Privacy policy

1. Who processes the data

The controller for accounts and the operation of the ProofSeal app is [Ragione sociale], [indirizzo], P.IVA [00000000000]. Contact: [privacy@getproofseal.com].

For end-client data that a business enters in its inspections (names, signatures, photos of goods), the controller is that business; ProofSeal acts as its processor (Art. 28 GDPR).

2. What we process

• Account data: email, name, business name, settings.
• Inspection content: photos taken with the in-app camera, close-ups, damage marks, notes, condition, readings (odometer, fuel, meters), signer names and signatures.
• Evidence metadata: server and device time, SHA-256 fingerprint of each photo and signature, check-in and check-out master hashes.
• Location: GPS coordinates and accuracy when the photo is taken, only if the user grants the device permission. Without it the photo is recorded as “GPS unavailable”.
• Technical data: access logs, IP address, device model, date and time public report links are opened.

3. Why and on what basis

• Providing the service and keeping the photo evidence (contract, Art. 6(1)(b) GDPR).
• Integrity, security and abuse prevention (legitimate interest, Art. 6(1)(f)).
• Legal obligations, e.g. tax (Art. 6(1)(c)).

We do not sell data or use it for targeted advertising.

4. Public report link

Every sealed report has a secret link (and a QR code in the PDF). Anyone with the link can view the report and verify its integrity without an account. The link is not indexed by search engines. Share it only with the people involved.

When the link is opened we record the date and time, so the business can see that the client viewed the report.

5. Where data is stored and who receives it

We use providers acting as sub-processors:

• Supabase — database and authentication ([region to be confirmed]).
• Cloudflare R2 — photo storage ([region to be confirmed]).
• Vercel — hosting of this site ([region to be confirmed]).

Any transfer outside the European Economic Area relies on the European Commission's standard contractual clauses or other adequate safeguards.

6. How long

• Account: while it is active.
• Sealed inspections: cannot be edited, to preserve their evidential value. They remain available for [period to be defined, e.g. 5 years] or until the account is deleted.
• Unsealed drafts: can be deleted from the app at any time.
• Technical logs: [30] days. Backups: [30] days after deletion.

7. Deletion and your rights

You can request access, rectification, erasure, restriction, portability or object to processing by writing to [privacy@getproofseal.com]. Deleting the account removes inspections, photos and signatures within [30] days, unless the law requires otherwise.

If you are the end client of a business using ProofSeal, contact that business first: it decides on the data in its inspections. We will still help forward your request.

You may lodge a complaint with your data protection authority (in Italy: Garante per la protezione dei dati personali).

8. Security

Photos travel encrypted (TLS), are stored in private storage and are reachable only through short-lived links. Every photo is protected by a SHA-256 fingerprint checked by the server; sealed reports cannot be edited.

9. Changes

Changes to this policy will be published on this page with the update date.