Privacy notice

Your email address and a hash of your password, held by the identity service, or, if you sign in with Google, the address and the profile details Google shares at sign-in, such as your name. The sessions of your sign-ins.

Its name, its members' addresses and roles, its projects and settings, and each invitation: the address invited and a digest of the invitation's token.

The files you upload, which hold personal data only if your documents do. They are deleted after the number of days your organization keeps them.

What a check found: the figures it read, its findings and their evidence excerpts, which are short passages of your files: the values, their locations and the text around them. Also the decisions your team records on findings.

Who did what, and when: decisions on findings, changes to settings and members, and deletions. It holds no text of a reason.

The services log request and check identifiers, routes, status codes, durations and counts, never a file's content. To enforce rate limits, the API counts a signed-in user's requests by user and by network address. The web app's host keeps request logs of the pages it serves.

Address confirmations, invitations and notices that a check has finished are sent to your address. Not yet in service: no email provider is chosen for a deployment.

The Help form sends nothing itself: it opens your own email app, or copies your message for you to send.

7 days after the check ends, unless an admin chooses from 1 to 30 days.

Deleted at the end of every attempt to run a check, whether it succeeded or failed.

Until someone deletes the check or its project. They are never deleted for their age.

The numerical forms of labels read from your files, used in matching, are deleted once unused for your organization's number of days.

Deleted once their minute or hour has ended.

Kept as long as the organization and the account are.

Not yet in service: how long logs are kept is not set yet.

An analyst deletes their own finished checks, and a reviewer or an admin any finished check, with its results, its evidence and any file still stored.

An admin deletes a project and every check in it.

An admin chooses how many days files are kept, and whether the organization's checks may use external AI once it is added.

Not yet in service: deleting an account or an organization, and exporting your data, are not offered on a screen yet. Ask at [the address for privacy requests].

[the rights the governing law gives, and the regulator to complain to].

Cookies whose names begin with this hold your session once you sign in, in numbered parts when it is long, and, while a sign-in is in progress, the value that ties it to this browser. No script can read them, they are sent only over HTTPS to TieProof's own pages, they last 7 days after their last use, and logging out removes them.

Kept in this browser's storage, not a cookie: the token of an invitation you opened, so that it survives a sign-in. It is sent once, when you accept, and then forgotten.

Kept in this browser's storage, not a cookie, only if you turn on the notice that a check has finished: that you chose it in this browser. It is never sent to TieProof, and turning the notice off removes it.