Privacy policy

Last updated: August 2026

Pragma is operated by DappIT (SASU, France) — see the imprint. This policy explains what personal data we process when you use pragma.pm and app.pragma.pm, and the rights you have under the GDPR. Questions and requests: contact@dappit.fr.

What we collect

• Account data — email, name, authentication identity, organization membership and roles.
• Content you create — projects, work items, comments, file attachments, time entries. This may contain personal data you choose to put there; your organization owns it.
• Billing data — handled by Paddle (merchant of record); we store subscription references and charge events, never card numbers.
• Usage and security logs — quota counters, API usage, and an organization activity history (retention depends on your plan).
• Product analytics — via PostHog, EU region.
• AI feature data — meeting recordings you upload are transcribed, and AI features process the content you point them at. Nothing is used to train models.

Where it lives

Application, database and file storage run in the European Union (AWS eu-west-1, Ireland; Couchbase Capella in the same region). Analytics and email providers run in their EU regions. Data is encrypted in transit (TLS) and at rest, with 30-day rolling encrypted backups.

Processors

We use the following processors under data processing agreements:

• AWS (hosting, storage — EU)
• Couchbase Capella (database — EU)
• Ory (authentication)
• Paddle (billing, merchant of record — UK, adequacy decision)
• Resend (email — EU region)
• PostHog (analytics — EU region)
• Sentry (error tracking — US, standard contractual clauses)
• Google (AI features — US, standard contractual clauses)
• AssemblyAI (meeting transcription — EU processing)

How long we keep it

• Account data: for the life of the account; hard-deleted when the account is deleted.
• Organization content: for the life of the subscription, plus a 30-day export window after cancellation, then deleted.
• Activity history: 7 days to unlimited, depending on plan.
• Invoicing records: 10 years (French commercial law).
• Backups: 30 days rolling.

Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to certain processing. Pragma includes self-service tools: export your organization's data as JSON, export your personal data, and delete your account or organization from the app. For anything else, write to contact@dappit.fr. You may also lodge a complaint with the CNIL (cnil.fr) or your local supervisory authority.

Cookies

The marketing site sets no advertising trackers. The application uses cookies necessary for signing you in, and EU-hosted product analytics.