Privacy policy.
What personal data ProofMart processes, why it processes it, how long anything is kept, and how you can ask for it to be deleted. The facts here match the security page exactly; that page describes the systems this policy rests on.
Draft. This policy is pending legal review. Business details are placeholders until [BUSINESS NAME] confirms them.
01Who we are
This service is operated by [BUSINESS NAME], [REGISTERED ADDRESS]. For anything about your personal data, write to [CONTACT EMAIL].
02What personal data we process
The site processes bank statements, which are financial personal data under India’s Digital Personal Data Protection Act 2023.
- Account data: your email address and sign-in credentials. Passwords are handled by Supabase Auth; ProofMart never stores a password itself.
- Documents you upload: the PDF files you submit for verification and the results derived from them (extracted facts, findings, verdicts).
- API keys: only a SHA-256 hash and a display prefix are stored, never the raw key.
- Webhook endpoints you register, and the signed delivery log for each one (which carries the verification result).
- Operational records: API usage events (which key, which event type), audit events (sign-ins, uploads, key and webhook changes), and rate-limit counters.
- Billing records: your plan and its status, and the Razorpay order ID for any upgrade. ProofMart never sees or stores card, UPI or bank details.
03Why we process it
- To run the verification pipeline you asked for: parse the PDF, extract its content, and check it against the fixed marker rules.
- To operate your account: sign-in, saved documents, API keys, webhooks, billing quota.
- To keep the service working and safe: audit events, rate limits, retrying failed webhook deliveries.
Processing happens server-side inside ProofMart’s own runtime. No document content is sent to a third-party AI or OCR API.
04How long we keep it
| Data | Kept for | Removed by |
|---|---|---|
| File uploaded while signed out | Not kept | Deleted as soon as the scan finishes |
| File sent to the API | Not stored | Processed in memory; only the response leaves |
| Saved document: original file and result | Until you delete it | You, from My documents; record and file go together |
| Webhook delivery log, including the result payload | 90 days | Pruned automatically, daily |
| Audit events | 180 days | Pruned automatically, daily |
| Rate-limit counters | 1 day | Pruned automatically, daily |
| API keys (stored as a SHA-256 hash) | Until revoked | You; revoking takes effect immediately |
05Who else sees your data
Two infrastructure providers handle data, and a payment processor handles Pro checkout. No other third party receives document content.
| Provider | Used for | Holds |
|---|---|---|
| Vercel | Hosting, serverless compute, private Blob storage | Uploaded files, while they are kept |
| Supabase | Postgres database, authentication | Account data and saved scan results |
| Razorpay | Payments for the Pro plan, once billing is enabled | Your email, user ID and the order; card, UPI or bank details you enter at checkout stay with Razorpay |
06Deletion and your rights
- Saved documents: deleting one from My documents removes its database record and its stored file together, never one without the other.
- Your account: write to [CONTACT EMAIL] to ask for your account and its data to be deleted, or to correct it.
- API keys: revoking a key takes effect immediately; the stored hash can no longer authenticate a request.
We will confirm a deletion request once it is done, and tell you plainly if some record has to be kept (for example, a payment record the law requires).
08Changes to this policy
If this policy changes in a way that matters, the change will be noted here with the date. Continued use of the service after a change means you accept the updated policy.
Last reviewed: not yet — draft.