Privacy Policy
Version 1.4 · Effective 21 October 2026
1. Who we are
Pavitt Public Finance, LLC ("we", "us") operates the service at pfmexpert.net. This policy explains what we collect, why, and your choices. Questions: support@pfmexpert.net.
2. Information we collect
Account data you provide (name, email, job title, organisation, and the pathway and access level chosen at registration). If you choose to sign in with Google or Microsoft, we receive from that provider the details it shares for sign-in, such as your name, email address and an identifier for your account with it (for a Microsoft work or school account, also identifiers for your organisation's directory), and use them only to sign you in to your account; we never receive the password for that account. That provider handles the sign-in under its own terms and privacy policy. If your organisation has set up sign-in through its own identity provider, we receive from that provider only your work email address and display name, and use them only to sign you in; your organisation manages that sign-in under its own arrangements. Billing data handled by our payment processor, Stripe (billing address and tax identifiers; card details are entered with Stripe and are not stored by us). Usage data (how you use the training and the Desk). Content you submit, including Desk questions and any documents you upload. Technical data such as authentication cookies and, for security and abuse-prevention, a hashed form of your IP address and your browser user-agent. We count visits to our pages with Vercel Web Analytics, a service of our hosting provider. It sets no cookies and stores nothing on your device. For each visit it records the page, the referring site, your approximate location (country, region and city), your device type, and your browser and operating system. To count a visitor only once a day, it uses a code derived from your connection that Vercel discards within 24 hours. It does not identify you by name and does not follow you across other websites. Business contacts: we may collect the names and work contact details of professionals from public sources, such as published procurement notices and project listings, to contact them about our services. We keep a record of anyone who asks not to be contacted, so that we do not contact them again.
3. How we use it
To provide and operate the service; to authenticate you and keep accounts secure; to process payments and applicable taxes; to respond to your questions; to maintain and improve the service; and to comply with law. We rely on performing our contract with you, our legitimate interests in running and securing the service, and your consent where required. If you ask for a download, we keep your email address to send it. If you also tick the box to hear from us, we use it to send occasional practice notes; every such email has an unsubscribe link, and we keep a record of anyone who unsubscribes so that we do not email them again. If your organisation, or a training provider that enrolled you, manages your account, it can see your training progress and results, how much you use the Desk, and, where the Desk's checks flag an answer for review, the question you asked. We may review the questions and answers that our checks flag, to maintain and improve the Desk.
4. Service providers and subprocessors
We share data only as needed with providers that help us operate the service: Supabase (database, authentication, and document storage), Vercel (hosting and page-visit statistics), Stripe (payments and tax), Resend (email delivery), OpenRouter and the model providers it routes our requests to (drafting Desk answers, checking and reviewing each citation against its source, translating search queries, source excerpts and, in a donor review, a finding into English to search the document it cites, and creating text embeddings for search), and Mistral AI (optical character recognition, in the EU (Paris) region, used only to read scanned or photographed document uploads; on our paid plan your content is not used to train models and is deleted within 30 days). The model providers we currently use, and the countries where they process data, are listed with the date of the last change on our Security page. We use these providers under terms governing their processing for us. Where a provider acts as a processor or subprocessor, we put required data-processing terms in place. For customers for whom we process personal data as a processor under a data processing addendum (DPA), additions or replacements of subprocessors are governed by that DPA, including any required advance notice and opportunity to object.
5. AI processing of your questions and documents
When you use the Desk, your question, any documents you attach, and the source material retrieved to answer it are sent through OpenRouter to language-model providers, to draft a response and to check each citation in it against its source. For these calls we instruct OpenRouter to use only providers that do not store the content or train on it. Scanned or photographed uploads are first read by an optical-character-recognition service (Mistral AI, in the EU (Paris) region) to extract their text; on our paid plan that content is not used to train any model and is deleted within 30 days. We do not use your submitted content to train any model, and we do not sell your data.
6. Retention
We keep account and billing records for as long as your account is active and as required for legal, tax, and accounting purposes, then delete or anonymise them. Desk conversations, answers, and any documents you upload are retained while your account is active so you can refer back to them; you can delete an uploaded document, together with the text extracted from it, at any time from the conversation. Deleted customer content may remain in encrypted managed backups for up to seven days until those backups expire in the ordinary course; backups are used for restoration and security, not as active customer content. Provider-specific transient retention, including the Mistral AI period stated in Section 5, is separate. Acceptance records of the Terms are kept as a record of the agreement.
7. Your rights
Depending on where you live, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise them, contact support@pfmexpert.net. You can also manage billing details through the customer portal.
8. International transfers and data location
We and our providers process personal data in the countries needed to operate the service. For the standard shared pfmexpert.net deployment as of the effective date of this policy, the primary application database and document storage are hosted in Mumbai, India, and optical character recognition for scanned or photographed uploads is performed in the European Union (Paris, France). Hosting, payment, email, and related processing may also occur in the United States, the European Union, and other countries used by the providers named above. For model inference we use only providers based in the United States or the European Union; the providers, and where they state it the countries in which they process data, are listed on our Security page. Where required, we rely on appropriate safeguards for cross-border transfers. These statements describe the current standard deployment; they are not a contractual data-residency or localisation promise. Any binding customer-specific residency or localisation commitment is stated in a signed Order Form, DPA, or security schedule, and that signed document controls for that customer.
9. Security
We use access controls, encryption in transit and at rest, row-level security in our database, and private, per-account storage for uploaded documents to protect data. No system is perfectly secure; you are responsible for keeping your credentials safe.
10. Children
The service is not directed to children under 13, and we do not knowingly collect their data.
11. Changes
We may update this policy to reflect changes in the service, providers, law, or our data practices. We will revise the version and effective date when we do and provide appropriate notice of a material change. Replacing or adding a provider that performs materially the same function does not, by itself, require reacceptance of the Terms or this policy. We will seek affirmative reacceptance or other consent when a change materially alters the contractual or consented data bargain, or when applicable law requires it. Relevant factors include a new or materially expanded processing purpose, material new data categories, new model-training or other secondary-use rights, materially longer retention, a material change in transfer or residency geography, a material reduction in security commitments, or a material reduction in user rights. Where a DPA applies, its subprocessor notice and objection process applies independently of whether the site Terms or this policy require reacceptance.