Privacy Policy
1. The short version
- We collect the minimum needed to run the service: your email, your files, and billing status.
- Your files are private. They are stored in a private bucket and served only through short-lived links generated for you.
- We keep your files exactly as you sent them, including metadata such as capture dates, camera model, and location. That preservation is the product.
- We never display or share the location data in your files with anyone, and it never appears in an Originality Packet.
- We do not sell your data, and we do not use your content to train AI models.
- You can delete your data and your account at any time.
2. Who is responsible
Berrada Ventures LLC, a single-member LLC organised in New York, is the controller of personal information processed through Provenance.
- Contact: Support@useprovenanceapp.com
- Notice address: 1548 Waterford Rd., Walworth, NY 14568
3. What we collect
3.1 You give us
- Account details: email address and password. Passwords are stored only as salted hashes; we never see them.
- Your files and anything you type about them — descriptions, categories, product names.
- Your state of residence, if you provide it, so we can determine whether we are able to sell you a subscription.
3.2 Created automatically when you use the service
- The time we receive each file, and its SHA-256 hash.
- File name, size, and type.
- Standard server and security logs, including IP address, browser type, and timestamps.
3.3 Metadata inside your files — read this section
Your photos and videos frequently contain metadata written by the device that made them. This can include the date and time of capture, the camera or phone model, lens and exposure settings, and the GPS coordinates of where the file was created — which, for someone working from home, is their home address.
We keep all of it, unaltered. We store your file byte-for-byte as you sent it. We do not strip, rewrite, or re-encode it. That is deliberate and it is the point of the product: that metadata is often the only thing showing when your work was actually made, and it cannot be recovered once removed.
How we handle the location data specifically:
- It is never displayed in the application.
- It is never included in an Originality Packet.
- It is never shared with any marketplace, third party, or other user.
- It remains inside your own file, which only you can access, and is only ever revealed if you choose to share that file with someone.
If you would rather we did not hold it, remove the location data from your files before uploading — most phones and photo tools can do this — or delete the file from Provenance. Be aware that removing it also removes evidentiary value.
3.4 What we do not collect
We do not use advertising trackers, we do not build advertising profiles, and we do not buy personal data about you from anyone.
4. Why we process it
| Purpose | What it covers |
|---|---|
| Providing the service | Storing files, hashing, generating packets, authentication |
| Billing | Managing subscriptions and payments through Stripe |
| Support | Responding when you contact us |
| Security | Detecting abuse, preventing fraud, protecting accounts |
| Legal | Meeting tax, accounting, and other legal obligations |
Where a lawful basis is required, we rely on performance of our contract with you, our legitimate interests in operating and securing the service, and compliance with legal obligations.
We do not use your content to train machine learning models. We do not sell personal information. We do not share it for cross-context behavioural advertising.
5. Who processes data on our behalf
We use a small number of service providers. They act on our instructions and may not use your data for their own purposes.
| Provider | What they handle | Where |
|---|---|---|
| Supabase | Database, authentication, and file storage | United States (AWS, Ohio — us-east-2) |
| Netlify | Website and application hosting | United States |
| Stripe | Payment processing and subscription billing | United States |
| Resend | Transactional email such as password notifications | United States |
Stripe handles your card details directly under its own privacy policy. We never receive your full card number.
If we add or change a provider handling your files, we will update this page.
6. How your files are protected
- Stored in a private bucket. There are no public URLs to your files.
- Access is enforced per account at the database level, so one account cannot reach another's files.
- Files are served through short-lived signed links, generated on request and valid for a few minutes.
- Encrypted in transit (HTTPS) and at rest by our storage provider.
No system is perfectly secure. We do not promise your data can never be accessed unlawfully, and you should keep your own copies of anything you cannot afford to lose.
7. How long we keep things
| Data | Retention |
|---|---|
| Your files, while your account is active | Until you delete them |
| Your files, after a Pro subscription lapses | Read-only for 180 days, then may be permanently deleted. See the Terms |
| Your files, after you delete them | Removed from active storage promptly |
| Record that a deleted file existed — its name, SHA-256 hash, size, and the times it was received and deleted | Kept as part of that product's history, so an evidence log cannot be rewritten without trace. Nothing else about the file is kept — no description, no evidence category, no capture date or other metadata read from inside it. Deleted when you delete the product or your account. The filename can be removed on request |
| Backups | Deleted data may persist in routine backups for up to 7 days |
| Account details | Until you delete your account |
| Billing and tax records | As long as tax and accounting law requires, typically 7 years |
| Server and security logs | Typically 90 days |
8. Your rights
You can, at any time:
- Access your data — everything you have uploaded is visible in your account.
- Export it — download your files and generate Originality Packets.
- Correct your account details.
- Delete individual files, products, or your entire account.
- Object or restrict — tell us to stop certain processing.
- Complain to a data protection authority if you are in a region with one.
Email Support@useprovenanceapp.com and we will respond within 30 days. We will not charge you or treat you differently for exercising these rights.
Note on deletion and Free-plan allowances: deleting data does not restore your Free plan's lifetime product or file allowance. That is a billing limit, not a data-retention practice, and it is explained in the Terms. Your right to have the data itself deleted is unaffected.
Note on removal records. When you delete a file we keep a short record that it existed — see section 7. We keep it because an evidence log you can silently rewrite is worthless as evidence, which is the thing you are paying us for. If the filename itself is the sensitive part, email us and we will remove the name while leaving the hash and dates in place. Deleting the product, or your account, removes the record entirely.
If you are in California, you have the rights described above under the CCPA/CPRA, including the right to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of.
If you are in the EEA or UK, our lawful bases are set out in section 4, and you have the rights described above under the GDPR. Data is processed in the United States; where required we rely on Standard Contractual Clauses through our providers.
9. Children
Provenance is not for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, email us and we will delete it.
10. If something goes wrong
If a breach affects your personal information, we will notify affected users and any required authority without undue delay, and tell you plainly what happened, what was affected, and what we are doing about it.
11. Changes to this policy
We may update this page. Material changes will be notified by email or in-product at least 30 days before taking effect. The "Last updated" date always reflects the current version.
12. Contact
Support@useprovenanceapp.com Berrada Ventures LLC, New York