# Product Owner AI Privacy Policy

Effective date: 3 November 2026

Product Owner AI processes account, workspace, project, document, meeting recording, billing and integration data to provide requirements analysis and delivery-tool publishing features.

## Data used

- Account details supplied through Google, Atlassian, or email/password authentication.
- Documents and meeting recordings uploaded or pasted by the user.
- Workspace project context and generated requirements artifacts.
- Jira and Confluence workspace metadata and content created at the user's request.
- Billing events and purchase records managed by Stripe. Stripe receives payment details directly; Product Owner AI does not store card numbers.

## How data is used

Data is used only to authenticate users, operate workspace features, generate requested analysis, publish requested work items, process subscriptions and credits, prevent abuse, and provide support. Meeting recordings are transcribed and classified to produce requirements and missing-information reports.

## Storage and sharing

Workspace content and provider credentials may be encrypted at rest and are shared only with the connected services the user chooses, such as Atlassian, Google, Stripe, and configured AI providers. Product Owner AI does not sell personal information or uploaded content. Service providers process data under their own terms and security controls.

## Retention and deletion

Users may remove content through the application or request account and workspace deletion from support. Billing records may be retained where required for tax, fraud prevention, dispute handling, or legal obligations.

## Security

The service uses authenticated sessions, workspace authorization, CSRF protection, encrypted credentials, HTTPS in production, rate limits, and secret-management controls. No internet service can guarantee absolute security.

## Contact

Privacy requests: privacy@productownerai.com

This policy must be reviewed and replaced with the publisher's legal entity, support contact, data-controller address, retention periods, and any jurisdiction-specific rights before Chrome Web Store submission.