Privacy Policy

1. Who we are

PMAC (the "Service") is operated under the brand name "PMAC" by Guy Kushnir, an individual providing the Service personally (the "Company", "we", "us", or "our"). This Privacy Policy describes how we collect, use, store, and protect personal information when you use the Service at pmagentchain.com.

This Privacy Policy applies to all users of the Service, including users who sign up themselves, users whose accounts are set up for their organization, and reseller partners.

For privacy-related questions, contact: guy@pmagentchain.com

2. Information we collect

2.1 Information you provide directly

2.2 Information collected automatically

2.3 Generated content

When a Review runs, the Service produces management-facing assurance outputs, such as an Executive Report, supporting documents, and knowledge base entries, from the project evidence supplied for that Review. This Service Output is considered part of your data and is treated accordingly.

3. How we use your information

We use the information we collect for the following purposes:

3.1 To provide the Service

• Analyze the project evidence supplied for a Review and return assurance outputs
• Store your project evidence and Review outputs and make them accessible to you
• Maintain your account and enable authentication
• Deliver Review outputs such as the Executive Report, supporting documents, and the knowledge base

3.2 To operate and improve the Service

• Monitor Service performance and detect technical issues
• Analyze aggregate usage data (Section 2.2), never project evidence or Review outputs, to improve user experience
• Prevent fraud, abuse, and unauthorized access
• Comply with legal obligations and enforce our Terms of Service

3.3 To communicate with you

• Send Service-related notifications (account changes, security alerts, feature updates)
• Respond to your support requests
• Send promotional communications (only with your consent, and you can opt out at any time)

4. Legal basis for processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, Switzerland, or other jurisdictions with comprehensive data protection laws, we process your personal data on the following legal bases:

5. Sharing your information

We share your information only in the following limited circumstances:

5.1 With service providers

We use third-party service providers to operate the Service. These providers process personal data on our behalf to operate the Service. Categories of service providers include:

• AI language model providers (for analyzing the project evidence supplied for a Review)
• Cloud infrastructure and database providers (for hosting and data storage)
• Web hosting and content delivery providers (for serving the website)
• Authentication providers (for secure login, including Google and Microsoft sign-in when selected)
• Observability and monitoring providers (for operational visibility)
• Analytics and session-replay providers — Google Analytics and Contentsquare (see Section 10.3). These run only after you accept analytics.
• Email service providers (for transactional emails)
• Background processing providers (for running the processing steps of a Review; project content may be included in the job data they receive)

We select service providers based on their security posture, data protection practices, and compliance with applicable laws.

5.2 With your consent

We may share your information with third parties when you explicitly direct us to do so (for example, when you request integration with an external tool).

5.3 For legal reasons

We may disclose information when required by law, subpoena, court order, or other legal process, or when we believe disclosure is necessary to:

• Comply with legal obligations
• Protect the rights, property, or safety of the Company, users, or the public
• Enforce our Terms of Service
• Investigate fraud or security incidents

5.4 Business transfers

If the Service is acquired, merged, or transferred to another entity, your information may be transferred as part of that transaction. You will be notified in advance, and if you do not wish for your data to be transferred you can ask us to delete it, as described in Section 7.

6. International data transfers

The Service is operated from Israel. Your personal data may be transferred to and processed in countries outside your country of residence, including Israel, the United States, the European Union, and other locations where our service providers operate.

For questions about international transfers of your personal data, contact us at guy@pmagentchain.com.

7. Data retention

7.1 What we keep

To provide the Service, we keep:

• Account information
• Project evidence, project briefs, and Service Output
• Communications with you

We do not currently delete this data automatically.

7.2 Deletion requests

To ask for data associated with your account, project or Review to be deleted, email guy@pmagentchain.com. Deletion requests are handled manually, and we will confirm the scope and timing with you. When we act on a deletion request:

• Aggregate usage statistics (with no identifiers and no project evidence) may be retained indefinitely for operational analytics
• Data that we are legally required to retain (for tax, accounting, or legal compliance) is retained for the period required by law

7.3 Legal holds

If we receive a legal hold or preservation order, we may retain data as required to comply with legal obligations, including after a deletion request.

8. Your rights

Depending on your location, you have the following rights regarding your personal data:

8.1 Universal rights (all users)

• Right to access: Request a copy of your personal data
• Right to correction: Ask us to correct inaccurate information
• Right to deletion: Ask us to delete your data (subject to legal retention requirements)
• Right to opt out of marketing: Unsubscribe from promotional emails at any time

8.2 Additional rights under GDPR (EEA, UK, Switzerland)

• Right to restrict processing: Ask us to limit how we use your data
• Right to data portability: Receive your data in a machine-readable format
• Right to object: Object to processing based on legitimate interest
• Right to withdraw consent: Withdraw consent at any time (without affecting prior processing)
• Right to lodge a complaint: File a complaint with your local data protection authority

8.3 How to exercise your rights

To exercise any of these rights, email guy@pmagentchain.com with your request. We will respond within 30 days. We may ask you to verify your identity before processing certain requests.

8.4 Automated decision-making

The Service uses AI models to analyze the project evidence supplied for a Review and produce outputs. These analyses are informational and advisory. The Service does not make legally significant automated decisions about you as an individual.

9. Security

We implement technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS/HTTPS) for all data transmitted to and from the Service
• Encryption at rest for data stored in our database and file storage
• Access controls limiting who can access your data internally
• Row-level security in our database to prevent cross-account data access
• Rate limiting and input validation to prevent abuse
• Regular security reviews and updates

Despite these measures, no internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security of your data. In the event of a data breach that affects your personal data, we will notify you as required by applicable law.

10. Cookies and tracking

We use cookies and similar technologies for the following purposes:

10.1 Essential cookies

Required for the Service to function. These cannot be disabled.

• Session cookies for authentication and login state
• Security cookies to prevent fraud and protect your account
• A cookie-consent preference cookie that records only your analytics choice (accept or reject). It contains no identifier and no personal data, and lasts 180 days (about six months), after which we ask again.

10.2 Functional cookies

Remember your preferences and settings.

• UI preferences (dark mode, language)
• Recently viewed projects

10.3 Analytics and session-replay

We use two analytics tools to understand how the website is used and improve the service. They run only after you accept analytics — before that, no tag loads, no request is sent, and no analytics cookie is written. You can accept, reject, or change your choice at any time using the Cookie Settings link in the footer.

Google Analytics 4 (provided by Google)

• Purpose:pageview and interaction analytics — how many people visit, which pages they view, and which actions they take.
• Loads only after you accept analytics; before that no Google Analytics tag, request, or cookie is created.
• Sets first-party analytics cookies (for example _ga and _ga_<id>) to distinguish visitors and sessions.
• You can withdraw consent at any time via Cookie Settings; on withdrawal we stop loading Google Analytics and remove the analytics cookies we are able to.

Contentsquare

• Provider: Contentsquare (which now includes Hotjar).
• Purpose:session replay and behavioral analytics — recordings of clicks, scrolling, mouse movement, and navigation on the page — to see where visitors get stuck and improve the experience. This is individual session behavior, not anonymous aggregate statistics.
• Runs only on our public marketing pages. It is excluded from sign-in and authenticated product pages (your dashboard, project runs, admin, and any page showing your project documents, generated reports, or account information).
• Form inputs are masked. The text you type — names, email addresses, company names — and dropdown selections are not intentionally collected in recordings.
• Sets first-party cookies (for example _cs*) for session continuity and analytics.
• Session-replay retention: Contentsquare session replays are available for up to two months while the account is on a Growth trial or Growth plan. Under the Free plan, session replays are retained and accessible for one month. If our plan changes, the applicable retention period may change accordingly.
• Loads only after you accept analytics; you can withdraw at any time via Cookie Settings. On withdrawal no new recording begins and we remove the Contentsquare cookies we are able to.

Your analytics choice is stored in a first-party cookie for 180 days (about six months); that cookie contains only your choice and no identifier or personal data. This 180-day period is the lifetime of your consent preference only — it is separate from how long the analytics tools retain the data they collect (for example, the Contentsquare session-replay retention described above). You can also manage cookies through your browser settings. Note that disabling essential cookies will prevent you from using the Service.

11. Children’s privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact guy@pmagentchain.com and we will delete the data promptly.

12. Third-party links

The Service may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We encourage you to read the privacy policies of any third-party services you access.

13. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Service features. Material changes will be communicated to you by email or through a notice on the Service at least 14 days before they take effect.

The "Last updated" date at the top of this Privacy Policy indicates when the current version became effective. We encourage you to review this Privacy Policy periodically.

14. Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

For EU residents: If we are not able to resolve your concern, you have the right to lodge a complaint with your local data protection authority. A list of authorities is available at edpb.europa.eu.