Privacy Policy

Organization data is scoped to the relevant organization. Owners and administrators can access member contact details, roles, assignments, attendance, and operational records needed to manage that organization.

If an organizer enables same-shift name sharing, assigned participants can see the names and team labels of other assigned people on their own shifts after the event is published. This is off by default. It does not share contact details or give participants access to the organization roster or other shifts.

When you connect Proximatic to ChatGPT, Codex or another supported client, you approve an organization and specific permissions. To carry out your requests, authorized tools can return event and shift details, member names and roles, team membership, declared availability, assignments, relationship rules, proposal details and attendance timestamps. They also return the record identifiers and links needed to find, review or act on those records; an attendance-sign link grants access to its check-in flow. A participant-message review includes the message text and the organizer contact email if it will appear in the sent message, so you can review what recipients will see. The structured recipient list contains names and member identifiers, not recipient email addresses; text supplied by an organizer can itself contain personal information. Organizer tools can prepare private proposals and apply reviewed changes; participant email requires a separate permission and explicit send approval, or an explicitly approved finite staffing delegation for its specified actions. People or email lists supplied for an import are retained privately with the proposal so application uses the reviewed input. The connected client receives the requested tool results and processes them and your conversations under its own privacy terms, including its retention and deletion controls. Proximatic retains its account and operational records as described below. You can revoke a connection from your Proximatic profile and request access or deletion as described below.

For a reviewed signup rule, the connected client receives the selected contact, existing member references or configured participant names, the exact event and shifts, and the proposed effect for approval. Proximatic matches the contact's verified account locally; rule responses omit stored contact-email fields and private matching credentials. User-provided names and rule labels may themselves contain personal information. The bounded configuration needed for review is retained privately with the proposal and saved rule. When the verified contact signs up, the reviewed rule can place existing members or create named event placements, subject to current permissions and signup constraints. Named placements do not create accounts or guest mailboxes, and do not supply another person's confirmation, waiver acknowledgment or reminder consent. Rule execution does not make another model call. These configurations and their minimal approval and execution receipts follow the operational retention described below. Removing the responsible contact's membership removes its current rule configuration and attachments; existing named placements and operational history follow their own retention.

For an explicitly approved staffing job, the configured AI provider receives a bounded, minimized scheduling excerpt from verified replies, requested dates and time zone, any referenced usual-hours baseline, necessary assignment context, and aggregate progress and approved limits. Proximatic verifies sender identity locally, excludes email headers, routing metadata, attachments and recognized quoted history, and removes recognized contact details. New text, including names and text after signatures, remains available for interpretation. Necessary sender and approved counterpart names, record IDs, baseline hours and shift details can accompany the excerpt or be returned by scoped schedule tools. The full organization identity catalog is not sent. AI distinguishes a person from an ordinary word without a language-specific text classifier. Oversized or structurally unsafe excerpts request a scheduling-only restatement or organizer review. These controls reduce disclosure but cannot guarantee anonymous text: availability and unrecognized personal details may still be personal information. The provider interprets the excerpt and selects scoped MCP actions; Proximatic validates the source, scope, permissions and current constraints before recording facts or applying changes. Connected-client progress tools remain aggregate; original sources and named review remain in the authenticated organization interface for owners and administrators. The deterministic solver receives structured scheduling inputs. Resend, the configured AI provider and database providers process the data needed for their roles, with independent retention and processing terms; provider prompt caching may retain matching context under those terms. We do not claim a provider's zero retention or exclusion from training without the applicable verified agreement. These feature-specific controls do not govern information you independently give a connected client or its other authorized tools.

Organizer inquiries are separate from organization data. Their counts and messages are available in the product only to the configured Proximatic product owner, not to organization owners, administrators or public visitors. We do not verify the submitted email address or treat an inquiry as permission for unrelated marketing.

Published event pages are public and may display event details, team names, aggregate participation, fundraising totals, and donation amounts without donor identity. Users should not post sensitive information in public event content.

We disclose information to service providers only as needed to operate the Service, process payments, deliver communications, store data, monitor errors, and comply with lawful requests.

We retain account and operational records while they are needed to provide the Service. Payment, donation, security, and dispute records may be retained longer for accounting, fraud prevention, and legal obligations. Uploaded content is not subject to an automatic 30-day deletion policy.

Organizer inquiries are retained while needed to handle the request and reviewed for deletion when no longer needed. There is no automatic inquiry expiry. You can request access or deletion through hello@proximatic.app; related notification copies and backups have separate retention and must also be considered.

Organization waiver documents and acknowledgment records remain after signup cancellation, membership removal or account deletion so the accepted version and original participant association are preserved. There is no automatic expiry for these records. Contact hello@proximatic.app and identify the organization to request access or deletion; we review the affected records and the organization's retention needs before changing this history.

Staffing reply text and known-outcome outgoing message content become eligible for automatic deletion 90 days after receipt or creation. The scheduled retention job removes that content; queued replies and messages with unresolved provider outcomes are held for resolution rather than deleted by that job. Scoped declarations, grants, opt-out preferences, rosters and minimal provenance/receipts may remain longer while needed for coordination, security, accounting or disputes. Provider copies and backups have separate retention. To request access, correction or deletion, or report accidentally submitted sensitive information or a suspected disclosure, contact hello@proximatic.app and identify the organization and request without resending the sensitive material. We assess the affected records and providers and any applicable response or notification obligations; a request does not immediately delete a provider copy or a required accounting record.

We use tenant access controls, secure transport, restricted provider credentials, and authenticated one-time QR claims. No internet service can guarantee absolute security, and organizers remain responsible for granting appropriate access within their organizations.

Essential cookies support authentication, security and planning-allowance checks. The browser can retain your unfinished event preview and corrections, consent preference and push-registration state locally. Google Analytics or Google Tag Manager loads only after analytics consent is granted. You can change analytics consent through Cookie Preferences.

When analytics consent is granted and you are signed in, Google Analytics receives a pseudonymous Proximatic account identifier so activity from the same account can be recognized across browsers and devices. We do not send your email address or name as the analytics user identifier. Anonymous visits remain measured with Google's normal browser or device identifier. Optional analytics also covers the ChatGPT and Codex connection steps. A connection approved while analytics is enabled may report bounded tool outcomes using a pseudonymous connection identifier. Prompts, event content, emails, OAuth credentials and callback URLs are excluded. Withdrawing analytics in Cookie Preferences stops measurement for existing connections without removing access; a new connection approval is needed to enable it again. Unauthenticated MCP previews are not measured in Google Analytics because their consent and client identity cannot be verified.

Consented analytics includes public page paths, fixed product-screen labels, referring website domains, shared campaign labels, and actions such as starting signup, preparing a draft, or publishing an event. First-entry context is retained for the browser session so these steps can be measured together. Private event and person identifiers, URL query strings, referrer paths, form contents, and credentials are excluded. The signed-in Proximatic owner account is excluded from browser analytics. Withdrawing consent clears the stored analytics entry context and stops further delivery.

With analytics consent, eligible campaign entries on the volunteer guide and organizer signup page may also contribute to first-party daily campaign landing counts. These store shared campaign labels, entry type, UTC day and count, without IP addresses, browser identifiers, account details or individual visit records. They do not measure unique visitors or email opens. Daily aggregates are retained for up to 90 UTC days while collection is active; dormant collection requires removal of expired aggregates before reactivation. Rejecting analytics does not disable account, event, payment, or attendance functionality.

Shared campaign links may also pass through a first-party redirect that counts requests by UTC day, shared campaign labels and destination type. This server counter operates independently of browser analytics consent and does not use tracking pixels, cookies, browser storage, IP addresses, user agents, referrers, recipient codes or individual request records. Automated email scanners and repeated requests can contribute; these counts do not identify human clicks or email opens. Only the volunteer guide and organizer signup are supported destinations. Reports exclude aggregates older than 90 UTC days; expired rows are removed on successful collection, with maintenance required during periods without collection. Ordinary account and event processing at the destination remains separate.

You can update profile information and communication permissions in the Service. Depending on where you live, you may also have rights to request access, correction, deletion, portability, or limits on certain processing, and to receive equal service when exercising those rights.

Submit a request through the contact form or email hello@proximatic.app. We may need to verify your identity and may retain information where permitted or required by law.