Privacy Policy

1. Controller and scope

[Legal entity name required] operates Poppelo and is the controller for account, website, and sales data. For customer order documents, we generally act as a processor on the customer's instructions.

2. Data we collect

• Account data: organization name, work email, role, authentication and consent records.
• Service data: submitted documents, extracted order fields, connected-system identifiers, corrections, and audit events.
• Billing data: subscription and transaction references received from the payment processor. We do not collect full card numbers.
• Technical data: IP address, security logs, device/browser information, and optional de-identified browser error reports when consent is given.

3. Purposes and legal bases

We process data to provide and secure the service, perform our contract, comply with law, support customers, and improve tenant-specific extraction. We send marketing only with consent or where another lawful basis applies; consent can be withdrawn at any time.

4. AI and service providers

Order content may be provided to contracted AI, cloud hosting, payment, email, monitoring, and integration providers only as needed to deliver the service. Connected-system data is sent to destinations configured by the customer. Where required, we use appropriate safeguards for international transfers.

5. Retention and security

We retain data only for documented operational, contractual, and legal needs, then delete or anonymize it. Exact retention periods depend on the plan and record type. We use access controls, encryption, tenant isolation, secret hashing, and audit logging; no security method is absolute.

6. Your privacy rights

Depending on your location, you may request access, correction, deletion, portability, restriction, or objection; withdraw consent; or complain to a regulator. California residents may also request disclosure or deletion and opt out of sale or sharing. We do not sell personal information, and we do not discriminate for exercising privacy rights. Browser Global Privacy Control signals are treated as an opt-out where legally required.

7. Children

The service is for businesses and is not directed to children under 16. Contact us if you believe a child has provided personal information.

8. Cookies and choices

Necessary cookies support authentication and security. Optional browser monitoring runs only after consent. See the Cookie Policy or use “Cookie settings” in the footer.

9. Contact and requests

Email privacy@poppelo.com to exercise a right or ask a privacy question. We may verify identity before responding.