Privacy policy

Who is responsible

ProveFix (provefix.com) is the controller of the personal data described here. Our full company name and registered address will be published on this page before paid plans launch.

For anything about your data, use the contact page and choose the privacy topic. We reply within 30 days, and usually much sooner.

What we collect

Account data: your name, email address, a hashed password (we never store the password itself), your workspace name and your role. If you sign in with Google, we receive your name, email address and Google account ID.

Workspace data: the sites, clients, team members, settings and report addresses you add, and the results of the tools you run, such as audits, uptime checks, change history and fix tasks.

Billing data: your plan and payment status. Card details go straight to our payment provider, Stripe, and never reach our servers.

Contact form: your name, email address, topic, message, language and IP address.

Technical data: IP address, browser type, the pages you request, and error logs, needed to deliver the service and keep it secure.

Analytics, only if you choose "Accept all" on the public site: the pages you visit, how you arrived, your device and browser type and your approximate location, collected by Google Analytics with cookies.

Consent records: the choice you make in our notice, with a random ID, the time, a shortened IP address, a browser summary, the page and the language.

Data from the websites you check

The tools read public web pages and records at the addresses you enter, such as HTML, headers, DNS and certificates. They obey robots.txt and never sign in to a site.

Public pages can contain personal data, such as a name on an about page. We store it only as part of the result you asked for, and only for as long as that result is kept.

Why we use your data and our legal bases

To provide the service you signed up for, run your tools and send the alerts and reports you set up: performance of a contract (GDPR Article 6(1)(b)).

To keep the service secure, apply usage limits, prevent abuse and fix errors: our legitimate interests (Article 6(1)(f)).

To answer messages you send us: our legitimate interest in replying, or steps before a contract.

To keep billing and tax records: a legal obligation (Article 6(1)(c)).

We don't use your data for advertising, we don't sell it and we don't share it for others' marketing.

To measure how the public site is used with Google Analytics: your consent (Article 6(1)(a)). You can withdraw it at any time with Cookie settings at the bottom of each page.

To keep proof of the choices made in our notice: a legal obligation (Articles 6(1)(c) and 7(1)).

AI features

AI explanations and drafts run on servers we operate. Your data isn't sent to outside AI providers and isn't used to train AI models.

AI only receives the facts a tool measured, never your passwords or keys. AI text is labelled, and no AI output can change a site on its own.

Usage limits without an account

When someone uses a tool page without signing in, we apply daily limits using a hashed form of the IP address and a random visitor ID kept in a cookie. The hash can't be turned back into the IP address.

Who we share data with

We use a small number of service providers who process data for us under contract: our hosting provider, our email delivery provider, Stripe for payments, and Google if you choose to sign in with Google.

When you connect a service yourself, such as Google Search Console, Jira, GitHub, WordPress, Slack or Microsoft Teams, we send it only what that connection needs, at your request.

We may disclose data when the law requires it, or to protect the rights and safety of our users and the public.

Google, for Google Analytics, only if you accept analytics. In the European Economic Area this service is provided by Google Ireland Limited.

International transfers

Our providers may process data outside your country. Where data leaves the European Economic Area or the United Kingdom, we rely on an adequacy decision or on safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep data

Account and workspace data: while your account is open. When you delete your account, its data is removed within 30 days, apart from records we must keep by law.

Results of tool runs made without an account: a few hours, as set for each tool, then deleted automatically.

Uptime checks: individual checks for 30 days and daily summaries for about 13 months. In-app notifications: 90 days. Usage logs: 30 days.

Contact messages: as long as needed to deal with your request, and no longer than two years.

Billing records: as long as tax law requires, usually up to 10 years depending on the country.

Google Analytics data: up to 14 months, then deleted. Consent records: 3 years.

How we protect data

Connections use HTTPS. Passwords are hashed, and keys and passwords you give us for connections (SMTP, Search Console, Jira, GitHub, WordPress) are encrypted at rest.

Each workspace's data is kept separate, staff access is limited to what's needed, and the tools fetch pages through a safe fetch layer that refuses private network addresses.

If a breach puts your data at risk, we will tell you and the relevant authority as the law requires.

Your rights

Depending on where you live, you can ask to access your data, correct it, delete it, limit how we use it, receive it in a portable format, or object to processing based on our legitimate interests.

Where we rely on your consent, you can withdraw it at any time. You can delete your account yourself in the dashboard settings.

To use a right, write to us through the contact page. If you're in the EU or UK and unhappy with our answer, you can complain to your local data protection authority. In India, you also have rights under the Digital Personal Data Protection Act, 2023.

Residents of California and other US states with privacy laws have similar rights. We don't sell or share personal information for cross context advertising.

Children

ProveFix is a business tool and isn't meant for anyone under 16. We don't knowingly collect data from children. If you think a child has given us data, tell us and we will delete it.

Automated decisions

We don't make decisions about you that have legal or similarly significant effects based only on automated processing. Usage limits and spam checks are technical safeguards, and you can always contact us about them.

Changes to this policy

When we change this policy, we update the date at the top. If a change is significant, we tell signed in users by email or in the dashboard before it takes effect.