Privacy Policy

At Proofcan ("we", "the service") we value your privacy. This policy explains how your personal data is collected, used, stored and protected. It has been prepared in accordance with the EU General Data Protection Regulation (GDPR) and applicable legislation.

1. Data Controller

Galzura Software Company (legal entity: Volkan Çatak, sole proprietorship)
Bayraktar Mah. Koza 1 Cad. Sağıroğlu Apt. No: 138, İç Kapı No: 9, Çankaya / Ankara, Türkiye
Email: support@proofcan.com

2. What Data We Collect

a) Account data: your email address provided at registration; your password if you register with email/password (stored in irreversibly encrypted/hashed form — we cannot see your password); when you sign in with Google, the email address and name that Google provides to us.

b) Content data: the images, video and audio files you upload to use the service. Video and audio files can contain people's faces and voices. These files are processed for the marking and verification operation; a marked output and a verification record are created.

c) Usage data: your number of operations and your quota (e.g. monthly usage), your subscription status, and the verification records created.

d) Payment data: your payment details (card, etc.) are not collected or stored by us. All payment processing is handled by Paddle.com Market Limited and is subject to Paddle's privacy policy.

e) Technical data: technical information that may be necessary for the security and operation of the service (e.g. session information).

f) Badge image requests: if you or someone else embeds the Proofcan badge on a web page, each visitor's browser requests that badge image from proofcan.com. The image is a static file served by our hosting and delivery infrastructure, which necessarily receives the visitor's IP address and standard request headers (such as the referring page). Proofcan's own application code does not run for these requests: it does not log them, set cookies or run analytics on them.

g) Purchase, withdrawal and cancellation records: when you buy a paid plan, whether you buy as a business or as a consumer, the plan, the version of the statement you confirmed and the time (no IP address); when you send a withdrawal or cancellation statement, its content (name, email addresses, contract, and for a cancellation its type, reason and requested end) and the time it was received.

h) Daily check limit: to apply the daily limit on free file checks on the website (3 images, 1 video and 1 audio file a day), our signing engine keeps a one-way digest of your IP address and a count, in memory only. The digest is made with a secret that changes every day, so the IP address cannot be read back from it; the IP address itself is not stored. If you are signed in, your account is counted the same way.

i) Video and audio jobs: for a video or audio file you mark on the website, its job record (status, file type, length, marks used and the file's name) and, when it is done, an email to your account's email address saying that the marked file is ready or could not be marked.

3. Cookies

Our website uses only cookies that are technically necessary to provide the service. These are session cookies (to keep you logged in), cookies required for the sign-in with Google (OAuth) function, and security cookies. These cookies do not require consent under applicable law. We do NOT use any marketing, tracking or profiling cookies or similar technologies; therefore no cookie consent banner is displayed. You can block technically necessary cookies in your browser settings, but in that case some functions of the site may not work.

4. Purposes and Legal Bases for Processing

To create your account and provide the service (legal basis: performance of a contract); to mark and verify your images, video and audio files and produce compliance reports (performance of a contract); to email you when a video or audio file you marked on the website is ready or could not be marked (performance of a contract); to apply the daily limit on free file checks with a one-way digest of your IP address (legitimate interest, Art. 6(1)(f) GDPR: keeping free checks available to everyone and protecting the service from overload); to manage your quota and subscription (performance of a contract); to ensure the security of the service and prevent abuse (legitimate interest); to comply with legal obligations (legal obligation); to record purchase statements and to receive, confirm and carry out withdrawals and cancellations, and to be able to prove them (performance of a contract and legal obligation).

5. Where Data Is Stored and International Transfers

Our main systems are located in the European Union: the website's server functions in Frankfurt, Germany (Vercel, region fra1); the signing engine, which marks and verifies your files, in Nuremberg, Germany (Hetzner); the database in Ireland (Turso, AWS region eu-west-1).

Some data is also processed outside the European Union:

• Cloudflare: requests to our signing engine (engine.proofcan.com), DNS lookups for proofcan.com and email sent to support@proofcan.com pass through Cloudflare's global network, which can process them in data centres outside the EU.
• Vercel, Turso and Resend are companies based in the United States. Vercel's data processing addendum states that its primary processing facilities are in the United States. Resend sends our emails from Ireland (eu-west-1) but stores the account data, including email metadata and logs, in the United States.
• Paddle (United Kingdom) receives your billing and payment details when you buy a plan, as the seller of the subscription and under its own privacy policy.
• Google, if you sign in with Google: Google Ireland Limited is responsible for users in the EEA and Switzerland, and Google may process data on its servers around the world.

Where personal data is transferred to a country without an adequacy decision of the European Commission, the transfer relies on the safeguards in the provider's data processing terms, such as the European Commission's Standard Contractual Clauses.

However, the data controller is established in Türkiye and may access this data from Türkiye for administrative and technical purposes. Türkiye has not been recognised by the European Commission as providing an adequate level of data protection. Where such access constitutes a transfer requiring safeguards under the GDPR, appropriate safeguards (such as the European Commission's Standard Contractual Clauses) and appropriate technical and organisational measures are applied. You may request a copy of the Standard Contractual Clauses via support@proofcan.com.

6. Data Retention

Marked image files are stored for 24 hours. After you mark an image, the signed file is kept on our servers for 24 hours so that you can download it, and is then deleted automatically. The original file you upload is never stored: it is held only in temporary storage for the duration of processing and discarded immediately afterwards.

Video and audio files. A video or audio file you upload for marking is kept only until its job ends (waiting in line and marking) and is then deleted; a file uploaded to be checked is deleted when the check ends. The marked file is stored for 24 hours so that you can download it, and is then deleted automatically. The job record (status, file type, length and the file's name) is deleted 30 days after the job ends; the file name is kept only in this job record. Your account's list of video and audio jobs (type, length, marks used, status and record number, without the file name) is kept as long as your account is active.

The one-way IP digests and counts of the daily check limit (section 2 h) are deleted at the end of each day (00:00 UTC).

The marking record itself (lookup ID, integrity hash, timestamp and file name; for a video or audio file the media type and length instead of the file name) is retained so that verification keeps working. A file you have downloaded carries its own signed credential and watermark, so it stays verifiable against the registry after our copy has been deleted.

Account and usage data is retained for as long as your account is active. When you delete your account, your relevant data (including marking and verification records) is deleted within a reasonable period. Statutory retention obligations (e.g. billing records) are reserved; such records are held by the payment provider, Paddle.

Purchase, withdrawal and cancellation records (section 2 g) are kept for as long as claims arising from the contract can be raised under the applicable limitation periods, and are then deleted.

Due to the verification portal feature, a verification record you create may remain publicly verifiable until you delete it. When you delete a record, the associated verification link becomes invalid.

7. Data Sharing and Sub-processors

We do not sell your data to third parties. These providers process personal data on our behalf, as processors under Article 28 GDPR, and only to deliver the service:

• Vercel Inc. — Hosts the website and its server functions: sign-in, dashboard, quota and API key checks. Where: Server functions in Frankfurt, Germany (fra1). Vercel's Data Processing Addendum (vercel.com/legal/dpa, last updated 17 March 2026) applies to customers on its Pro and Enterprise plans; it states that Vercel's primary processing facilities are in the United States.
• Turso, Inc — The website's database. Where: Ireland (AWS eu-west-1).
• Hetzner Online GmbH — Runs the marking engine: watermark, C2PA signature and registry. Where: Nuremberg, Germany. Hetzner's data processing agreement is concluded in the Hetzner customer account; its model text is published at hetzner.com/AV/DPA_en.pdf.
• Cloudflare, Inc. — DNS for proofcan.com, the TLS endpoint and tunnel for engine.proofcan.com, and email routing for support@proofcan.com. Where: Cloudflare's global network. Cloudflare's Customer Data Processing Addendum (cloudflare.com/cloudflare-customer-dpa) forms part of Cloudflare's self-serve subscription agreement.
• Plus Five Five, Inc. (Resend) — Sends the receipts for withdrawal and cancellation statements and the notices of them to support@proofcan.com, and the email that a video or audio file marked on the website is ready or could not be marked. Where: Emails are sent from Ireland (eu-west-1); Resend stores the account data, including email metadata and logs, in the United States. Resend's Data Processing Addendum (resend.com/legal/dpa, last updated 31 December 2025) forms part of Resend's Terms of Service; it states that Resend's primary processing operations take place in the United States and that transfers out of the EEA are made under the European Commission's Standard Contractual Clauses (Decision 2021/914). Resend also states that it complies with the EU-U.S. Data Privacy Framework.

These companies are not our processors; they decide themselves how they use the data they receive and are separate controllers under their own privacy policies:

• Paddle.com Market Limited — Merchant of Record: the seller of your subscription and the payment intermediary. Paddle handles checkout, invoices and VAT under its own privacy policy. Where: United Kingdom.
• Google Ireland Limited — Sign in with Google, only if you choose it: Google confirms who you are and passes your email address and name to Proofcan. Where: Ireland, for users in the EEA and Switzerland. Google may process data on its servers around the world.

Data may also be shared with competent authorities where there is a legal obligation.

8. Your Rights (GDPR)

With respect to your personal data, you have the right to: request access to your data; request its rectification; request its erasure ("right to be forgotten"); restrict or object to its processing; request the portability of your data; withdraw consent you have given.

To exercise these rights, you may contact support@proofcan.com. You also have the right to lodge a complaint with a supervisory authority.

9. Data Security

Reasonable technical and organizational measures are applied to protect your data: irreversible hashing of passwords, hosting within the EU, and protection against unauthorized access. However, we remind you that no transmission or storage over the internet is 100% secure.

10. Children's Privacy

The service is not directed at persons under the age of 16. We do not knowingly collect data from persons under 16.

11. Changes

We may update this policy from time to time. We will inform users in a reasonable manner of significant changes. The current version is always available on this page.

12. Contact

For any questions or requests regarding privacy: support@proofcan.com