Privacy Policy

At Proofcan ("we", "the service") we value your privacy. This policy explains how your personal data is collected, used, stored and protected. It has been prepared in accordance with the EU General Data Protection Regulation (GDPR) and applicable legislation.

1. Data Controller

Galzura Software Company (legal entity: Volkan Çatak, sole proprietorship)
Bayraktar Mah. Koza 1 Cad. Sağıroğlu Apt. No: 138, İç Kapı No: 9, Çankaya / Ankara, Türkiye
Email: support@proofcan.com

2. What Data We Collect

a) Account data: your email address provided at registration; your password if you register with email/password (stored in irreversibly encrypted/hashed form — we cannot see your password); when you sign in with Google, the email address and name that Google provides to us.

b) Content data: the images you upload to use the service. These images are processed for the marking and verification operation; a marked output and a verification record are created.

c) Usage data: your number of operations and your quota (e.g. monthly usage), your subscription status, and the verification records created.

d) Payment data: your payment details (card, etc.) are not collected or stored by us. All payment processing is handled by Paddle.com Market Limited and is subject to Paddle's privacy policy.

e) Technical data: technical information that may be necessary for the security and operation of the service (e.g. session information).

3. Cookies

Our website uses only cookies that are technically necessary to provide the service. These are session cookies (to keep you logged in), cookies required for the sign-in with Google (OAuth) function, and security cookies. These cookies do not require consent under applicable law. We do NOT use any marketing, tracking or profiling cookies or similar technologies; therefore no cookie consent banner is displayed. You can block technically necessary cookies in your browser settings, but in that case some functions of the site may not work.

4. Purposes and Legal Bases for Processing

To create your account and provide the service (legal basis: performance of a contract); to mark, verify your images and produce compliance reports (performance of a contract); to manage your quota and subscription (performance of a contract); to ensure the security of the service and prevent abuse (legitimate interest); to comply with legal obligations (legal obligation).

5. Where Data Is Stored and International Transfers

All user data is stored and processed on servers located within the European Union: application servers and image processing in Germany (Frankfurt, EU); the database in Ireland (EU). Your data remains within the borders of the European Union both while being processed and while being stored.

However, the data controller is established in Türkiye and may access this data from Türkiye for administrative and technical purposes. Türkiye has not been recognised by the European Commission as providing an adequate level of data protection. Where such access constitutes a transfer requiring safeguards under the GDPR, appropriate safeguards (such as the European Commission's Standard Contractual Clauses) and appropriate technical and organisational measures are applied. You may request a copy of the Standard Contractual Clauses via support@proofcan.com.

6. Data Retention

Account and usage data is retained for as long as your account is active. When you delete your account, your relevant data (including uploaded/marked images and verification records) is deleted within a reasonable period. Statutory retention obligations (e.g. billing records) are reserved; such records are held by the payment provider, Paddle.

Due to the verification portal feature, a verification record you create may remain publicly verifiable until you delete it. When you delete a record, the associated verification link becomes invalid.

7. Data Sharing and Sub-processors

We do not sell your data to third parties. Data is shared only with the infrastructure providers necessary to deliver the service (acting as processors/sub-processors):

• Hosting and delivery infrastructure (application servers and delivery): within the EU
• Database provider: Ireland (EU)
• Image-processing server: Germany (EU)
• Google (only if you use the "Sign in with Google" option, for authentication)
• Paddle (Merchant of Record, for payment processing)

These providers process data only on our behalf and in accordance with this policy; a data processing agreement under Article 28 GDPR is in place with each of them. Data may also be shared with competent authorities where there is a legal obligation.

8. Your Rights (GDPR)

With respect to your personal data, you have the right to: request access to your data; request its rectification; request its erasure ("right to be forgotten"); restrict or object to its processing; request the portability of your data; withdraw consent you have given.

To exercise these rights, you may contact support@proofcan.com. You also have the right to lodge a complaint with a supervisory authority.

9. Data Security

Reasonable technical and organizational measures are applied to protect your data: irreversible hashing of passwords, hosting within the EU, and protection against unauthorized access. However, we remind you that no transmission or storage over the internet is 100% secure.

10. Children's Privacy

The service is not directed at persons under the age of 16. We do not knowingly collect data from persons under 16.

11. Changes

We may update this policy from time to time. We will inform users in a reasonable manner of significant changes. The current version is always available on this page.

12. Contact

For any questions or requests regarding privacy: support@proofcan.com