Privacy Policy

tailoredbits, a sole proprietorship operated by Abadeer Afif ("Company," "we," "us," or "our"), operates the Lepulses proposal-portal Service. This Privacy Policy explains what information we collect, how we use and share it, and the rights you have. It applies to two categories of individuals:

• Account Holders — freelancers, agencies, and other users who register for and use the Service; and
• Proposal Recipients — the clients and visitors who view proposals that Account Holders create and share, and whose engagement is measured by the Service.

By using the Service, you consent to the practices described here.

1. Information We Collect

1.1. Personal Data (Account Holders)

Collected when you register and manage your account through our identity provider (Amazon Cognito):

• First and last name;
• Email address;
• Date of birth;
• Phone number (in international format);
• Password (stored and managed in hashed form by Amazon Cognito; we do not have access to your plaintext password);
• A unique account identifier.

1.2. User Content (Account Holders)

Content you submit when creating proposals:

• Uploaded files (video, PDF, image, and document files), stored in Amazon S3;
• Proposal and project metadata, including client name, client company, project name, agency name, file titles, descriptions, and welcome messages;
• Optional proposal access passwords that you set.

1.3. Usage and Engagement Data (Proposal Recipients)

When a Proposal Recipient interacts with a shared proposal, the Service records engagement events to provide analytics to the Account Holder, which may include:

• Event timestamps and event types (e.g., page viewed, image viewed, video watched, file downloaded, proposal accepted);
• Time spent and engagement duration;
• Page numbers viewed (for PDFs) and playback positions/segments (for videos);
• Download activity;
• Device information (e.g., primary device/type) associated with the interaction;
• Deal/proposal status.

Account Holder responsibility: If you are an Account Holder, you are responsible for ensuring you have an appropriate legal basis and any required notices/consents to share proposals with, and collect engagement data about, your recipients.

1.4. Tracking Technologies and Cookies

• Authentication cookies: We use cookies to store session/authentication tokens so you can stay signed in and so protected areas of the Service can be gated. These are strictly necessary for the Service to function.
• Analytics: In our production environment, we use Vercel Analytics to understand aggregate usage and performance of the Service.
• We do not currently use Google Analytics, Mixpanel, advertising trackers, or third-party marketing/support-chat SDKs.

1.5. Payment Data

Payments are processed by Paddle, which acts as Merchant of Record. We do not collect or store your full payment card details. Paddle processes your payment information subject to its own privacy policy; we receive limited subscription and status information (e.g., plan, billing period, subscription status) needed to provision your account.

2. How We Use Your Information

We use the information described above to:

• Create, authenticate, and secure your account (including email verification, password reset, and login);
• Provide core functionality — storing and serving your uploaded files, generating shareable proposal links, and producing engagement analytics;
• Enforce plan entitlements and usage limits (e.g., storage and active-proposal quotas);
• Process subscriptions, billing, and related transactions via Paddle;
• Communicate with you about your account, security, and service-related matters;
• Monitor, maintain, troubleshoot, and improve the Service and its performance;
• Detect, prevent, and address fraud, abuse, or violations of our Terms;
• Comply with legal obligations.

3. Legal Bases for Processing (EEA/UK Users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service you sign up for;
• Legitimate interests — to secure, maintain, and improve the Service and prevent abuse;
• Consent — where required (e.g., certain analytics/cookies), which you may withdraw at any time;
• Legal obligation — to comply with applicable law.

4. How We Share Information

We do not sell your personal data. We share information only as follows:

5. Data Storage, Location, and Security

5.1. Location. Your data is primarily stored and processed on AWS infrastructure located in the European Union (Stockholm, `eu-north-1`). If you access the Service from outside this region, your data may be transferred internationally subject to appropriate safeguards.

5.2. Security Measures. We implement reasonable technical and organizational measures to protect your data, including:

• Authentication and session management via Amazon Cognito, with credentials stored in secure cookies;
• Encrypted, time-limited (presigned) URLs for file uploads to S3;
• Token-based authorization for all backend API requests;
• Reliance on industry-standard infrastructure providers (AWS, Vercel, Paddle).

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Data Retention

• We retain Account Holder personal data and User Content for as long as your account is active or as needed to provide the Service.
• Deleting a proposal permanently removes its files and entire analytics history and cannot be undone.
• Upon account deletion request, we will delete or anonymize your personal data within a commercially reasonable period, except where retention is required for legal, accounting, fraud-prevention, or backup purposes.
• Residual copies may persist in backups for a limited period before being overwritten.

7. Your Rights

7.1. GDPR (EEA/UK) Rights

Subject to applicable law, you have the right to: access; rectification; erasure ("right to be forgotten"); restriction of processing; data portability; objection to processing; and to withdraw consent. You may also lodge a complaint with your local supervisory authority.

7.2. CCPA/CPRA (California) Rights

Subject to applicable law, California residents have the right to: know/access the categories and specific pieces of personal information collected; deletion; correction; and to opt out of "sale" or "sharing" of personal information. We do not sell your personal information. We will not discriminate against you for exercising these rights.

7.3. Exercising Your Rights

To exercise any right, contact us at support@lepulses.com. We may need to verify your identity before fulfilling a request. We will respond within the timeframes required by applicable law.

8. Children's Privacy

The Service is intended for users who are at least eighteen (18) years of age and is not directed to children. We collect date of birth at registration in part to support age verification. We do not knowingly collect personal data from children. If we learn we have collected such data, we will delete it. If you believe a child has provided us personal data, contact us at support@lepulses.com.

9. International Users

By using the Service, you understand that your information may be processed in the EU and potentially other countries where we or our service providers operate, which may have different data-protection laws than your country.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by reasonable means, and the "Last Updated" date will be revised. Continued use after the effective date constitutes acceptance.

11. Contact

tailoredbits (operated by Abadeer Afif)

Privacy inquiries: support@lepulses.com

General support: support@lepulses.com