Privacy
What DashProposal stores, why it stores it, and every third party that receives any of it.
Last updated 17 August 2026
Draft — not in effect
This document has not been reviewed by a lawyer and does not yet govern anything. It is published for review only. Nothing in DashProposal currently asks you to agree to it.
Two different roles
DashProposal handles two kinds of personal data, and its responsibilities differ for each.
Your account. When you sign up, DashProposal decides what to collect and why. This policy covers that.
Your clients. Their names, email addresses and signatures are here because you put them here. You decide what is collected; DashProposal only acts on your instructions. That relationship is set out in the data processing terms.
What is stored about you
Email address and password (handled by Supabase Auth, never stored in readable form by DashProposal), business name, business address, logo URL, payment link, webhook URL, currency, and any default scope or terms you save.
Failed sign-in attempts are recorded as a salted hash of the IP address, kept for fifteen minutes, purely to slow down password guessing. The address itself is never stored and the hash cannot be reversed to recover it.
What is stored about your clients
Client name, email address and any notes you add. The full contents of every proposal, including scope, timeline, price and terms.
Signatures record more, deliberately. When someone signs, DashProposal stores their typed name, email address, the exact consent wording shown to them, a SHA-256 fingerprint of the document, a trusted timestamp, and their IP address in full.
The IP address is kept unhashed here, unlike everywhere else in the product, because it is evidence that a particular signature happened. A signature record that cannot be corroborated is worth little if the agreement is ever disputed.
Proposals also record engagement: how many times the link was opened, when it was last opened, and whether the pricing and agreement sections were viewed. This is visible to the sender and to nobody else.
What is stored about visitors
Messages sent through the contact form: name, email, message, browser user agent, and a salted hash of the IP address used for rate limiting.
Cookies and tracking
DashProposal runs no analytics, no advertising pixels and no third-party trackers of any kind. There is nothing measuring you across sites.
Two cookies exist, both strictly necessary: a session cookie that keeps you signed in, and a timestamp used to sign you out after a period of inactivity. Your light or dark theme preference is kept in your browser and never sent anywhere.
Needs legal wording
Confirm whether essential-only cookies exempt this site from a consent banner in the jurisdictions being targeted. The technical position above is accurate and unusually clean; the conclusion drawn from it is a legal question.
Who else receives data
These are every third party involved, and precisely what reaches each one.
| Service | Purpose | What it receives | Region |
|---|---|---|---|
| Supabase | Database and account authentication | All stored data, including proposals, signatures and account details | United States (us-east-1) |
| Cloudflare | Hosting and content delivery | Requests to the site, including IP address and browser details | Global edge network |
| Anthropic | Drafting a first version of a proposal | Client name, project description, target price and timeline. Only when AI drafting is used, which is optional per proposal. | United States |
| Resend | Sending email, including signed agreement copies | Recipient email address and the contents of the message or attachment | United States |
| FreeTSA | Trusted timestamps proving when a document was signed | A SHA-256 hash of the document only. The document itself is never sent and cannot be reconstructed from the hash. | Germany |
Two of these are worth calling out. AI drafting sends a client name and project description to Anthropic, and is optional on every proposal, so it can be avoided entirely. Timestamping sends only a hash to FreeTSA, which means the timestamping service never sees the agreement it is timestamping.
DashProposal never receives or processes payments. Paying happens on your own payment provider's page, and no card details ever reach this application.
What you can already do
Export everything: Settings has a download containing your account and all associated records.
Delete your account: this schedules erasure after a grace period, during which it can still be cancelled.
Needs legal wording
Retention periods, the legal bases relied on for each kind of processing, and how requests from a client (rather than an account holder) are handled all need wording. See the open question in the data processing terms about whether signed agreements survive account deletion.
Contact
Needs legal wording
A contact address for privacy requests, the operating legal entity and its country, and a supervisory authority if one applies.