Privacy
What DashProposal stores, why it stores it, and every third party that receives any of it.
Last updated 17 August 2026
Two different roles
DashProposal handles two kinds of personal data, and its responsibilities differ for each.
Your account. When you sign up, DashProposal decides what to collect and why. This policy covers that.
Your clients. Their names, email addresses and signatures are here because you put them here. You decide what is collected; DashProposal only acts on your instructions. That relationship is set out in the data processing terms.
What is stored about you
Email address and password (handled by Supabase Auth, never stored in readable form by DashProposal), business name, business address, logo URL, payment link, webhook URL, currency, and any default scope or terms you save.
Failed sign-in attempts are recorded as a salted hash of the IP address, kept for fifteen minutes, purely to slow down password guessing. The address itself is never stored and the hash cannot be reversed to recover it.
What is stored about your clients
Client name, email address and any notes you add. The full contents of every proposal, including scope, timeline, price and terms.
Signatures record more, deliberately. When someone signs, DashProposal stores their typed name, email address, the exact consent wording shown to them, a SHA-256 fingerprint of the document, a trusted timestamp, and their IP address in full.
The IP address is kept unhashed here, unlike everywhere else in the product, because it is evidence that a particular signature happened. A signature record that cannot be corroborated is worth little if the agreement is ever disputed.
Proposals also record engagement: how many times the link was opened, when it was last opened, and whether the pricing and agreement sections were viewed. This is visible to the sender and to nobody else.
What is stored about visitors
Messages sent through the contact form: name, email, message, browser user agent, and a salted hash of the IP address used for rate limiting.
Cookies and tracking
The product itself — everything after you sign in, and every client's proposal link — runs no analytics, no advertising pixels and no third-party trackers of any kind. There is nothing measuring you across sites there.
The public marketing pages (this one included, plus the homepage, pricing, login and signup) use PostHog, a third-party analytics tool, to see which pages get visited — not the pages above, and never recording what you type into any field, only page visits.
A cookie banner appears before PostHog loads. Declining, or simply not answering, means PostHog is never fetched for that visit — nothing loads until Accept is clicked, and the choice is remembered for next time.
Two cookies exist for the product itself, both strictly necessary: a session cookie that keeps you signed in, and a timestamp used to sign you out after a period of inactivity. Your light or dark theme preference is kept in your browser and never sent anywhere.
Who else receives data
These are every third party involved, and precisely what reaches each one.
| Service | Purpose | What it receives | Region |
|---|---|---|---|
| Supabase | Database and account authentication | All stored data, including proposals, signatures and account details | United States (us-east-1) |
| Cloudflare | Hosting and content delivery | Requests to the site, including IP address and browser details | Global edge network |
| Anthropic | Drafting a first version of a proposal | Client name, project description, target price and timeline. Only when AI drafting is used, which is optional per proposal. | United States |
| Resend | Sending email, including signed agreement copies | Recipient email address and the contents of the message or attachment | United States |
| FreeTSA | Trusted timestamps proving when a document was signed | A SHA-256 hash of the document only. The document itself is never sent and cannot be reconstructed from the hash. | Germany |
| PostHog | Page-visit analytics on the public marketing pages only, and only after the cookie banner is accepted | Which marketing page was visited, browser/device details, and IP address. Nothing at all unless the visitor accepts the cookie banner. Never runs on the product itself (after sign-in) or on a client's proposal link, and does not record what you type into any field. | United States |
Two of these are worth calling out. AI drafting sends a client name and project description to Anthropic, and is optional on every proposal, so it can be avoided entirely. Timestamping sends only a hash to FreeTSA, which means the timestamping service never sees the agreement it is timestamping.
DashProposal never receives or processes payments. Paying happens on your own payment provider's page, and no card details ever reach this application.
What you can already do
Export everything: Settings has a download containing your account and all associated records — proposals, clients, invoices, change orders and signature records.
Delete your account: this schedules erasure after a grace period, during which it can still be cancelled.
Deletion erases everything, including signed agreements
When the grace period ends, the erasure is complete: your login, your account, your clients, your proposals, and the signature records attached to them. Nothing is retained afterwards, and a client's proposal link stops working.
This is why both sides are emailed a copy at the moment of signing. A signed agreement is evidence of a contract between you and your client, and the client is not a DashProposal account holder — so rather than DashProposal keeping their evidence indefinitely, each side is given their own permanent copy at the time. The signed PDF that arrives by email is yours to keep and does not depend on this service continuing to exist.
Before deleting, export your data. Deletion is not reversible once the grace period has passed.
Contact
DashProposal is operated as a sole proprietorship from North Carolina, United States.
For any privacy request — access, correction, deletion, or a question about this policy — email support@dashproposal.com.