This Privacy Policy explains what personal data pmo.one collects through the pmo.one website and platform, why we use it, who we share it with, and the choices you have.
pmo.one is operated by Ehab Digital Marketing, headquartered in Amman, Jordan. We are committed to transparency, data minimization, and the strict protection of your enterprise project governance data.
Our Commitments at a Glance
Your personal information and company records are never monetized or sold to third parties.
We do not use your proprietary prompts, contracts, or project data to train foundation AI models.
Uploaded contract files are parsed in temporary memory and are never written to permanent disk storage.
Data in your workspace is strictly segregated from every other customer through multi-tenant database rules.
1. Who We Are and Our Role
Ehab Digital Marketing, Amman, Jordan operates pmo.one. Depending on the nature of the data, our role under applicable privacy laws (including GDPR and regional data protection regulations) is structured as follows:
| Data Type | Our Role | Who Decides How It Is Used |
|---|---|---|
| Account, billing, website, and support data | Controller | pmo.one, as described in this policy |
| Customer Data inside a workspace (projects, tasks, contracts metadata, resources, RAID items, and personal data within them) | Processor | The customer organization that owns the workspace |
2. Data We Collect
We collect personal information to provide institutional delivery intelligence and authenticate authorized users:
| Category | Examples | Source |
|---|---|---|
| Account Data | Name, work email, password (stored as a secure hash by Firebase Authentication), Google sign-in profile, role, workspace. | You, your Admin, or Google if you use Google sign-in |
| Profile & Resource Data | Job title, department, skills and proficiency ratings, capacity, cost and billing rates, allocations, leave records. | You or your organization |
| Project & Work Data | Projects, tasks, assignments, comments, milestones, deliverables, sign-offs, risks, and issues. | You and other users in your workspace |
| Contract-Derived Data | Extracted contracting parties, contact names, roles, milestones, clauses, and financial payment terms. | Contracts you upload (the files themselves are not stored) |
| AI Inputs & Outputs | Prompts to the AI Insights Copilot, generated briefings, suggested tasks, risk predictions. | You and the AI Features |
| Usage & Audit Data | Sign-ins, actions, changed values, timestamps, IP address, device and browser type, AI token usage. | Collected automatically |
| Billing Data | Billing contact, company name, plan, invoices. Payment card details are handled by our payment processor, not stored by us. | You |
| Communications | Support requests, feedback, inquiries, and emails sent to our desk. | You |
| Website Data | Pages visited, referrer, contact form entries. | You and cookies (Section 5) |
3. How We Use Data and Our Legal Bases
| Purpose | Legal Basis (where GDPR or similar laws apply) |
|---|---|
| Create and manage accounts, approve workspace access, enforce roles | Performance of a contract |
| Provide platform features, including dashboards, EVM, Monte Carlo, resource calendars, and notifications | Performance of a contract |
| Run AI Features on your request (Section 4) | Performance of a contract |
| Keep audit logs, detect fraud and abuse, enforce our Terms and Google's Generative AI Prohibited Use Policy | Legitimate interests in security and compliance; legal obligation |
| Bill you and keep financial records | Performance of a contract; legal obligation |
| Respond to support requests | Performance of a contract; legitimate interests |
| Send service emails (approvals, password resets, assignment alerts) | Performance of a contract |
| Improve the platform using aggregated, de-identified usage statistics | Legitimate interests |
| Send product news and marketing | Consent, which you can withdraw at any time |
4. AI Processing and Contract Uploads
AI Features run only when explicitly triggered by a user, such as uploading a contract, generating tasks for a milestone, predicting delivery risks, or asking the AI Insights Copilot a question.
The relevant Input and the minimal workspace context required to answer it are dispatched from our secure backend servers to Google's Gemini API over TLS-encrypted connections. Your browser never calls external AI endpoints directly.
Uploaded contract documents (PDF, Word, text) are loaded into ephemeral server memory strictly for the duration of the parsing routine, and are immediately discarded. Files are never saved to cloud storage buckets or persistent hard disks. We record only the extracted structured fields that you inspect and approve.
We do not use your customer data, prompts, or contract contents to train or fine-tune AI foundation models. Our integration with the Gemini API uses enterprise settings that ensure customer inputs and completions are not used to improve or train Google models.
AI outputs—including resource optimization, skill evaluations, and risk forecasts—are advisory recommendations intended for human review. They are never used to make autonomous or binding legal decisions about individuals.
All AI usage is subject to Google's Generative AI Prohibited Use Policy. Automated safety screening is applied to prevent abuse, security violations, and unlawful activities.
5. Cookies and Similar Technologies
| Type | Purpose | Can You Turn It Off? |
|---|---|---|
| Strictly Necessary | Maintain authenticated sessions (Firebase Authentication tokens in local browser storage), defend against cross-site attacks, and remember security settings. | No; the platform cannot operate without them. |
| Preferences | Remember interface choices such as dashboard active filters, grid view modes, and theme selections. | Yes, through browser storage settings; some interface preferences will reset. |
6. Sharing and Sub-Processors
We share personal data only as required to operate pmo.one, with vetted infrastructure providers and under strict data processing agreements:
| Recipient | Why | Data Involved |
|---|---|---|
| Google Cloud / Firebase | Cloud database hosting (Firestore), user authentication, server-side compute infrastructure. | All platform data |
| Google (Gemini API) | AI Features, contract text parsing, autonomous WBS suggestions. | AI Inputs and workspace context needed for each request |
| Email Delivery Provider (EmailJS) | Inquiry routing, registration notifications, password-reset emails. | Name, email, message content |
| Payment Processor | Subscription checkout, invoicing, tier payments. | Billing contact and payment details |
| Other Users in Workspace | Collaboration according to assigned roles (Admin, Partner, Editor, Viewer). | Your profile, assignments, and activity |
| Professional Advisers / Authorities | Legal compliance, regulatory enforcement, defending legal claims. | As legally required |
| A Buyer or Successor | Merger, acquisition, or corporate reorganization under this policy's protections. | As needed under strict NDA |
7. International Transfers
Your data is hosted in Google Cloud United States multi-region infrastructure. Our service providers, including Google, may process data in other global data centers.
8. Data Retention Schedule
| Data | How Long We Keep It |
|---|---|
| Uploaded Contract Files | Not retained; discarded from volatile server memory once parsing finishes. |
| Customer Data in a Workspace | Retained for the active duration of the subscription; permanently deleted within 30 days of subscription termination unless exported earlier. |
| Deleted Items (e.g. deleted contract records, tasks) | Removed from active database indexes immediately. |
| Account Data | Retained while your account is active; deleted or anonymized within 30 days of deactivation, unless workspace retention policies require preservation. |
| Audit & Access Logs | 2 years, or longer where statutory obligations or customer compliance agreements mandate. |
| Billing and Tax Records | Retained as required by accounting and tax laws, typically 2 years minimum. |
| Marketing Preferences | Retained until unsubscription, plus an immutable suppression list to prevent future unsolicited outreach. |
9. Security Measures
We safeguard personal and enterprise delivery data through comprehensive technical and organizational controls:
If we become aware of a personal data breach affecting your workspace, we will notify affected customers and supervisory authorities as required by law. Report security concerns or vulnerability disclosures to info@pmo.one.
10. Your Rights & Choices
Depending on your location and applicable privacy laws, you possess fundamental rights regarding your personal information:
Email our privacy team at info@pmo.one. We verify your identity and respond within 30 days (or sooner if mandated by local regulations). If your request concerns Customer Data within an organization's workspace, we forward it to your workspace Administrator, who determines how to respond. We never discriminate against any user for exercising their legal privacy rights.
You can also manage and update your user profile directly in pmo.one, and unsubscribe from marketing communications using the link provided in any broadcast message.
11. Children, Changes and Contact
Children's Privacy
pmo.one is an enterprise business delivery platform designed for professionals aged 18 and older. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately and we will promptly delete it.
Policy Changes & Versioning
We may update this Privacy Policy as our platform capabilities or applicable statutory obligations evolve. Updated versions will be published on this page with a revised effective date. For material changes affecting data usage, we will notify workspace Administrators in-app or via direct email at least 30 days in advance.
Ehab Digital Marketing
Amman, Jordan
Privacy questions, data protection addendums, and statutory inquiries: info@pmo.one