Privacy Policy

1. Who we are

PM Habit ("PM Habit", "we", "us", "our") is operated by [to be added once the company is registered], a company registered in Romania as a societate cu răspundere limitată (SRL), registration number [to be added once the company is registered], with its registered office at [to be added once the company is registered].

You can reach us about privacy matters at hello@pmhabit.com.

2. What this policy covers

This policy explains what personal data PM Habit collects when you create an account and read our product-management snippets, why we collect it, who else sees it, and the rights you have over it. It applies to www.pmhabit.com and any subdomain we operate. It will be updated before we launch email courses or a paid plan.

3. What we collect

• Your email address, collected when you sign up. We use it to send you one-time sign-in codes and, once our snippet emails start, the snippets you signed up for.
• The name you give us, if you choose to tell us what to call you. It is optional and shown at the top of the site while you are signed in.
• Your time zone, so that emails arrive at a sensible time for you.
• Your reading activity: which snippets you have unlocked and opened, when, and whether you arrived through a sign-in code, a link in one of our emails, or on your own. We use this to give you access to the right snippets, to keep your reading streak, and to understand whether the product helps people build a habit.
• Sign-in records: when each signed-in session started, how it started (code or email link), and when it was last used, so we can keep your account secure.
• Basic technical data: standard web server and hosting logs (for example IP address, browser type and request times), collected automatically by our hosting provider for security and reliability.

We do not collect payment information. PM Habit does not accept payments at this stage; this policy will be updated before that changes.

We do not run analytics or advertising trackers on the site. If we add an analytics tool, we will update Section 7 first and, where required, ask for your consent before it runs.

4. Why we process your data (legal basis)

• To provide the service you signed up for: signing you in, giving you access to your snippets, keeping your streak, and (once they start) sending your snippet emails. Legal basis: performance of a contract, or our legitimate interest in running the service.
• To keep the service secure and prevent abuse of sign-in codes, email links and access to snippets. Legal basis: legitimate interest.
• To understand whether PM Habit works, using reading activity counted across readers. Legal basis: legitimate interest.

We plan to keep a record of your email confirmation when our snippet emails start, as Romanian and EU rules on commercial email require. Where we rely on your consent, you can withdraw it at any time (see Section 8).

5. Who we share it with

We use a small number of specialist providers to run PM Habit. Each processes personal data on our behalf, under a data processing agreement, and does not use it for its own purposes:

• Supabase: hosts our database (your account, reading activity and sign-in records), in an EU region chosen so that this data stays in the EU.
• Resend: sends our emails. Today that is sign-in codes; later it will also send snippet emails and emails about deleting your account. Resend sends mail using Amazon Web Services (USA).
• Cloudflare (Email Routing): receives any email you send to hello@pmhabit.com and forwards it to our inbox. It does not host the website.
• Vercel: hosts and serves the website.

We do not sell personal data, and we do not share it with anyone for their own marketing.

6. International transfers

Not every provider keeps data inside the EU.

Our database (Supabase) is in an EU region.

Resend stores the emails it sends for us, including their content, delivery logs and account records, in the United States, whichever sending region is chosen. We send from the Ireland region; that affects delivery, not where Resend keeps the data.

Cloudflare's terms allow it and its sub-processors to process data outside the European Economic Area, Switzerland and the United Kingdom.

For transfers to the United States we rely on Resend's certification under the EU-U.S. Data Privacy Framework (held since March 2025) and, otherwise, on Standard Contractual Clauses with our providers. We will update this section if a provider's certification or terms change, or if we add a provider that processes data outside the EU.

7. Cookies and tracking

PM Habit uses one strictly necessary cookie: a session cookie that keeps you signed in after you enter a sign-in code or open a link from one of our emails. It lasts up to 60 days, or until you sign out.

We do not use analytics, advertising or third-party tracking cookies.

8. Your rights

Under the GDPR you have the right to:

• see the personal data we hold about you;
• correct inaccurate data;
• have your data deleted;
• object to or restrict some processing;
• receive a portable copy of your data;
• withdraw consent at any time.

To use any of these rights, write to hello@pmhabit.com. You can also complain to the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), at www.dataprotection.ro.

How this works today. There is not yet a button to close your account. To close it, or to ask us to delete your data, email hello@pmhabit.com (or, once our snippet emails start, reply to any of them). We handle deletion requests by hand, normally within 30 days, following a written internal procedure. Deleting your account removes your account, sign-in sessions, snippet access and reading activity; Section 9 covers what our providers keep afterwards. An unsubscribe link will be in every snippet email once those emails start. Signing out ends the session on that device only.

9. How long we keep your data

• Account, reading activity and sign-in records: for as long as your account exists. If you ask us to delete your account, we do so by hand, normally within 30 days (Section 8). Some records may be kept briefly where the law requires it (for example, proof of consent).
• Emails sent through Resend: Resend keeps message content, delivery logs and related records for 30 days, and deletes remaining data within 90 days after our account with them ends. Resend can also remove a specific message earlier on request.
• Emails you send to hello@pmhabit.com: Cloudflare forwards them to our inbox and, as far as its published documentation says, does not keep its own copy. The copy in our inbox stays until we delete it.
• Server and hosting logs: only as long as needed for security and troubleshooting, then deleted or anonymised on our hosting provider's standard schedule.

10. Children

PM Habit is for working professionals and is not aimed at children. We do not knowingly collect personal data from anyone under 16.

11. Changes to this policy

We will update this policy as the product changes, for example when snippet emails, email courses, a paid plan or an analytics tool are introduced. We will post the new version here with a new date and, for material changes, also tell active readers by email.

12. Contact

Questions about this policy or your data: hello@pmhabit.com.