1. Introduction
ProductOS tech, a private limited company incorporated under the laws of India ("ProductOS," "we," "us," or "our"), operates ProductOS — an AI-powered product-planning and execution platform (the "Services"). This Privacy Policy explains what personal data and Customer Content we collect, how we use and share it, how long we keep it, and the rights available to you. It applies to everyone who accesses or uses the Services, including Users on free plans, paid subscriptions, and enterprise agreements.
This Privacy Policy is incorporated by reference into, and forms part of, the ProductOS Terms of Service. Where this Policy uses a capitalized term it takes it from the Terms — Services, Customer, User, Customer Content, AI Outputs, ProductOS Technology, Third-Party Services, Subscription, and Model-Improvement Processing carry the same meaning in both documents.
2. Scope, Controller, and Processor Roles
As between you and ProductOS, you (or the organization you represent) retain ownership of Customer Content. ProductOS acts in two roles:
- Data Controller / Data Fiduciary: for Account Information collected directly from individuals to register, operate, bill, and support the Service.
- Processor / party acting on instructions: for Customer Content — PRDs, roadmaps, tickets, and related materials a Customer or its Users submit — which ProductOS is licensed to host, process, and use only for the purposes set out in Section 5.2 of the Terms and this Policy.
3. Information We Collect
3.1 Account Information
Name, work email, company name, role, authentication credentials, and billing details (processed by our payment processor; ProductOS does not store full card numbers).
3.2 Customer Content
All data, text, documents, product requirements, roadmaps, tickets, project information, feedback, instructions, and other materials a Customer or its Users submit, upload, connect, or otherwise make available to ProductOS — the Terms' defined "Customer Content." This is the most sensitive category ProductOS handles, since it typically reflects unreleased product strategy.
3.3 AI Outputs
Content, recommendations, summaries, requirements, documents, tickets, and analyses the Services generate from Customer Content or User instructions.
3.4 Guest / View-Only User Information
ProductOS's free tier gives unlimited view-only access to Guests invited by a paying PM (engineers, designers, stakeholders). We collect the Guest's name and email to provision access, and their view activity. Guests are Users under the Terms; they do not provide payment information and are not marketed to independently of the inviting Customer.
3.5 Usage and Device Information
Pages visited, clicks, timestamps, browser type, device identifiers, IP address, and similar diagnostic data.
3.6 Third-Party / Integration Information
When a Customer connects a Third-Party Service — Jira, Notion, GitHub, Slack, Figma, Linear, or Confluence today, and in later phases Mixpanel, Amplitude, Stripe, HubSpot, Intercom, Zendesk, or CI/CD tools — ProductOS receives the data and access scope the Customer authorizes, limited to what is needed to read strategy documents and write back tickets, statuses, or comments, consistent with Section 9 of the Terms.
4. How We Use Information
- Operate, maintain, secure, and support the Services.
- Generate AI Outputs from Customer Content and User instructions.
- Manage accounts, billing, and support.
- Monitor usage, performance, and security, including abuse and fraud prevention.
- Conduct aggregated, de-identified analytics and reporting.
- Communicate service, security, and billing notices.
- Carry out Model-Improvement Processing as described in Section 5 below.
- Comply with applicable law and respond to lawful requests.
5. AI Training and Model-Improvement Processing
"Model-Improvement Processing" means using Customer Content to train, fine-tune, evaluate, or otherwise improve ProductOS's own internal AI models, so as to improve the quality, accuracy, and reliability of AI Outputs across the Services. This applies irrespective of your Subscription plan — Free, Starter, Growth, or Enterprise.
Regardless of plan:
- ProductOS does not sell, license, rent, or otherwise disclose Customer Content to any third party for that third party's own independent purposes, and does not sell Customer Content as a commercial data product.
- Customer Content used for Model-Improvement Processing stays within ProductOS's control and is not shared with other Customers or the public, and is never used to generate AI Outputs delivered to another Customer.
- Customer Content may still be processed by third-party AI and infrastructure providers solely as reasonably necessary to deliver the Services (Section 8 of this Policy) — this delivery-related processing is separate from, and not conditioned on, Model-Improvement Processing.
If you do not want your Customer Content used for Model-Improvement Processing, write to hi@productos.live. We will respond and act on your request within 30 days, and confirm the resulting arrangement in writing. Once actioned, your Customer Content is excluded from future Model-Improvement Processing — but because it may already have shaped previously trained or updated internal models, we cannot guarantee that processing which occurred before your request was received can be reversed, or that all derived model parameters can be removed.
6. Legal Bases for Processing
These Terms and this Policy are governed by the laws of India (Section 18.1 of the Terms). Where you are located elsewhere, you may also have rights under your own country's law; ProductOS does not intend to exclude any mandatory protection that applies to you (Section 18.3 of the Terms).
| Jurisdiction | Basis relied on | Notes |
| --- | --- | --- |
|---|
| India (DPDP Act, 2023) | Consent of the Data Principal; "certain legitimate uses" (e.g., contract performance) | Primary regime — ProductOS is an Indian entity and this is the governing law of the Terms. |
| EU/UK (GDPR) | Contract performance, legitimate interests, consent, legal obligation | Applies where a User or Guest is located in the EU/UK, regardless of the Terms' Indian governing law. |
| US (CCPA/CPRA) | Business purpose / service-provider processing; consent for sale/share opt-outs | Applies where a User is a California resident. ProductOS does not sell personal information. |
7. Data Sharing and Sub-processors
ProductOS does not sell or rent personal information. We engage third-party sub-processors — cloud infrastructure and AI technology providers among them — solely as reasonably necessary to deliver the Services, each bound by written confidentiality and data-protection obligations no less protective than those in the Terms (Section 8.2).
| Category | Purpose |
| --- | --- |
|---|
| Cloud hosting & infrastructure | Application hosting, storage, backups |
| Authentication | Login and identity management |
| AI / LLM inference | Generating tickets, alignment scores, and AI Outputs from Customer Content |
| Product analytics | Usage and performance analytics |
| Payments | Billing for Starter, Growth, and Enterprise tiers |
| Customer-authorized integrations | Jira, Notion, GitHub, Slack, Figma, Linear, Confluence (Phase 1); Mixpanel, Amplitude, Stripe, HubSpot, Intercom, Zendesk (later phases) |
A current list naming specific sub-processors is available on request at hi@productos.live, consistent with Section 8.2 of the Terms.
We also share information with: affiliates or successors in a merger, acquisition, or asset sale; and legal authorities where required by law.
8. International Data Transfers
Customer Content may be processed or stored in countries other than the one in which you reside or operate. Where it is transferred internationally, ProductOS applies contractual, technical, and organizational safeguards consistent with applicable law, including India's Digital Personal Data Protection Act, 2023, and equivalent international transfer mechanisms (Standard Contractual Clauses for EU/UK transfers) — matching Section 8.5 of the Terms.
9. Data Retention, Export, and Deletion
ProductOS retains Customer Content for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce applicable agreements (Section 14.2 of the Terms).
Following cancellation or termination, you have no less than 30 days to export eligible Customer Content — including PRDs, generated tickets, and alignment scores — in a commonly used, machine-readable format. Enterprise Customers may negotiate a longer export window in their order form. After that window closes, ProductOS deletes or otherwise disposes of Customer Content in accordance with its retention policy, applicable law, and any contractual obligations, though some information may be retained where legally required or reasonably necessary for security, dispute resolution, or compliance (Sections 14.1 and 14.3 of the Terms).
Because Customer Content may already have been used for Model-Improvement Processing (Section 5, above), deleting it from active systems does not necessarily reverse previously trained or updated internal models, or remove all derived model parameters (Section 14.4 of the Terms).
10. Data Security and Breach Notification
ProductOS implements reasonable technical and organizational measures to protect Customer Content against unauthorized access, disclosure, alteration, or destruction, including encryption in transit and at rest, access controls, and monitoring (Section 8.3 of the Terms). No method of transmission or storage is completely secure.
Where a security incident poses a material risk to the confidentiality, integrity, or availability of Customer Content or personal data, ProductOS will notify affected Customers without undue delay, and in any event within 72 hours of becoming aware of it, and will notify relevant authorities where legally required (Section 8.4 of the Terms).
Enterprise readiness features — SSO, SAML, audit trails, and independent security testing — are available or on the roadmap for Enterprise Customers who require them as part of procurement.
11. Your Rights
11.1 India — Digital Personal Data Protection Act, 2023
If you are a Data Principal in India, you may: request a summary of personal data processed and the processing activities carried out; request correction, completion, updating, or erasure of your personal data; nominate another individual to exercise your rights in the event of death or incapacity; withdraw consent at any time; and file a complaint with our Grievance Officer, and thereafter with the Data Protection Board of India.
11.2 EU/UK — GDPR
If you are located in the EU/UK, you may request access, rectification, erasure, restriction, or portability of your personal data; object to certain processing; withdraw consent at any time; and lodge a complaint with your local supervisory authority.
11.3 United States — CCPA/CPRA
California residents may request access to, deletion of, or correction of personal information, and may opt out of any "sale" or "sharing" as CCPA/CPRA define those terms. ProductOS does not sell personal information and does not knowingly share it for cross-context behavioral advertising.
Requests under any of the above can be sent to hi@productos.live. We will verify your identity before acting on a request.
12. Cookies and Tracking Technologies
ProductOS uses cookies and similar technologies for authentication, session management, and product analytics. Non-essential cookies are set only with your consent where required by law. You can manage cookie preferences through your browser or, where offered, an in-product cookie banner.
13. Children's Privacy
The Service is a business tool directed at working professionals and is not directed to, marketed to, or intended for use by individuals under 18. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we will delete it.
14. Relationship to the Terms of Service
ProductOS does not maintain a separate, generally published Data Processing Addendum. Together, the Terms of Service and this Privacy Policy set out the complete terms on which ProductOS processes Customer Content and any personal data it contains (Section 8.1 of the Terms). If your organization requires a separately executed data processing agreement as a condition of using the Services — for example, as part of Enterprise procurement — contact hi@productos.live to discuss terms.
Where a separately signed Enterprise agreement conflicts with this Policy or the Terms, the Enterprise agreement governs to the extent of the conflict (Section 10.7 of the Terms).
15. Governing Law and Complaints
This Policy is governed by the laws of India. Disputes relating to this Policy follow the same good-faith discussion and courts-of-competent-jurisdiction process set out in Section 18 of the Terms, without limiting any right to bring a complaint before a competent data-protection or consumer authority available to you under your own country's law.
16. Changes to This Policy
We may update this Policy from time to time. Where a change materially affects your rights, we will provide reasonable notice through email, an in-product notification, or another appropriate method, consistent with Section 19.1 of the Terms, and the revised Policy will state its effective date.
17. Contact Us
ProductOS tech
Guwahati, Assam, India
Email: hi@productos.live
Website: https://productos.live
Grievance Officer (India, DPDP Act 2023): Kamaljit Deka · Email: hi@productos.live