Privacy Policy

1. Who we are

This Service is operated by [ProvenShot legal entity name], with registered address at [address], Spain, tax ID [CIF/NIF]. For data protection purposes, we are the data controller. You can contact us at hello@provenshot.com.

2. What data we collect

We collect data only as needed to operate the Service:

• Account data: name, email, password (stored hashed), account preferences.
• Content and proof data: when you create a proof in the mobile app, we store metadata about the capture — exact timestamp, GPS location at the moment of capture, and a cryptographic fingerprint (hash) of the content. Photos and videos themselves remain on your device unless you choose to share them.
• Payment data: when you purchase a plan or pack, payment is processed by Stripe. Stripe receives your card details directly; we do not store them. We retain a transaction reference.
• Verification queries: when someone uses the public verifier to check a proof, we log the query for security and fraud-prevention purposes.
• Technical data: IP address, device type, browser, operating system, and similar information collected automatically when you use the Service.
• Cookies: see our Cookies Policy.

3. How we use your data — legal bases (GDPR)

• To provide the Service (contractual necessity, Art. 6(1)(b) GDPR): account creation, proofs, verification, support, payments.
• To comply with legal obligations (Art. 6(1)(c)): tax records, fraud prevention, lawful requests from authorities.
• To pursue legitimate interests (Art. 6(1)(f)): security, abuse prevention, aggregate product analytics, debugging.
• With your consent (Art. 6(1)(a)): non-essential cookies, marketing communications, optional analytics.

4. Sharing your data

We do not sell your personal data. We share it only with:

• Service providers acting as processors (Stripe for payments, hosting providers, email delivery).
• Authorities, when required by law.
• Business transfers, in the event of a merger, acquisition or sale of assets, with appropriate safeguards.

5. International transfers

Some of our processors may be located outside the European Economic Area. When that is the case, we rely on appropriate safeguards (Standard Contractual Clauses, adequacy decisions) to protect your data.

6. Retention

• Account data: while your account is active, plus a reasonable period after closure for legal and fraud-prevention purposes (typically up to 5 years).
• Proof metadata: proof records are designed to be permanent so verifications keep working. You can request the deletion of your account; proof records associated with you may then be anonymised.
• Payment records: as required by tax and accounting law (typically 6 years in Spain).
• Logs: typically up to 12 months.

7. Your rights

Under GDPR, you have the right to:

• Access the data we hold about you.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten"), subject to legal limits.
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent at any time, without affecting prior processing.
• Lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or the supervisory authority in your country.

To exercise these rights, contact hello@provenshot.com. We will respond within one month.

8. Children

The Service is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, contact us so we can delete it.

9. Security

We use industry-standard technical and organisational measures to protect your data, including encryption in transit, access controls and ongoing monitoring. No method is 100% secure; we do our best to keep your data safe.

10. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new "Last updated" date and, for material changes, notify you in-app or by email.

11. Contact

For privacy questions, contact us at hello@provenshot.com.