Effective Date: 18 March 2026 · Last Updated: 18 March 2026
WinsProposal ("we", "us", "our") is operated by Polsia Inc. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our AI proposal generation service at winsproposal.com.
This policy complies with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and India's Digital Personal Data Protection Act 2023 (DPDPA).
WinsProposal (operated by Polsia Inc.) is the data controller for the personal data processed through this service.
Contact: privacy@winsproposal.com
| Data Type | What We Collect | Lawful Basis | Retention |
|---|---|---|---|
| Account Data | Email address, name, hashed password | Contract performance | Until account deletion |
| Proposal Content | RFP text you upload, AI-generated proposals, knowledge base entries | Contract performance | Until account deletion |
| Usage Data | Daily proposal generation counts, feature usage | Legitimate interest (rate limiting, product improvement) | Until account deletion |
| Payment Data | Subscription status and plan type. Card details are held solely by Stripe/Razorpay. | Contract performance | Active subscription + 7 years (financial records) |
| Analytics Data | Anonymous visitor ID, page views | Consent | 90 days |
| Consent Records | Cookie and marketing preferences, timestamps | Legal obligation | Duration of account + 3 years |
We do not sell your personal data. We do not use your proposal content to train AI models.
When you generate a proposal, your RFP text and knowledge base context are sent to our AI provider (OpenAI) for processing. This data is:
| Processor | Purpose | Location | Safeguards |
|---|---|---|---|
| OpenAI | AI proposal generation | United States | Standard Contractual Clauses (SCCs) |
| Neon | Database hosting | United States / EU | SCCs, SOC 2 |
| Render | Application hosting | United States | SCCs, SOC 2 |
| Stripe | Payment processing (USD) | United States / EU | PCI DSS Level 1, SCCs |
| Razorpay | Payment processing (INR) | India | PCI DSS Level 1 |
Your data may be transferred to and processed in the United States. For transfers from the UK/EEA, we rely on:
You can set your preferred data region in your account settings. While we cannot guarantee data will only be stored in that region (due to our infrastructure architecture), we use this preference to optimise data handling where possible.
Under UK GDPR / EU GDPR, you have the following rights:
| Right | Description | How to Exercise |
|---|---|---|
| Access | Request a copy of all your personal data | App Settings → Export Data, or GET /api/gdpr/export |
| Rectification | Correct inaccurate personal data | Edit your profile in the app |
| Erasure | Delete your account and all associated data | App Settings → Delete Account, or DELETE /api/gdpr/account |
| Data Portability | Receive your data in a machine-readable format (JSON) | App Settings → Export Data |
| Withdraw Consent | Change cookie and marketing preferences at any time | Cookie banner → Preferences |
| Object | Object to processing based on legitimate interest | Email privacy@winsproposal.com |
| Complaint | Lodge a complaint with a supervisory authority | UK: ico.org.uk |
We will respond to all data rights requests within 30 days. Data export and deletion are available instantly through the app.
wp_token — JWT authentication token (localStorage)wp_lang — Language preference (localStorage)wp_cookie_consent — Your consent preferences (localStorage)polsia_vid — Anonymous visitor ID for page view analytics (localStorage)We do not use third-party tracking cookies. The analytics beacon only fires after you grant analytics consent.
WinsProposal is not directed at individuals under 16. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us immediately.
We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice. The "Last Updated" date at the top reflects the most recent revision.
For privacy-related inquiries, data requests, or complaints: