Privacy Policy
Last updated: February 19, 2026
1. What Data We Collect
We collect the following categories of data:
- Account data: email address, name, profile photo (when using Google authentication), password (encrypted)
- Model data: financial models, parameters, calculations, and other content you create in the Service
- Organization data: organization name, member composition, roles, invitations
- Technical data: IP address, browser type, operating system, time zone, preferred language
- Usage data: actions within the Service, visit dates and times, pages viewed
2. Purposes of Data Processing
We use collected data for the following purposes:
- Providing and supporting Service functionality
- Authentication and account management
- Enabling collaboration within organizations
- Improving and developing the Service based on usage analysis
- Sending important notifications (Service changes, account security)
- Technical support and handling inquiries
- Ensuring security and preventing abuse
3. Data Storage and Protection
Your data is stored on secure servers. We apply industry-standard security measures, including: password encryption using bcrypt; data transmission over HTTPS; storage of authentication tokens in httpOnly cookies with Secure and SameSite flags; hashing of invitation and password reset tokens; regular database backups. We retain your data as long as your account is active or as needed to provide the Service. Upon account deletion, data is removed within a reasonable timeframe, except where retention is required by law.
5. User Rights
You have the following rights regarding your personal data:
- Right of access — you can request a copy of your data
- Right to rectification — you can update your data in profile settings
- Right to erasure — you can request deletion of your account and associated data
- Right to portability — you can export your financial models
- Right to restriction — you can request limitation of your data processing
To exercise your rights, contact us at support@productwave.app.
6. Security
We take reasonable technical and organizational measures to protect your data from unauthorized access, alteration, disclosure, or destruction. However, no method of data transmission or storage over the Internet is completely secure. In the event of a data breach affecting your personal data, we will notify you as soon as possible.
7. Third Parties
We may share data with third parties only in the following cases:
- Infrastructure providers — for hosting and operating the Service
- Google Authentication — when using Google sign-in (only the minimum necessary data is shared)
- Email service — for sending emails (password reset, invitations)
- Legal requirements — when disclosure is necessary to comply with legal obligations
We do not sell or share your personal data with third parties for marketing purposes.
8. Children
The Service is not intended for persons under 16 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with their data, please contact us for its removal.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date. Continued use of the Service after changes constitutes your acceptance of the updated Policy. We recommend periodically reviewing this page.
10. Contact Us
If you have any questions, comments, or suggestions regarding this Privacy Policy, please contact us: