Privacy Policy
Last updated: 2 November 2026 · This Privacy Policy explains how ePropels collects, uses and protects personal data under the GDPR. Privacy contact: info@epropels.com.
1. Who we are and GDPR
ePropels is operated from Portugal, so the EU General Data Protection Regulation (GDPR) and Portuguese law apply. For your account data we act as controller. For the client data you upload (contacts, proposals, files, signatures) your agency is the controller and ePropels acts as its processor.
2. What data we collect and why
• Account: name, email, password (stored hashed) or Google/Microsoft sign-in — to create and secure your account. • Workspace content: clients, proposals, files, templates and team members — to provide the service. • Billing: plan, subscription status and Stripe customer reference (we never store full card numbers) — to charge your subscription. • Proposal recipients: name, signature, email code verification, time, browser details and document fingerprint — to record signatures; views and engagement — to show the agency proposal activity. • Technical: logs and security data — to keep the service secure. • Optional analytics: Google Analytics, only if you accept it in the cookie banner.
3. Legal basis
Contract (Art. 6(1)(b)): account, workspace, billing and signing. Legal obligation (Art. 6(1)(c)): invoicing and tax records. Legitimate interest (Art. 6(1)(f)): security, fraud prevention and service emails. Consent (Art. 6(1)(a)): optional analytics cookies and any marketing messages — you can withdraw it anytime.
4. Cookies
Essential storage keeps you signed in and remembers language, theme and your cookie choice. Analytics cookies load only after consent. Change your choice anytime via “Cookie preferences” in the footer.
5. Marketing messages
We only send account and service emails (sign-in, password reset, signature codes, billing). We do not send promotional emails without your prior opt-in consent, and every marketing message will include an unsubscribe link. Agencies using ePropels must obtain their own consent before sending marketing to their clients.
6. Who we share data with
We do not sell personal data. We use these service providers (processors) under data processing agreements: Lovable Cloud / Supabase (hosting, database, authentication), Cloudflare (network and security), Stripe (payments and subscriptions), our email delivery provider (account emails), Lovable AI Gateway and its model providers (AI writing features, without training on your data), Google (optional analytics, Google sign-in) and Microsoft (Microsoft sign-in). CRM tools such as HubSpot, Pipedrive or Salesforce receive data only when you connect them. Some providers may process data outside the EEA under Standard Contractual Clauses or an adequacy decision.
7. How long we keep data
Account and workspace data: while your account is active, then deleted within 30 days of a deletion request or account closure. Signed proposals and signature evidence: kept for as long as the agency keeps the document, as proof of agreement. Billing and invoice records: 10 years, as required by Portuguese tax law. Security logs: up to 12 months. Analytics: up to 14 months.
8. Your rights and data deletion
You may request access, correction, deletion, restriction, portability or object to processing, and withdraw consent. To delete your account and data, email info@epropels.com from your account email with the subject “Delete my account”. We confirm your identity and complete the request within 30 days (legally required records such as invoices are kept only as long as the law requires). You can also export your proposals and payment reports from the app. You may complain to the Portuguese authority CNPD (www.cnpd.pt).
9. Data security
All traffic uses HTTPS with HSTS through Cloudflare. Data is protected by per-workspace access rules in the database, role-based permissions, hashed passwords and one-time codes, encrypted integration tokens, HMAC-sealed signature evidence and a tamper-proof audit log. Payment cards are handled only by Stripe.
10. Data breach procedure
If a personal data breach occurs we will contain it, assess the risk, notify the CNPD within 72 hours where required (Art. 33 GDPR), inform affected agencies without undue delay so they can meet their own duties, and notify affected people directly when the risk is high (Art. 34). Every breach is documented internally.
11. Changes
We will post updates on this page and notify account owners of material changes by email.