Privacy policy

• We collect what we need to run Promolane and to talk to you about it, and nothing for advertising.
• We never sell personal information, and we don't share it for targeted ads.
• What you put in your workspace, including your clients' information, belongs to you. We handle it only to provide Promolane to you.
• Our AI providers never train on your data. We may improve Promolane's own models with de-identified, aggregated data that can't identify you, your clients or anyone else, and your workspace can opt out.
• We may share industry insights, such as how often a product is proposed, built from many customers' de-identified data. They never identify you, your clients or anyone else.
• Your workspace data is stored in Canada. Our servers and most of our providers are in the United States, a few are in Europe, and we name every one below.
• promolane.com sets no cookies and runs no advertising or tracking scripts. We count visits with Vercel Web Analytics, which uses no cookies and doesn't identify you.
• You can ask to see, correct, export or delete your information at any time.
• If something material changes, we'll tell account holders before it takes effect.

The rest of this page is the detail behind each of these.

Promolane Inc. ("Promolane", "we" or "us") operates promolane.com and the Promolane app at app.promolane.com, from Richmond Hill, Ontario, Canada.

This policy covers:

• The website, promolane.com, including the early-access form.
• The Promolane app, including sign-in, workspaces, connected accounts, AI features and our support and onboarding, such as migrating your data from another system.
• Our emails and conversations with you about Promolane.

If your company has a separate written agreement with us, that agreement governs how we handle your workspace data, and this policy fills in the rest.

Privacy law treats us differently depending on whose information it is and why we have it. We think you should know which hat we're wearing.

Section 15 explains what this means for the people whose information is in your workspace.

When you request early access

Your work email address, and anything you choose to add in the optional questions: your name, company, team size, the systems you use today and your role. We record when you asked and how you found us.

When you use the app

• Account and sign-in: your name, email address and organization, and the identity details Microsoft or Google share when you sign in with them, such as whether your email is verified. Promolane has no passwords; you sign in with Microsoft, Google or a one-time code sent to your email.
• Workspace content: what you and your team create, upload or import, such as clients and contacts, addresses, proposals and presentations, orders, purchase orders, shipments, artwork and files.
• Settings and preferences: for example your theme, layout density and saved views.
• Activity and audit records: what changed in your workspace, by whom and when. These keep your records trustworthy and help us investigate problems.

From services you connect

• Email and calendar, if you connect Microsoft 365 or Google. Section 07 explains exactly what we access.
• Supplier and product data, for example from SAGE when you link your SAGE account, used under that provider's licence terms.
• Data you migrate from another system, such as exports, order history and artwork you send us or ask us to bring across.
• Shipment tracking details from carriers, when you track a shipment.

Collected automatically

Like any website or app, our servers receive technical information with each request, such as your IP address, browser and device type, and the pages or features requested. We use it to deliver the service, keep it secure and fix errors. To understand which pages people read, promolane.com counts visits with Vercel Web Analytics: the page, the site that sent you, your country and your device type, without cookies and without anything that identifies you or follows you to other sites. promolane.com runs no advertising or session-recording tools, and the app runs no analytics of any kind.

When you contact us

What you tell us in emails, calls, meetings and support requests.

We use personal information to:

• provide, maintain and improve Promolane, and the features you choose to use;
• train and improve Promolane's own models, using only de-identified, aggregated data (see section 06);
• create industry insights from de-identified data combined across many customers (see section 09);
• respond to early-access requests, onboard your team and migrate your data;
• sign you in, keep your account secure, and prevent fraud and abuse;
• send service emails, such as sign-in codes, invitations and important notices, which you can't opt out of while you have an account;
• send product news, which you can stop at any time with the unsubscribe link or by emailing us;
• provide support, and understand and fix problems;
• meet our legal obligations and enforce our agreements.

We don't use your information for advertising, we don't build profiles of you for anyone else, and we don't make decisions about you based solely on automated processing.

Our legal bases, if you're in Europe or the UK

We provide the service under our contract with you or your company. We handle website enquiries, security and product improvement on the basis of our legitimate interest in running a safe, useful business, and we send marketing with your consent or where the law allows it for existing contacts. We keep some records because the law requires it.

Promolane is built around AI, so we want to be specific about it.

• Our AI providers never train on your data. They're contractually barred from using it to train or improve their models.
• Promolane's own models learn only from de-identified data. To make Promolane better at the work distributors do, we may use de-identified, aggregated data to train and improve our own models. Before any data is used this way, we remove personal information and anything that identifies you, your clients, your contacts or your suppliers. We never use licensed supplier catalogue data or information from connected email and calendar accounts for training, and nothing one customer puts in Promolane is ever shown to another. A workspace administrator can opt out at any time by emailing privacy@promolane.com.
• Bloom's memory stays in your workspace. Bloom can remember things about how your business works, such as your preferences and how you like proposals written, so it can help you better. That memory is part of your workspace data: it's never shared with other customers, you can ask to see or delete it, and it's deleted with your workspace.
• Only what the task needs. When an AI feature runs, we send the provider only the information that task requires, and the result comes back to you.
• Suggestions you confirm. AI drafts and suggestions are shown to you to accept, edit or ignore. They aren't sent anywhere or saved as fact until you or your team decide to.

On the website

After you request early access, we suggest your name from your email address so you don't have to type it. Clear cases such as jane.smith are worked out on our own servers. For others, we send only the part of the address before the @ to Anthropic's Claude to suggest a name. Nothing is saved unless you submit the form, and Anthropic deletes these requests within 30 days and doesn't train on them.

In the app

AI features such as drafting presentations from a client brief use the model providers listed in section 10. Each of them is barred from training on your data, and deletes what we send within 30 days. They keep it that long only to detect abuse of their services.

You can choose to connect your Microsoft 365 or Google account so Promolane can work with your email and calendar, for example to file client emails against the right order or to check your availability for a meeting. Connecting is optional, and Promolane works without it.

• We ask only for the access a feature needs, and the consent screen shows you each permission before you agree.
• Access is handled through Nango, which stores the access tokens encrypted. Promolane stores only a reference to them.
• You can disconnect at any time in your workspace settings, or in your Microsoft or Google account. We then stop accessing that account.

Promolane's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We hold information from Microsoft to the same standard. That means:

• we use it only to provide the features you turned on;
• we don't use it for advertising, and we don't sell it;
• we don't use it to train AI models;
• no person at Promolane reads it unless you ask us to, it's needed for security, or the law requires it.

promolane.com sets no cookies and loads no third-party scripts. Our fonts, and the Vercel Web Analytics script that counts visits, are served from our own site.

The app uses only the cookies and browser storage it needs to work. None are used for analytics or advertising, so there's nothing to opt out of.

We never sell personal information, and we don't share it for targeted or cross-context advertising. We share it only:

• with service providers who help us run Promolane, listed in the next section, under contracts that limit them to doing that work for us;
• within your workspace, with the colleagues your company has invited, according to their permissions;
• with services you connect or ask us to send information to, such as your email provider or a supplier;
• if the law requires it, for example under a valid court order, and only as much as required. Unless we're prohibited from doing so, we'll tell your company first;
• if our business changes hands, with the buyer or successor, who must keep honouring this policy. We'll tell you before that happens.

Industry insights aren't personal information. We may combine de-identified data from many customers into statistics and insights, for example how often a product is proposed or ordered, or how a price compares with a market average, and share them with customers, suppliers and partners. An insight never identifies you, your clients, your contacts or any individual, and we only release one when it combines enough customers that no single customer's information can be worked out. Suppliers never learn which distributor or client a proposal or order involved.

These are the companies that handle personal information for us, and where. We review each one before using it, and we keep this list current.

Some features connect you to services your company chooses, such as SAGE for supplier product data. When you use them, those services handle the information under their own terms. In the app, address autocomplete sends what you type to Google Places, and maps load their images from OpenFreeMap, which sees your IP address as any website would.

Promolane's app database and file storage, where your workspace data is kept, are hosted in Canada. The servers that run the website and the app are in the United States, so your information passes through them as you use Promolane. Most of the providers in section 10 are also in the United States, and a few are in Europe. While it's there, it may be accessible to courts, law enforcement and national security authorities under those countries' laws.

We protect information sent outside Canada with contracts that require our providers to keep it secure and use it only for the work they do for us. Before transferring personal information outside Quebec, we assess whether it will be adequately protected, as Quebec law requires. For information from Europe or the UK, we rely on the European Commission's standard contractual clauses and the UK equivalent.

We keep information only as long as we need it for the purposes in this policy.

We may keep information longer if the law requires it, or to resolve a dispute, and only for that purpose.

• Information is encrypted in transit between you, us and our providers, and encrypted at rest in our database.
• Each company's workspace is kept separate at the database level, so one organization can't see another's data.
• There are no passwords to steal: you sign in with Microsoft, Google or a one-time code.
• Only Promolane staff who need it can access customer data, and only to help that customer, keep the service secure, or meet a legal obligation.
• We remove personal details from error reports before they leave our servers.

No system is perfectly secure. If a breach of security involving your personal information creates a real risk of significant harm, we'll notify you and the relevant privacy regulators as the law requires, as soon as we can.

Wherever you are, you can ask us to:

• tell you what personal information we hold about you and how we use it;
• give you a copy of it, in a commonly used format;
• correct it if it's wrong or incomplete;
• delete it, unless the law requires us to keep it;
• stop using it for marketing, or withdraw a consent you gave.

Email privacy@promolane.com to make a request. We'll confirm it's really you before acting, and we'll answer within 30 days. Requests are free.

Canada

We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector (Law 25). If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

Europe and the UK

You also have the right to object to processing based on our legitimate interests, to ask us to restrict processing, and to complain to your local data protection authority.

United States

Depending on your state, you may have the rights above under laws such as California's. We don't sell or share personal information for targeted advertising, so there's nothing to opt out of. We won't treat you differently for using your rights. If we decline a request, you can appeal by replying to our decision. An authorized agent can make a request on your behalf with your written permission.

Distributors use Promolane to manage their own clients, contacts and orders. If your information is in a distributor's Promolane workspace, that distributor is responsible for it and decides how it's used, so please send your request to them. If you contact us instead, we'll pass it on and help them respond.

Distributors: you're responsible for having the right to put your clients' information into Promolane and for answering their requests. We'll help you do that, including by exporting or deleting records.

Promolane is a business service for adults. We don't knowingly collect information from anyone under 18. If you think we have, contact us and we'll delete it.

When we change this policy, we'll update the date at the top of this page. If a change is material, we'll tell account holders by email or in the app before it takes effect, and we'll never apply a material change to information we already hold without the notice or consent the law requires.

Our privacy officer is Evan Kalentzis, who is responsible for how Promolane handles personal information, including as the person in charge of protecting personal information under Quebec law.

Email privacy@promolane.com with any question, request or complaint, or write to us at: