit logs: 2 years, then anonymized (legal requirement)
Session data: 90 days, then deleted
Workspace administrators can customize these retention periods in their organization settings.
Your Rights
Under the GDPR, you have the following rights:
Right of access: Download all your personal data from your profile settings
Right to rectification: Update your data anytime in your profile
Right to erasure: Request account deletion from your profile settings
Right to data portability: Export your data in JSON format
Right to restrict processing: Manage consent for analytics and tracking
Right to object: Opt out of marketing communications anytime
Right to withdraw consent: Revoke any consent at any time without affecting prior processing
Sub-Processors
We use the following third-party services to operate our platform:
EU-hosted cloud infrastructure - Hosting and data storage