# Privacy policy

> What personal data Provely collects, why it collects it, how long it keeps it, who it shares it with, and how to exercise your rights.

Canonical: https://provely.sh/privacy  
Last reviewed: 2026-09-05  

**Macleod Labs is the controller of the personal data described here. This policy takes effect on 2026-09-06. Write to [macleod@macleodlabs.ai](mailto:macleod@macleodlabs.ai) to exercise any right in this policy.**

## What data do we collect?

*Each row states one purpose and one retention period.*

| Data | Why we hold it | How long we keep it |
| --- | --- | --- |
| Your name, email address, and the identity provider you signed in with | To create your account and to contact you | While the account is open, then 30 days |
| Your organisation name and billing details | To bill you and to meet tax law | Seven years, because tax law requires it |
| API keys, stored as a hash | To authenticate your calls | Until you rotate or delete the key |
| Provider credentials that you connect, stored encrypted | To read the evidence that your contracts name | Until you remove the connection |
| Operations, contracts, verdicts, and receipts | To verify your workflows and to show you the result | While the account is open, then 30 days |
| Raw provider responses | To explain a verdict while you investigate it | A short time to live, off by default |
| Request logs and error traces, with secrets redacted | To run the service and to find defects | 30 days |
| Website analytics without a cookie | To count page views and to compare page designs | 12 months, in aggregate |

## What do we not do?

- We do not sell personal data.
- We do not use your data to train a model.
- We do not give evidence to a language model. The runtime evaluates evidence with operators.
- We do not write secrets to logs or to telemetry.
- We do not set an advertising cookie.

## Why are we allowed to hold it?

- Contract: we need the data to give you the service that you asked for.
- Legal duty: tax law requires us to keep billing records.
- Legitimate interest: we keep short logs to run the service and to keep it secure.

## Who else sees the data?

We use a small number of processors. Each one holds a contract that limits it to our instructions.

| Processor | Purpose | Location |
| --- | --- | --- |
| Amazon Web Services | Hosting, storage, and backups | Ireland (eu-west-1) |
| Stripe | Payment and billing | United States, with standard clauses |
| Google and GitHub | Sign-in, when you choose that provider | United States, with standard clauses |
| Resend | Service email | United States, with standard clauses |

We give data to a public authority only when the law compels it, and we tell you unless the law forbids it.

## What are your rights?

- Ask for a copy of your personal data.
- Ask us to correct data that is wrong.
- Ask us to delete your data.
- Ask us to limit how we use it.
- Ask for your data in a portable format.
- Object to a use that rests on a legitimate interest.
- Complain to your data protection authority. In the United Kingdom that is the Information Commissioner’s Office.

Write to [macleod@macleodlabs.ai](mailto:macleod@macleodlabs.ai). We answer within 30 days.

## Cookies

The public website sets no cookie for advertising and no cookie for cross-site tracking. The application sets one session cookie after you sign in. That cookie is necessary, so no consent banner appears.

> The home page shows one of several designs, chosen at random. The choice is not stored in a cookie, and it identifies nobody.

## Security

- We encrypt data in transit and at rest.
- We store API keys as a hash with a pepper, never in plain text.
- Verifier credentials are read only wherever the provider permits it.
- We redact provider responses before telemetry.
- We sign every receipt with Ed25519, so you can check it without trusting us.

Report a security problem to [macleod@macleodlabs.ai](mailto:macleod@macleodlabs.ai). Describe the class of the problem. Do not send a working exploit.

## Changes to this policy

We publish a new version on this page. We tell you by email before a material change takes effect.

## Read next

- [Terms of service](https://provely.sh/terms)
- [About Macleod Labs](https://provely.sh/about)
- [What a receipt proves](https://provely.sh/receipts)