Privacy Policy

The information we handle depends on how you use Prooflin. Most of it comes from you. Some comes from Workspace members who invite you, from our merchant of record about the status of a purchase, and, if you allow them, from optional analytics and advertising technologies.

Account and contact information

Your name, email address, and the details you add to your profile. For an organization, this can include its name and the names of its Workspaces.

Authentication and security records

Records needed to sign you in and keep your account secure, such as sign-in times, the sign-in method used, session records, and two-step verification settings where you use them.

Workspaces, roles, Projects, and settings

The Workspaces you belong to, your role in each, invitations, Projects, branding and delivery settings, and other configuration.

Website addresses and public material

The URLs, sitemaps, or page lists you supply for a Website Audit, and the publicly accessible content of those pages that we retrieve to perform it.

Uploaded files and campaign data

Screenshots, images, logos, creative assets, documents and selected PDF pages, campaign exports, and figures you upload or enter. These can contain personal information if you include it, for example names or contact details visible in a screenshot.

Extracted material, findings, and reports

Text and data extracted from your inputs, findings, scores, recommendations, report drafts and your edits, finalized reports, exported PDFs, and the sharing settings you choose for a report, such as its publication status and password protection.

Subscription and billing information

Your Workspace’s plan, billing cadence, Trial and subscription status, invoices, and transaction references. Payment details are collected by Dodo Payments as merchant of record for applicable purchases. We don’t receive your full card number.

Enquiries and correspondence

What you tell us when you contact us or ask about Enterprise, such as your name, email address, company, topic, and message, and our replies.

Device, browser, network, and log information

IP address, browser and device type, operating system, language, timestamps, pages requested, referring page, and error and security logs. We use this to operate and protect the website and service.

Consent records

The cookie and tracking choices you make, when you made them, and the version of the choices you were shown.

Optional analytics and advertising information

Only if you allow it: information about how you use our website and respond to our ads, such as pages viewed, interactions, and conversion events. Section 10 and the Cookie Policy explain these choices.

Using Prooflin does not connect it to your advertising accounts, analytics accounts, or design tools, and Prooflin doesn’t access private or members-only areas of websites. Campaign and design material reaches us only when you upload or enter it.

Please don’t supply sensitive information that an audit doesn’t need, such as health or financial details about individuals, and never include passwords, one-time codes, or other credentials in uploads or messages.

3.1 What we use information for

• To provide your account and the features you request, including sign-in, Workspaces, Projects, team membership, and the features of your plan.
• To run audits, and to generate, store, edit, export, and publish reports as you and your Workspace direct.
• To manage Trials, subscriptions, and billing records, and to send service communications such as sign-in codes, invitations, receipts, and important notices about your account or the service.
• To answer enquiries, provide support, and administer customer and Enterprise relationships.
• To prevent misuse, fraud, and abuse, and to protect the security of the service, our customers, and others.
• To maintain and improve the service using operational information, such as errors, performance, and feature usage. This does not include using your private audit content to train AI models.
• To meet legal, tax, and accounting obligations, and to establish, exercise, or defend legal claims.
• To understand how our website is used and to measure our advertising, only where your cookie choices permit it.

3.2 Legal grounds

Some privacy laws, such as those in the European Economic Area and the United Kingdom, require a legal ground for each use of personal information. Where they apply, we rely on the following:

Performance of a contract

Providing your account, Workspaces, audits, and reports; administering Trials, subscriptions, and billing; and sending the service communications those require.

Legal obligations

Keeping accounting, tax, and legal-acceptance records, responding to lawful requests from authorities, and meeting other requirements the law places on us.

Legitimate interests

Securing the website and service and preventing misuse; answering enquiries that aren’t part of a contract, including Enterprise enquiries; maintaining and improving the service using operational information; and establishing or defending legal claims. We weigh these interests against your rights, and you can object to this processing.

Consent

Optional functional, analytics, and advertising technologies, and any other use for which we ask your permission, such as featuring a report in public marketing. You can withdraw consent at any time.

We do not rely on legitimate interests for optional analytics or advertising technologies. They run only with your consent. Where the law of your location sets other conditions for processing personal information, we follow them.

3.3 Separate choices

Accepting our Terms of Service, acknowledging this Privacy Policy, and deciding whether to allow optional tracking are separate. Accepting the Terms does not give consent to optional cookies or tracking, and declining optional tracking does not affect your account or your use of the service.

4.1 Our commitment

“Private audit content” means the inputs you supply for an audit, the material extracted from them, and the reports made from them. A report you choose to publish or share remains yours, and the commitment above still applies to how we use it.

4.2 How AI processing works

To prepare findings and report content, Prooflin sends selected audit information, meaning the parts of your inputs that the requested analysis uses, to OpenAI models through Vercel AI Gateway. The output returns to your Workspace as a draft.

We have configured this processing with a restriction against the provider using it to train its models. This is not a promise that providers never access or keep the information. OpenAI and Vercel process it to provide their services, may keep limited information for a period for security and abuse prevention under their own terms, and may process it outside India. That provider retention can differ from Prooflin’s own retention schedule in section 8.

4.3 Review before delivery

AI output can be incomplete or wrong. Every report stays a draft until someone in your Workspace reviews, edits, and finalizes it, and it reaches other people only if you publish it or share it.

4.4 Proprietary details

We don’t publish the prompts, internal scoring methods, operational instructions, or other implementation details Prooflin uses, because they are part of our proprietary service technology. This does not limit your rights over the personal information we hold about you.

• Running an audit does not make your uploads or reports public.
• Workspace permissions govern which members of a Workspace can view, edit, export, or publish its content. The Workspace Owner and Admins manage membership and roles.
• When you deliberately publish a report, the selected report snapshot and its report-safe assets become available at the report’s link. Other Workspace information and the source uploads behind the report are not published automatically.
• Anyone who has an accessible report link may be able to read the report, subject to the access controls you configure, such as a password.
• Asking search engines not to index a report (noindex) is not an access control. It doesn’t stop anyone who has the link from opening the report.
• Password protection limits who can open a hosted report. It doesn’t stop recipients from forwarding the link and password, or from passing on what they read.
• Unpublishing withdraws the hosted report’s authoritative availability, so its link no longer serves the report. It cannot recall PDFs that were downloaded, screenshots, copies held by recipients, or copies held in external caches such as search engines and web archives.
• An exported PDF is a file you control. Once you send it, its recipients can keep and forward it.

6.1 Service providers

We use the following service providers to run Prooflin. We share with each one the information it needs to provide its service to us.

As merchant of record, Dodo Payments sells applicable purchases to you and handles their payment, billing, and tax. It processes the information involved under its own terms and privacy policy, and it tells us the status of a purchase and its transaction references.

Sign-in is handled by authentication software that runs as part of the Prooflin service. It is not a separate company that receives your information.

6.2 Optional website technologies

Where enabled, and subject to your choices, optional analytics and advertising providers listed in the Cookie Policy may receive information about your use of our website. A provider being listed does not mean its technology is active on every page or every visit, and none of them runs before you allow its category.

6.3 Other disclosures

We may also disclose personal information:

• At your direction, for example when you publish a report, share its link, or invite someone to a Workspace.
• For legal obligations, when the law, a regulation, legal process, or an enforceable request from a public authority requires it. Where we are allowed to, we check that a request is valid and limit what we disclose.
• To protect rights and safety, when reasonably necessary to protect Prooflin, our customers, or others, including to prevent fraud and security threats or to enforce our Terms of Service.
• To professional advisers, such as lawyers, accountants, auditors, and insurers, where they need it to advise or serve us and under duties of confidentiality.
• In a business transfer, such as a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to the protections applicable law requires. Where the law requires, we will tell you if your information becomes subject to a different privacy policy.

Prooflin serves customers globally. Zealsync is based in India, and our service providers may process information in other countries, including countries whose privacy laws differ from those in your country.

Where the law that applies to your information requires a safeguard for transferring it to another country, we must rely on a transfer mechanism that law recognizes, such as contractual clauses approved by the relevant authority or another basis the law permits.

To ask about the safeguards relevant to your information, contact our Legal team.

We keep information only for as long as we need it for the purposes in this policy. Different material follows different schedules:

Raw uploads follow their own schedule. They are not kept for as long as your Workspace stays active; saved reports and Workspace records are.

The periods above are targets for our ordinary deletion processes, not a guarantee that every copy is erased instantly everywhere. Deletion runs on a schedule, and information in backups is removed when those backups expire.

A legal or security hold means we must preserve specific information for an investigation, a dispute, or a legal requirement. Where the law requires it, or where information is needed for security, fraud prevention, or a legal claim, we may keep minimized, access-restricted records for longer, and only for as long as that need lasts.

Copies outside our control, such as PDFs you downloaded or sent, copies held by recipients, and external caches, are not affected by our deletion.

You can delete supported content, such as Projects and reports, in your Workspace, according to your role. You can ask us to delete your own account, and a Workspace Owner can ask us to delete a Workspace they own, by making a request as described in section 9. Deleting a Workspace doesn’t delete its members’ personal accounts, and a Workspace Owner can’t delete another member’s account.

9.1 Rights that may apply to you

Depending on where you live, and subject to the exceptions the law allows, you may have the right to:

Access

Confirm whether we process your personal information and receive a copy of it.

Correction

Have inaccurate or incomplete information corrected.

Deletion

Have your personal information deleted.

Portability

Receive information you provided in a structured, commonly used format, or have it sent to another provider where technically feasible.

Restriction or objection

Ask us to limit how we use your information, or object to processing based on legitimate interests, including for direct marketing.

Withdrawal of consent

Withdraw consent you have given, such as for optional cookies and tracking.

Advertising opt-outs

Opt out of the “sale” or “sharing” of personal information, or of targeted advertising, where the law of your location defines our advertising activity that way (section 10).

Complaint

Complain to the data protection authority or other regulator responsible where you live or work. You don’t need to contact us first, but we would welcome the chance to address your concern.

Appeal

Appeal our decision where the law gives you that right. If we decline a request, our response will explain how.

We won’t treat you differently for exercising your rights.

9.2 How to make a request

Send your request through our Contact page with the Legal topic selected. You don’t need an account, or to sign in. Tell us what you are asking for and, if you have an account, the email address and Workspace it concerns. Please don’t include passwords, one-time codes, or other credentials.

9.3 Verification and authority

To protect your information, we verify your identity before acting on a request, in a way that is proportionate to what you ask. For example, we may ask you to confirm that you control your account’s email address. We use the information you give us for verification only for that purpose. If someone makes a request on your behalf, we may ask for proof of their authority.

If your information is part of content that one of our customers supplied, such as a report about their client, we may need to refer your request to that customer or act on its instructions.

9.4 Response times

We respond within the period that the law of your location sets for your request. Where the law allows us to extend that period, we will tell you why and by how long.

9.5 Withdrawing consent

Withdrawing consent does not affect processing that took place lawfully before you withdrew it. Declining optional tracking does not prevent you from using the website or your account, or from making a request.

We don’t sell your private audit inputs or reports, and our advertising technologies don’t receive them.

Separately, if you allow Advertising in your cookie choices, advertising providers such as Google, Meta, and LinkedIn may receive information about your visits to our website and how you respond to our ads, such as pages viewed and conversion events, for advertising attribution, conversion measurement, and remarketing. Some privacy laws, including certain US state laws, may treat this as a “sale” or “sharing” of personal information, or as “targeted advertising”, even when no money changes hands.

Advertising starts off. You can turn it on or off at any time with Cookie Settings or Your Privacy Choices, which are also in the footer of every page. If your browser sends a recognized opt-out preference signal, such as Global Privacy Control, we treat it as a request to opt out of advertising sale and sharing in that browser.

We don’t send email addresses, phone numbers, messages you write to us, report data, or confidential URL parameters to advertising providers, and we don’t upload customer lists to them.

We use administrative, technical, and organizational measures designed to protect personal information against loss, misuse, and unauthorized access, appropriate to the nature of the information. These include role-based Workspace permissions, restricted internal access, and monitoring for misuse.

No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security. You can help by keeping your sign-in methods secure and telling us promptly about any suspected unauthorized use of your account. If a security incident affects your personal information, we will notify you and the relevant authorities where the law requires.

Prooflin accounts are for people aged 18 or older, and the service is not directed to children. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact our Legal team and we will take appropriate steps to delete it.

We may update this policy to reflect changes to Prooflin, our service providers, or the law. The effective date at the top of this page shows when the current version took effect.

If we make a material change, we will ordinarily give at least 30 days’ notice before it takes effect, by email to account holders, in the service, or on our website. A change needed urgently for legal, fraud-prevention, or security reasons may take effect sooner, and we will tell you about it as soon as reasonably possible. Where the law requires your consent to a change, we will ask for it.