Privacy Notice

1. What we collect

Account data: your name (if provided), email address and sign-in credentials when you create an account or sign in with Google.

Assessment data: the photographs of your item that you upload and the answers you give during the guided scan, plus the resulting reports and certificates.

Usage and device data: basic technical information such as IP address, browser and device type, and how you use the site, used for security and to improve the service.

Support data: any messages you send us. Payment card details are collected and processed by Paddle, our Merchant of Record — we never see or store your full card number.

2. Why we use it and our legal basis

To provide the service — generating your assessment, issuing certificates, saving reports to your account — on the basis of performing our contract with you.

For security, fraud prevention and to enforce our terms, on the basis of our legitimate interests.

To improve the product and respond to support requests, on the basis of our legitimate interests.

Where the law requires it, to meet legal and tax obligations. Where we rely on consent (for example optional analytics or marketing), you can withdraw that consent at any time.

3. Who we share it with

Service providers who help us run PurseProof: hosting and database infrastructure, AI processing (your photographs and answers are processed by AI models solely to produce your assessment), and support tooling.

Paddle (paddle.com), our Merchant of Record, for the sale of the product, subscription management, payments, tax compliance and invoicing. Paddle processes payment-related data under its own privacy terms.

Professional advisers (legal, accounting) where needed, and authorities where required by law. We do not sell your personal data.

4. How long we keep it

We keep account and report data while your account is active so you can re-download your certificates. Photographs submitted for an assessment are kept only as long as needed to provide the service and maintain the integrity of issued certificates.

When data is no longer needed — for example after an account is closed and any legal retention periods have passed — it is deleted or anonymised.

5. Security

We apply appropriate technical and organisational measures, including encryption in transit, access controls and row-level isolation of account data, to protect your personal data.

6. Your rights

Depending on where you live, you may have the right to access your data, correct it, have it erased, restrict or object to its processing, receive a portable copy, and withdraw consent where processing is based on consent. We respond to verified requests within one month.

If you are in the UK or EEA, your data may be processed in other countries; where it is, we use appropriate safeguards such as standard contractual clauses or adequacy decisions. You also have the right to complain to your local data protection supervisory authority.

To exercise any right, contact us through the support route shown on the site and we will help.

7. Cookies

We use essential cookies and similar storage to keep you signed in and to remember your progress through a scan. Where analytics or marketing cookies are used, you can manage your preferences through your browser settings. Blocking essential cookies may prevent sign-in and checkout from working.

8. Changes

We may update this notice from time to time; the version on this page applies from its “last updated” date. Material changes will be flagged on the site.