Privacy Policy

This Privacy Policy explains how ProposalOne, a product of Next313 — a registered d/b/a of Dignetix® Ltd., a Michigan corporation (“Dignetix,” “we,” “us”) — collects, uses, stores, and protects information when you use ProposalOne (“the Service”), available at proposalone.app. By using the Service, you agree to the practices described here.

This Privacy Policy works alongside our Terms of Service and, where applicable, our Data Processing Addendum (DPA). For privacy questions, contact us at privacy@next313.com.

1. Who We Are and Our Role

ProposalOne is RFP response management software used by businesses and their teams. For information about your own account and our public website, we act as a data controller. For the content your organization stores in its workspace — RFPs, issuer documents, drafted answers, your answer repository, and related records — we act as a data processor on behalf of your organization, which is the controller of that content. Our processing of workspace content is governed by our agreement with your organization, including our DPA where applicable.

2. Information We Collect

We collect only what is necessary to deliver and support the Service.

Account information

• Your name, email address, and (if you sign in with Microsoft) your Entra ID identifier.
• Your organization, company and operating-entity memberships, and role or permission assignments.
• Notification, timezone, and display preferences.

Workspace content (processed for your organization)

• RFPs and their extracted sections, requirements, and deadlines.
• Issuer documents you upload, and the response packages the Service generates from them.
• Your answer repository — approved answers, their tags, and their usage history.
• Cover sheets, companies, customers, service types, and your filing structure.
• Comments, assignments, review decisions, approvals, and the audit trail of who did what.

Technical and usage information

• Log and diagnostic data (IP address, browser, device type, timestamps).
• Aggregated, privacy-preserving usage analytics used only to improve the Service.
• Error reports generated when the Service encounters a problem.

Trial and demo enquiries

If you request a trial workspace or a demonstration, we collect the name, email address, organization, and any details you choose to include, in order to respond to you. You can ask us to delete an enquiry at any time.

We do not knowingly collect information from children under 16.

3. How We Use Your Information

• Operate, maintain, secure, and improve the Service.
• Authenticate users and enforce role- and tenant-based access controls.
• Extract sections from the documents you upload and draft responses from your own approved answers, within the permissions you hold.
• Respond to support requests and send service-related communications.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with our legal obligations.

We do not sell your data, we do not use your workspace content for advertising, and we do not use it to train artificial-intelligence models of our own. See Section 4 for how content is handled by our AI sub-processor.

4. Artificial Intelligence and Your Content

Drafting and extraction are core to the Service, so it matters that you know exactly what happens to your content. When you run extraction or auto-fill, the relevant text — the issuer document sections being processed and the candidate answers from your own repository — is transmitted to Anthropic, our AI sub-processor, to generate the output. Nothing is sent until you invoke a feature that needs it.

We do not use your workspace content to train any model of our own. We use commercial AI services that contractually restrict the use of your content for training foundation models, except as otherwise disclosed to you or required by law. AI features operate strictly within your role- and tenant-based permissions — they cannot surface data you could not otherwise see.

AI output may be inaccurate or incomplete. It is drafted for a person to review, and you remain responsible for what you submit to an issuer.

5. How We Share Information — Sub-processors

We share information only with trusted providers necessary to run the Service:

• Supabase — database, authentication, and file storage.
• Microsoft Azure — application hosting.
• Microsoft Entra ID — single sign-on.
• Anthropic — AI processing for section extraction and answer drafting, as described in Section 4.
• Resend — delivery of transactional email such as sign-in links, notifications, and deadline reminders.
• Stripe — payment processing, where card payment is enabled for your plan. Paid plans are invoiced directly today; Stripe receives billing contact and payment details only if and when card payment is turned on for your account.

These providers are contractually bound to protect your data. We also share information within your workspace according to the role permissions you set, and for legal reasons where required.

Business transfers

If ProposalOne, Dignetix, or the assets relating to the Service are involved in a merger, acquisition, reorganization, financing, change of control, or a sale or transfer of all or part of the business or assets relating to the Service, your information may be transferred as part of that transaction. The recipient will be required to honor this Privacy Policy or to provide equivalent protection, and we will notify you of any change in the controller of your personal data where required by law.

6. Data Storage and Security

Every customer is provisioned a dedicated PostgreSQL database at signup. Your workspace content is not stored in a shared table filtered by a tenant column — it lives in its own database, which is how the Service is built rather than a policy applied on top. That matters when the data in question is competitive pricing and win themes.

Data is encrypted in transit using Transport Layer Security (TLS) and at rest; uploads live in access-controlled buckets. No system is perfectly secure. In the event of a confirmed unauthorized access to personal data, we will notify affected customers without undue delay and in accordance with applicable law and our contractual obligations.

7. Data Retention

We retain workspace content for as long as the account is active. Deleted records are removed promptly; backups may retain deleted data for up to 30 days. On account closure, the organization may export its workspace content during a 30-day window, after which we delete workspace content within 90 days, except where retention is legally required.

Trials work the same way, on a shorter clock. A trial workspace runs for 30 days. If you convert, that workspace becomes your production workspace and nothing is migrated. If you do not, the workspace locks at the end of the trial, we offer you an export of anything you put in, and then the workspace and its database are deleted.

8. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, export, delete, object to, or restrict processing of your personal data, and to data portability. To exercise them, email privacy@next313.com; we respond within 30 days. If you are a member of a customer organization, some requests may be directed to that organization as the controller of your workspace content.

California privacy rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA), as amended:

• Right to know the categories and specific pieces of personal information we collect, use, and disclose;
• Right to request deletion of personal information, subject to certain exceptions;
• Right to correct inaccurate personal information;
• Right to opt out of the sale or sharing of personal information (we do not sell or share personal information as those terms are defined under the CCPA);
• Right to non-discrimination for exercising your privacy rights.

Categories of personal information collected include identifiers (such as name and email), professional information (such as your role and organization), internet or network activity (such as log data), and other information users provide through the Service.

To exercise your rights, contact us at privacy@next313.com.

9. International Transfers

We are based in the United States, and our providers may operate servers in other countries. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) for cross-border transfers.

10. Cookies and Analytics

We use strictly necessary cookies and browser storage to keep you signed in and maintain session state. For traffic measurement we use privacy-preserving, cookieless analytics; we do not use third-party advertising cookies or cross-site trackers, so no cookie-consent banner is required.

11. Changes to This Policy

We may update this policy. We will change the “Last updated” date and, for material changes, notify you by email or in the Service before they take effect.

12. Contact

Questions or requests: privacy@next313.com
100 W Big Beaver Rd Ste 160, Troy, MI 48084