Privacy policy

Last updated: November 2026

Pragma is operated by DappIT (SASU, France) — see the imprint. This policy explains what personal data we process when you use pragma.pm, app.pragma.pm and the Pragma apps for iPhone and Android, and the rights you have under the GDPR. Questions and requests: contact@pragma.pm.

What we collect

• Account data — email, name, authentication identity, organization membership and roles.
• Content you create — projects, work items, comments, file attachments, time entries. This may contain personal data you choose to put there; your organization owns it.
• Billing data — handled by Paddle (merchant of record); we store subscription references and charge events, never card numbers.
• Usage and security logs — quota counters, API usage, and an organization activity history (retention depends on your plan).
• Product analytics — via PostHog, EU region.
• Website audience measurement — on pragma.pm: pages viewed, clicks, how far you scroll, the page that sent you, campaign tags in the link, and your browser, operating system, device type, screen size, language and time zone. Via PostHog (EU region), without cookies; see Cookies.
• AI feature data — meeting recordings you upload are transcribed, and AI features process the content you point them at. Nothing is used to train models.

The mobile apps

The Pragma apps for iPhone and Android send the service what the web application does — your account identity and the content you author — plus the following. They contain no advertising and no tracking, and no third-party analytics.

• Meeting recordings — the apps use the microphone only between Start recording and Stop, after you allow it. The audio is uploaded for transcription, a summary and suggested actions, and kept with the recording until you delete it or your account.
• Push notifications — when you turn notifications on for a phone, the app registers it with a push token and a description of the device (for example “iPhone · iOS 17.5”). Notifications reach iPhones through Apple’s push notification service and Android phones through Google’s Firebase Cloud Messaging; the notification’s text passes through that service.
• Crash reports (iPhone app) — crashes, hangs and diagnostics, via Sentry. They are not linked to your account: no user identity, no request contents, only a random identifier per installation.
• Data on the phone — the apps keep a copy of the data you can see on the phone so they work without a connection, plus anything not yet sent. Deleting your account from the app erases it.

Where it lives

Application, database and file storage run in the European Union (AWS eu-west-1, Ireland; Couchbase Capella in the same region). Analytics and email providers run in their EU regions. Data is encrypted in transit (TLS) and at rest, with 30-day rolling encrypted backups.

Processors

We use the following processors under data processing agreements:

• AWS (hosting, storage — EU)
• Couchbase Capella (database — EU)
• Ory (authentication)
• Paddle (billing, merchant of record — UK, adequacy decision)
• Resend (email — EU region)
• PostHog (analytics — EU region)
• Sentry (error tracking — US, standard contractual clauses)
• Google (AI features — US, standard contractual clauses)
• AssemblyAI (meeting transcription — EU processing)

How long we keep it

• Account data: for the life of the account; hard-deleted when the account is deleted.
• Organization content: for the life of the subscription, plus a 30-day export window after cancellation, then deleted.
• Activity history: 7 days to unlimited, depending on plan.
• Meeting recordings: until you delete them, or delete your account.
• Phones registered for push notifications: until you turn notifications off on that phone, or delete your account.
• Invoicing records: 10 years (French commercial law).
• Backups: 30 days rolling.

Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to certain processing. Pragma includes self-service tools: export your organization's data as JSON, export your personal data, and delete your account from the iPhone or Android app. To delete your account without the app, and to see exactly what deletion erases and what it keeps, follow the steps on pragma.pm/support. For anything else, write to contact@pragma.pm. You may also lodge a complaint with the CNIL (cnil.fr) or your local supervisory authority.

Cookies

The marketing site sets no cookies and stores nothing in your browser. It measures visits with PostHog (EU region) in cookieless mode: to count unique visitors, PostHog's servers combine your IP address, your browser's full user-agent string and the site with a random value that changes every day, then delete the IP address and the user-agent string before the visit is stored. A visitor is therefore not recognised from one day to the next. The application uses cookies necessary for signing you in, and EU-hosted product analytics.