This Privacy Policy explains what information palummu ("the Service," "we") collects, how we use it, and the choices you have. It applies to palummu.com and the palummu web application.
Summary: We collect the account and project information needed to run the Service. We do not sell your personal information, we do not show ads, and we do not use your project content to train AI models. Payment card details are handled entirely by Stripe — we never see or store them.
Everything you create or upload in the Service: projects, goals, activities and tasks, phases, milestones, notes, meeting records, decisions, approvals, escalations, comments, and files you upload. Project content you share is visible to the team members you invite to that project, according to their permissions.
When you use AI plan generation, your goal description and relevant project context are sent to our AI provider (OpenAI) to generate the plan. We do not use your content to train AI models.
If you connect Google Calendar or Microsoft Outlook, we store encrypted OAuth tokens needed to maintain the connection and we read and write only the calendar events you choose to sync (e.g., task deadlines and reminders). Tokens are encrypted before storage; our database never holds them in readable form. You can disconnect at any time from the Connections settings, which revokes our access.
Subscriptions are processed by Stripe. We receive confirmation of your plan and payment status, but we never see or store your card number or other payment credentials.
We do not sell personal information. We do not display third-party advertising. We do not build advertising profiles.
We share information only with the service providers needed to operate palummu, each limited to its role:
| Provider | Role |
| Supabase | Authentication, database, file storage |
| Render | Web hosting |
| Stripe | Payment processing |
| Resend | Transactional email delivery |
| OpenAI | AI plan generation (only the content you submit for generation) |
| Google / Microsoft | Calendar sync (only if you connect an account, and only the events you sync) |
We may also disclose information if required by law or to protect the security of the Service and its users.
We keep your account and project data for as long as your account is active. If you delete a project, its content is removed from the live Service. Backups may retain copies for a limited period before they age out. If you close your account, contact support@palummu.com and we will delete your account data, subject to legal retention requirements (e.g., billing records).
Depending on where you live, you may have additional rights (such as access, correction, deletion, or portability under laws like the GDPR or CCPA). Contact us and we will respond.
We protect data with authenticated sign-in, server-enforced project permissions and tenant isolation, encrypted storage of integration tokens, security headers, and regular backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
The Service is not directed to children under 18, and we do not knowingly collect information from them. (See Terms of Service §3.)
If we make material changes, we will notify you by email or with a notice in the Service before they take effect. The "Last updated" date at the top reflects the current version.
Questions about this policy or your data: support@palummu.com.
Attorney review needed before publication. Open items: confirm legal entity name and jurisdiction for governing-law language; confirm backup retention window; confirm whether account self-deletion (vs. support request) will be built.