ProjectXL Privacy Policy

1. Who we are and what this policy covers

Transformative Management Solutions LLC, a Virginia limited liability company ("TMS," "we," "us," or "our"), provides ProjectXL. Our privacy contact is support@djobu.com.

This policy explains how we handle personal information in connection with the ProjectXL Excel add-in, our website at djobu.com (including the ProjectXL order and account pages and the beta program sign-up), our licensing and activation service, purchases, transactional email, and support by email (collectively, the "Services"). Personal information means information that identifies, relates to, or can reasonably be linked to an individual.

ProjectXL is desktop software. It has no TMS-hosted storage, no TMS-operated AI service, and no telemetry. The only connections the add-in makes on its own are to our licensing service and, if you configure them, to the AI provider you choose. Separate enterprise, hosting, or professional-services agreements, if any, would supplement this policy and identify any different practices.

This policy describes our practices; it does not itself request consent to optional processing. When consent is required, we request it separately through the relevant form or communication.

2. Your project data stays in your files

Project files under your control. ProjectXL stores every governed plan record inside your Excel workbook (as Excel tables, document properties, hidden sheets, and custom XML parts) and, for large time-phased data, in sidecar files saved next to the workbook. There is no TMS database, sync service, or server-side copy of your project. Installing, activating, or using ProjectXL does not give us the contents of your workbooks.

Local application files. The add-in keeps per-user files under your Windows profile (the ProjectXL folder in your local application data): your license record (which contains your email address and the signed license token, stored in plain text), your encrypted AI provider keys, preferences, window state, tutorial progress, and crash and diagnostic log files. Diagnostic logs are written only when you enable them. None of these files are transmitted to us. We receive their contents only if you choose to send them to us for support.

Where you save your files. If you save a workbook to a location that another provider synchronizes or hosts, such as your organization's file-storage service, that provider's handling of the file is governed by your arrangement with it, not by this policy.

Your organization's role. A ProjectXL license is tied to one email address. When your employer or another organization pays for your license or asks us to issue one, it may receive confirmation that a license exists for that address and its status. The organization controls its own workbooks and its own use of project information.

We act as a controller, or equivalent business, for the account, licensing, purchase, website, and support information described in this policy. We do not process the contents of your project files, so we do not act as a processor of them except where you send project content to support (Section 3.4). These distinctions do not remove any rights you have against us under applicable law.

3. Information we collect and its sources

The categories below reflect what our systems actually receive today. Where a category is collected only through a specific form or feature, we say so.

3.1 Email address and verification. Your email address is your ProjectXL identity. We collect it when you start a free trial, buy a license, request an account link, or when your organization asks us to issue a license to you. We send a verification link to that address; the link expires after 72 hours and can be used once. We do not create passwords and do not hold any password for you. We record whether and when the address was verified, which version of the terms you accepted and when, and whether you ticked the optional marketing box and when.

3.2 Beta program sign-up (website form). The beta sign-up form collects your full name, email address, country, title or role, and organization. We use these to confirm your address, review applications, and contact selected participants.

3.3 Purchase information. Payment is taken on Stripe's hosted checkout page, never on our pages, and we never receive your full card number or card security code. From Stripe we receive and keep: the checkout session and payment identifiers, the Stripe customer identifier, the product and offer purchased, the amount and currency, your billing country (the country you selected on our order page and the country of the billing address you entered at checkout), payment status, and any refund or dispute events. The Stripe event records we store contain the name, email address, and billing address you gave at checkout and, for refund or dispute events, limited payment-method details such as card brand, last four digits, and card country. For purchases outside the United States and Canada, the seller is Link, a Stripe company (Section 6).

3.4 Support information. Support is by email to support@djobu.com. We receive whatever you choose to send: your messages and any files, screenshots, log files, or workbooks you attach. Such materials can include names, labor and cost information, schedules, file paths, and other confidential or personal information. Please remove unnecessary sensitive information before sending. We do not treat a support submission as permission to use your project in demonstrations, testimonials, or marketing.

3.5 Device and connection information from the add-in. When ProjectXL activates, revalidates, or deactivates a license, it sends us your email address and a machine code. The machine code is a one-way SHA-256 hash of your computer's processor identifier and motherboard serial number; the underlying hardware identifiers themselves are never sent. We store the machine code against your license so we can enforce the three-machine limit and let you deactivate a machine, and we store the time of each activation. The add-in sends no file names, workbook contents, usage statistics, crash reports, or software version information to us. Our servers receive the IP address of each request as part of ordinary internet traffic; our application does not store IP addresses, and our application logs are limited to internal identifiers, hashes, rule identifiers, and error types.

3.6 Website and form protection. Our website is a static site. It sets no cookies of its own and uses no analytics, advertising, or session-replay tools. It stores your theme preference (light or dark) in your browser's local storage. The trial, order, account, and beta forms use Cloudflare Turnstile to block automated abuse; Turnstile runs in your browser and, for the trial, order, and account forms, we pass your IP address to Cloudflare when we verify the Turnstile result. To limit abuse of the trial and account-link forms, we keep a short-lived counter keyed to a SHA-256 hash of your IP address and of your email address; these counters are deleted shortly after their 24-hour window ends. Pages load fonts from Google Fonts, which means your browser requests those files from Google.

3.7 AI features (your provider, your key). ProjectXL's AI assistant works only with an API key that you obtain from a provider and enter into the add-in. The add-in sends your prompts and selected project context directly from your computer to the provider you selected. Nothing passes through TMS, and we receive no record of your prompts, responses, or usage. Section 5 describes what is sent and which providers are supported.

3.8 Sensitive information. We do not request sensitive personal information for any part of the Services. Support materials you send can nevertheless contain it. Do not send passwords, API keys, government identifiers, health information, or other unnecessary sensitive data in support messages. Any sensitive information we actually receive is handled for the disclosed, authorized purpose and subject to applicable protections.

4. How we use information

We use your email address, verification status, machine codes, and purchase and license records to issue and administer licenses; verify that you control the address; enforce the machine limit and activation rate limits; deliver purchases; process payments, taxes, refunds, and disputes; and send the transactional emails listed below.

Transactional emails we send. From DoNotReply@djobu.com (replies go to support@djobu.com): email verification; a notice when a new machine is activated on your license; purchase confirmation; a notice when your access end date becomes fixed; reminders before a trial ends (3 days and 1 day before) and before paid access ends (30, 7, and 1 day before); refund confirmations; a short-lived link to your billing portal when you request it; a notice if you request a trial for an address that already has a license; and license-issued notices when your organization arranges a license for you. These emails are necessary to the service and are sent whether or not you opt in to marketing.

Marketing. The order and trial forms include an unticked box, "Send me occasional product news by email." We record your choice and its time. We do not currently send marketing email. If we begin, we will send it only to addresses that opted in, and every such email will include a working way to opt out. You can withdraw your choice at any time by writing to support@djobu.com.

We use connection and operational information to operate and secure the Services, detect unauthorized access or license misuse, investigate errors, and maintain reliability. We use authorized support materials to respond to your request, diagnose the reported problem, and test a correction. We also process information to meet legal obligations, establish or defend legal claims, and prevent fraud or harm.

Where we create aggregate or de-identified information (for example, counts of trials or purchases), we take measures appropriate to the information and applicable law to prevent identification and do not attempt to re-identify it except as legally permitted.

5. AI features and connected services

ProjectXL's AI assistant is optional and is off until you configure a provider key. Supported providers are Anthropic (Claude), OpenAI, Google (Gemini), and xAI (Grok). You choose the provider and model; the add-in does not switch providers or models without your action. Your keys are stored on your computer, encrypted with Windows data protection for your user account, and are sent only to the provider that issued them.

What is sent to your provider. Your prompt and the conversation history of the current session; project identifiers (project code, name, and status date); summary structure lists (work breakdown, organizational breakdown, control account, and work package codes and names, with scope text shortened and the number of rows per list capped); activity codes and row counts; validation findings relevant to your question; and any images or PDF files you attach to the conversation. Workbook cell values beyond these summaries are not sent unless you paste them into a prompt or attach them. The add-in keeps a local count of tokens and estimated cost; that count is not sent anywhere.

Your provider's terms govern. Your agreement with the provider, not this policy, governs how the provider retains, uses, and secures what the add-in sends. The add-in does not set provider retention or model-training options; configure those in your provider account where the provider offers them. TMS receives none of this data and does not use it for any purpose, including training. We do not operate or engage any AI provider on your behalf.

Advisory only. The assistant can analyze, explain, compare, and suggest. It cannot write to your workbook or run calculations; any action it suggests is carried out only if you choose to perform it through the normal product workflow.

Automated actions on our side. Our licensing service applies fixed rules automatically: a bot check on public forms, request limits keyed to hashed IP and email addresses, a block on buying a second license for an address that already has one, and an immediate end of access when a purchase is fully refunded or a payment dispute is lost. These rules do not profile you and are not used to make decisions with legal or similarly significant effects beyond the license itself. You can contact support@djobu.com if you believe a rule was applied in error.

6. When we disclose information

Service providers. We use Microsoft Azure to run the Services: Azure Functions and Azure SQL Database for the licensing service and its records, Azure Static Web Apps for the website, Azure Communication Services to send our email, Azure Key Vault for secrets, and Azure Monitor for operational logs. These resources are hosted in Microsoft's East US and East US 2 regions. We use Cloudflare Turnstile to protect public forms (Section 3.6). The ProjectXL installer is distributed from GitHub, which receives ordinary download request data when you download it. Each provider receives only the information needed for its role, under its contractual terms with us.

Stripe and Link (payments and transaction seller). Stripe, Inc. processes every ProjectXL payment and calculates applicable tax through Stripe Tax. The role Stripe plays depends on your billing country: for the United States and Canada, TMS is the seller and Stripe is our payment processor; for every other country we sell to, the sale is made through Stripe's Managed Payments service and Link, a Stripe company, is the merchant of record. Link collects your name and billing address, may present the price in your local currency, sends your receipt and any refund notice, handles payment disputes, and lets you review your orders at link.com. Stripe and Link process your information under Stripe's own privacy policy for payments, fraud prevention, tax compliance, and their legal obligations. We exchange with them the information needed to fulfill and administer your purchase, including your email address and the product and offer you bought. If Stripe deletes your data at your request, it cancels any subscription sold through Managed Payments and notifies us; our own license record is not changed by that notice unless you also ask us (Section 8).

Tax and accounting. Transaction records (amount, tax, billing country, and date, together with the identifiers Stripe assigns) may be shared with our accountants and tax-compliance providers to file and remit taxes.

Your organization. When an organization arranges or pays for your license, we may confirm to its authorized contact that a license exists for your address and its status and end date.

Community forum. Our forum at project-xl.discourse.group is operated by Discourse under its own terms and privacy policy. Creating a forum account is separate from your license, and we do not transfer your license information to the forum.

Legal and corporate matters. We may disclose information when reasonably necessary to comply with applicable law or valid legal process, protect rights or safety, or address fraud and security incidents. Subject to appropriate protections, information may also be disclosed in a proposed or completed merger, financing, acquisition, or asset transfer. Any successor must handle the information consistently with applicable law and the privacy commitments governing it.

At your direction. We may disclose information for another purpose that you specifically request or separately authorize. We do not publish identifiable customer projects, customer names, or customer logos for marketing without permission.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising.

7. Cookies, browser storage, and privacy signals

Our website sets no cookies of its own and uses no analytics, advertising, or tracking technologies. It stores one value in your browser's local storage: your chosen theme (light or dark). Site search runs entirely in your browser.

Third-party components may set their own cookies or similar identifiers on the pages where they appear: Cloudflare Turnstile on forms that use it, and Stripe on the hosted checkout page and the billing portal, which are Stripe pages.

Because we do not sell or share personal information or engage in targeted advertising, there is no such processing for a browser opt-out signal, such as Global Privacy Control, to stop. We will honor legally required opt-out preference signals if our practices change.

8. Retention and deletion

We keep personal information only for as long as reasonably necessary for the purposes described here, subject to applicable legal requirements. The periods below describe what our systems do today.

Unverified trial requests: if you request a trial but do not verify your email address, the request and its license record are deleted automatically after 7 days. Verification links expire after 72 hours. Form-protection counters (hashed IP and email addresses) are deleted within about 24 hours after their window ends.

License and account records: your email address, verification, terms acceptance, marketing choice, machine codes, and entitlement history are kept for the life of the license and afterward for as long as reasonably necessary to administer entitlements, honor the one-trial-per-address rule, resolve disputes, and document contractual rights.

Purchase and payment event records: purchase records and the Stripe event records described in Section 3.3 are kept for 7 years from the transaction to meet accounting, tax, fraud-prevention, and legal-record obligations. Stripe keeps its own records under its policies.

Transactional email records: the queue entries that generate our emails (template, product, dates, amounts, and delivery status, linked to your license) are kept for as long as reasonably necessary for these purposes. Our email provider's own delivery logs follow its retention.

Beta program sign-ups: kept while the beta program runs and for as long afterward as reasonably necessary.

Support email: messages and attachments are kept in our support mailbox for as long as reasonably necessary after the matter is closed. Materials kept longer for an identified issue are limited to what is needed.

Operational logs: our application logs are kept for their configured retention period. Database backups: automatic Azure SQL backups are kept for their configured retention period, after which deleted data ages out of backups.

When information is no longer needed, we delete it or de-identify it. Deleting your TMS records does not delete ProjectXL workbooks or local application files on your computers, which you control. The ProjectXL uninstaller removes the add-in's local application folder, including the local license record and encrypted provider keys; it does not remove your workbooks or the separate tutorial and authoring folder.

A deletion request and a refund request are different actions. If you ask us to delete your license record, your license and any remaining access end, and we will tell you so before acting; it does not by itself refund a purchase. If you bought through Link, Stripe has its own deletion process, which cancels any Managed Payments subscription and removes its own records; contact the seller named on your receipt for that process, and us for our records.

9. Security

We use administrative, technical, and organizational measures appropriate to the information and Services to protect personal information. Among them: all connections to our services use TLS; license tokens are digitally signed and verified by the add-in against embedded public keys; signing keys and service secrets are held in Azure Key Vault; our application connects to its database with managed identity rather than stored passwords; administrative functions require a secret key compared in constant time; public forms are protected by a bot check and rate limits; and our application logs are designed to exclude email addresses, IP addresses, tokens, and secrets. Access to customer information is limited to TMS personnel with a need for it. We do not claim any third-party security certification.

No system or transmission method is completely secure. You and your organization are responsible for protecting your devices, your workbooks, your email account (which is how your license is verified), the local license record on your computers, and your AI provider keys. We remain responsible for the safeguards and legal obligations that apply to our own processing. We provide incident notifications when and as required by applicable law and our agreements.

10. Your choices and privacy requests

You can see how many of your three machine activations are in use, and deactivate the machine you are on, from the License Management window in the add-in; to deactivate a machine you no longer have, contact support. You can request a link to Stripe's billing portal from the account page on our website to see invoices and payment details for purchases made through TMS; purchases made through Link are managed at link.com. To change the email address on your license, or to access, correct, or delete the information we hold about you, write to support@djobu.com. We do not currently offer a self-service account dashboard for these requests.

Depending on your location and the law applicable to our processing, you may have rights to know about and access your information; obtain a copy; correct or delete it; restrict or object to processing; withdraw consent; or opt out of certain sales, advertising disclosures, profiling, or other covered processing. Rights are subject to applicable exceptions. Withdrawing consent does not affect processing lawfully performed before withdrawal.

We verify requests by confirming control of the email address on the record, which is the same way the license itself is verified, and do not ask for more than we need. Authorized agents may submit requests where the law permits, subject to appropriate proof of authority. We respond within the time required by applicable law and explain a denial and any available appeal or complaint route. We do not discriminate against you for exercising a privacy right.

11. United States state privacy disclosures

Where a state privacy law applies to our handling of your information, the rights in Section 10 apply as provided by that law. To appeal a decision where an appeal right exists, contact support@djobu.com and identify the request. We will explain our decision and how to contact the appropriate authority where required.

For California residents whose information is subject to the CCPA: in the preceding 12 months we have collected the categories described in Section 3 (identifiers and contact information; commercial information about purchases and licenses; internet or network activity limited to the connection information in Sections 3.5 and 3.6; and professional information from the beta sign-up form) from the sources named there, for the purposes in Section 4, and disclosed them to the recipients in Section 6. We have not sold or shared personal information for cross-context behavioral advertising, including information of individuals under age 16. We do not collect or use sensitive personal information to infer characteristics about individuals.

California residents may submit requests by email to support@djobu.com. Statutory privacy rights are not waived by the Terms and Conditions.

12. EEA, United Kingdom, and Swiss information

ProjectXL is sold to buyers in many EEA countries, the United Kingdom, and Switzerland through Link as merchant of record (Section 6). Where EEA, UK, or Swiss data protection law applies to our own processing, our legal bases are: performing a contract with you for the information necessary to issue and administer your license and fulfill your purchase; our legitimate interests in securing the Services, preventing fraud and license misuse, handling support, and managing ordinary business relationships, after considering your rights; compliance with legal obligations, including tax and accounting law; and consent for optional marketing email and any processing that requires it. Where your employer holds the contract, we do not assume that contract is a contract with you.

Your email address and billing country are needed to issue a license and complete a purchase; declining them means we cannot provide the Services. The marketing choice and support submissions are optional.

In addition to the rights described above, you may complain to the competent data protection authority, including the UK Information Commissioner's Office or the Swiss Federal Data Protection and Information Commissioner, as applicable.

13. International processing

TMS is located in the United States, and our services and records are hosted in Microsoft Azure data centers in the United States (East US and East US 2). Stripe, Link, Cloudflare, GitHub, and Google also process information in the United States and other countries under their own arrangements. Those locations may have different data protection laws from your location. You can request information about international transfers at support@djobu.com. We do not claim certification under any transfer framework.

14. Children

The Services are intended for adult professional users and are not directed to children under 18. We do not knowingly collect children's personal information. If you believe a child has supplied personal information to us, contact support@djobu.com so we can investigate and take appropriate action.

15. Changes and contact

We post updates at https://djobu.com/privacy/ and change the effective date. For material changes, we provide notice through an appropriate channel, such as the email address on your license, before the change takes effect where required. We obtain consent when required and do not treat continued use alone as permission for a new purpose that requires consent.

Questions, requests and product support: support@djobu.com. Accessible formats are available on request.