Privacy Policy

Proof AI, Inc. ("Proof AI," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access our website at proofco.ai, our SaaS platform at proofco.io, our mobile applications, and any related services (collectively, the "Services"). By using the Services, you agree to the practices described herein.

1. Information We Collect

1.1 Information You Provide Directly

• Account Registration: Name, email address, phone number, company name, billing address, and role/title when you create an account or are provisioned by a tenant administrator.
• Payment Information: Credit card numbers, bank account details, and billing information processed through Stripe. Proof AI does not store complete payment card numbers on its servers — all payment data is handled by Stripe in compliance with PCI-DSS Level 1.
• Communications: Content of emails, support requests, chat messages, and any feedback or surveys you submit.
• User Content: Job data, photos, documents, estimates, invoices, customer records, employee records, and any other data you input through the platform (collectively, "Tenant Data").

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent, click patterns, and navigation paths within the Services.
• Device Information: Browser type, operating system, device identifiers, screen resolution, and IP address.
• Location Data: Approximate location derived from IP address. Precise GPS location only when you explicitly enable location services for dispatch or field operations features.
• Cookies and Tracking: We use essential cookies for authentication and session management. We use Plausible Analytics (a privacy-focused, cookie-free analytics service) for aggregate website analytics. We do not use Google Analytics or sell tracking data to third parties.

1.3 Information from Third Parties

• Stripe: Payment confirmation, subscription status, and billing events via webhooks.
• Twilio: Call recordings, transcripts, and SMS delivery reports when voice/messaging features are enabled.
• Supabase: Authentication tokens and session data.
• Mapbox: Geocoding results for dispatch and scheduling features.

2. How We Use Your Information

• Service Delivery: Operating, maintaining, and improving the Services, including AI-powered features such as Vision analysis, AI Dispatch, and intelligent job management.
• Billing: Processing payments, managing subscriptions, issuing invoices, and enforcing billing policies including trial period management.
• Communication: Sending transactional emails (onboarding, password resets, billing alerts), service announcements, and optional marketing communications (with your consent).
• Security: Detecting and preventing fraud, unauthorized access, and other security threats through rate limiting, audit logging, and anomaly detection.
• Legal Compliance: Meeting legal obligations, responding to lawful requests, and enforcing our Terms of Service.
• Product Improvement: Analyzing aggregate usage patterns to improve features, performance, and user experience. We do not use your Tenant Data to train general-purpose AI models.

3. AI and Data Processing

Proof AI's platform includes artificial intelligence features including computer vision analysis, natural language processing, and predictive analytics. When you use these features:

• Your data (photos, documents, job details) is processed by our AI engines and may be sent to third-party AI providers (OpenAI) for analysis.
• We do not use your Tenant Data to train AI models. Data sent to AI providers is processed under their data processing agreements which prohibit training on customer data.
• AI-generated analysis results, estimates, and recommendations are stored within your tenant's data scope, protected by the same multi-tenant isolation and encryption as all other Tenant Data.
• You may opt out of AI features at any time through tenant settings without affecting core platform functionality.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We share data only in these circumstances:

• Service Providers: We share data with trusted third-party service providers that perform services on our behalf (Stripe for payments, Twilio for communications, Supabase for database hosting, Vercel for hosting, Resend for email delivery, OpenAI for AI processing). These providers are bound by data processing agreements and may only use your data as directed by us.
• Within Your Tenant: Data you create within a tenant organization is accessible to other authorized users within that same tenant, subject to role-based access controls.
• Stripe Connect: If you use our subcontractor payout or Connect features, payment information necessary for transfers is shared with Stripe's Connect platform in accordance with Stripe's privacy policy.
• Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Proof AI, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, bankruptcy, or sale of all or a portion of our assets, user information may be transferred as part of the transaction.

5. Data Security

We implement industry-standard security measures including:

• Encryption: TLS 1.3 for data in transit. AES-256 encryption for data at rest via Supabase (built on PostgreSQL with full disk encryption).
• Multi-Tenant Isolation: Row-Level Security (RLS) policies enforced at the database level ensure complete data isolation between tenants. Every query is scoped to the authenticated tenant's data.
• Access Controls: Role-based access control (RBAC) with distinct permission levels (owner, admin, general_manager, sales, crew, subcontractor, homeowner).
• Audit Logging: All data access, modifications, and administrative actions are logged in immutable audit trails.
• Webhook Verification: All inbound webhooks (Stripe, Twilio, Resend) are verified via cryptographic signatures before processing.
• Rate Limiting: API rate limiting via Arcjet to prevent abuse and brute-force attacks.

6. Data Retention

• Active Accounts: We retain your data for as long as your account is active and as needed to provide the Services.
• Cancelled Accounts: Upon account cancellation, we retain data for 90 days to allow for account reactivation, after which Tenant Data is permanently deleted. Billing records and audit logs may be retained for up to 7 years for legal and compliance purposes.
• Call Recordings: Twilio call recordings are retained for 30 days by default, unless a longer retention period is configured by the tenant administrator.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request a machine-readable copy of your data.
• Opt-Out: Unsubscribe from marketing communications at any time via email links or account settings.
• Restrict Processing: Request that we limit the processing of your personal data in certain circumstances.

To exercise these rights, contact us at privacy@proofco.ai.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know what personal information is collected, used, shared, or sold.
• Right to delete personal information held by us and by extension, our service providers.
• Right to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising.
• Right to non-discrimination for exercising your CCPA rights.
• Right to correct inaccurate personal information.
• Right to limit the use of sensitive personal information.

9. International Data Transfers (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your personal data may be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the legal basis for such transfers. Our sub-processors (Stripe, Supabase, Vercel, OpenAI) maintain their own GDPR compliance programs and data processing agreements.

10. Children's Privacy

The Services are not directed to children under 16. We do not knowingly collect personal information from children. If we learn we have collected personal data from a child under 16, we will promptly delete it. If you believe a child has provided us with personal information, contact us at privacy@proofco.ai.

11. Cookie Policy

We use the following types of cookies and similar technologies:

• Strictly Necessary: Authentication session cookies (proof_session) required for platform functionality. These cannot be disabled.
• Analytics: We use Plausible Analytics, a privacy-focused, cookie-free analytics service that does not use cookies or track individual users. No cookie consent banner is required for Plausible.

We do not use advertising cookies, social media tracking pixels, or fingerprinting technologies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on our website at least 30 days before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.

13. Contact Us