Privacy Policy

Quick summary

1. Data Controller

The data controller responsible for processing your personal information under this Privacy Policy is C-Carpenter Ltd ("we", "us", "our"), operator of ProjectPro, with its principal place of business in United Kingdom.

For any data protection questions, contact our team at info@c-carpenter.org.

2. Scope of this Policy

This policy applies to all visitors, users, and customers of ProjectPro worldwide, including users in the European Union, United Kingdom, United States, Canada, Brazil, Mexico, Asia-Pacific (including Japan, Singapore, Australia) and all other jurisdictions. Where local law grants you stronger rights, those rights apply.

3. Personal Data we Collect

3.1 Data you provide directly

• Account information: name, email address, password hash, language preference, country.
• Company profile: business name, logo, address, tax ID, default currency.
• Customer data: clients, products, quotes, templates, and other content you create.
• Support communications: emails, attachments, and any information you share with our team.

3.2 Data collected automatically

• Authentication & session data: secure session tokens, login timestamps, IP address (used for security only).
• Device & usage data: browser type, operating system, screen size, pages visited, feature usage.
• Cookies & similar technologies (see our Cookie Policy).

3.3 Data from third parties

• Google OAuth: when you sign in with Google, we receive your name, email and profile picture.
• Payment processors (Stripe, Lemon Squeezy, PayPal): transaction ID, status, last 4 digits of card, billing country. We never receive full card numbers.

3.4 Sensitive data

We do not knowingly collect sensitive personal data (racial or ethnic origin, religious beliefs, health data, biometric data, sexual orientation). Please do not submit such data through ProjectPro.

4. Legal Bases for Processing (GDPR / UK-GDPR)

5. How we Use your Data

• Operate and provide ProjectPro, including syncing your data across devices.
• Authenticate users and protect against unauthorized access.
• Process payments, issue receipts, and manage subscriptions.
• Send transactional emails (account, billing, security).
• Provide customer support and respond to your requests.
• Detect, prevent and address fraud, abuse, or security incidents.
• Comply with legal, regulatory and tax obligations.
• Improve and personalize the product (with your consent for analytics).

6. Who we Share Data With

We do not sell your personal data. We share it only with the trusted sub-processors below, strictly for the purpose of operating ProjectPro, under written data-processing agreements.

We may also disclose your data when required by law, court order, or to protect the rights, property or safety of C-Carpenter Ltd, our users, or the public.

7. International Data Transfers

C-Carpenter Ltd is based in United Kingdom. Some of our sub-processors are located outside the European Economic Area, the United Kingdom, or your country of residence. When personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and the EU-U.S. Data Privacy Framework (where applicable).

8. Data Retention

We keep your personal data only as long as necessary for the purposes set out in this policy and to comply with applicable law.

• Account data: until you delete your account, plus up to 30 days in backups.
• Invoices and tax-relevant records: 6–10 years, as required by law.
• Security logs: up to 12 months.
• Marketing data: until you withdraw consent or unsubscribe.

9. Your Rights

Depending on your jurisdiction (GDPR / UK-GDPR / CCPA / LGPD / PIPEDA / APPI / PDPA), you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your personal data ("right to be forgotten").
• Restrict or object to processing.
• Data portability (receive your data in a machine-readable format).
• Withdraw consent where processing is based on consent.
• Not be subject to solely automated decisions with legal effect.
• Opt out of "sale" or "sharing" of personal information (California CCPA/CPRA). We do not sell or share personal information.
• Lodge a complaint with your local data protection authority (e.g. ICO in the UK, EDPB in the EU, ANPD in Brazil, PPC in Japan).

To exercise any of these rights, email info@c-carpenter.org. We will respond within 30 days (or sooner where required by law).

10. Security

We protect your data with industry-standard measures: encrypted-at-rest databases, TLS-encrypted transit, bcrypt-hashed passwords, secure session cookies (HttpOnly, Secure, SameSite), role-based access control, regular backups, and the principle of least privilege for staff access. No system is 100% secure, so we additionally maintain an incident-response plan to notify affected users and regulators in the event of a data breach within 72 hours where required.

11. Children

ProjectPro is not intended for use by children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact info@c-carpenter.org so we can delete it.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified to you by email and/or by an in-app banner at least 14 days before they take effect. The date at the top of this page indicates the latest revision.

13. Contact us

Questions about this Privacy Policy or how we handle your data? Email info@c-carpenter.org or write to C-Carpenter Ltd, United Kingdom.