1. Overview

Proofloft is operated by Media Yard LLC, PO Box 73, Pennsauken, NJ 08110, USA. We built Proofloft to be minimal by design: we collect what the product needs to work and nothing else. We do not sell personal data, we do not run advertising trackers or third-party analytics, and we do not use your data to train AI models.

Who is responsible for what. For your Proofloft account, billing, and emails you send us, Media Yard LLC is the controller. For testimonials collected through your forms, the business that owns the form is the controller and we process that data on its behalf under our Data Processing Agreement (see section 4). We have not appointed a data protection officer or an EU or UK representative. Privacy contact: legal@proofloft.com.

2. Data we collect

• Account data: your email address (used for magic-link and one-time-code sign-in), your forms and workspaces, and your plan and subscription status.
• Testimonials: the name, role/title, star rating, and testimonial text an author chooses to provide, the date it was submitted, and whether they ticked the permission box. For testimonials a form owner imports, also the source (for example LinkedIn) and a link to the original.
• Billing data: handled by Stripe. We never see or store payment card details. We receive and keep your plan, subscription status, renewal dates, and Stripe customer and subscription IDs. Stripe holds your billing name, email, and address for tax and invoicing.
• Product events: counts of actions such as form views, submissions, sign-ins, and upgrades, stored in our own database. Events about signed-in users carry their account ID. Failed sign-in-code attempts record the email address tried, to stop abuse. Visitors to forms and walls are counted without any identifier.
• Technical logs: our hosting provider’s standard server logs (IP address, user agent, timestamps, requested pages) for security and debugging.
• Email you send us: messages to any @proofloft.com address.

Cookies: we set one essential cookie — your sign-in session. No analytics cookies, no ad cookies, no cross-site tracking. Fonts are served from our own domain, so loading a page doesn’t contact Google or any other third party. The embed widget displays approved testimonials and sets no cookies on visitors’ browsers.

3. How we use data, and our lawful bases

Where UK or EU data-protection law applies, this is why we use data as controller:

• To provide the Service — sign-in, forms, walls, embeds, export, and paid plans: performance of our contract with you (GDPR Art. 6(1)(b)).
• To send transactional email — sign-in links and codes, new-testimonial notices, and important account or billing notices: contract (Art. 6(1)(b)). We send no marketing email without your explicit opt-in (Art. 6(1)(a)).
• To keep the Service secure, prevent abuse, and understand how the product is used — logs and product events: our legitimate interests (Art. 6(1)(f)).
• To keep tax and accounting records for paid plans: our legitimate interest in meeting our US legal obligations (Art. 6(1)(f)).

We do not make automated decisions that have legal or similarly significant effects on anyone.

4. If you wrote a testimonial

If you submitted a testimonial through a Proofloft form, the business that sent you the form (the form owner) decides whether and where to publish it, and is responsible for your data. We store it on their behalf under our Data Processing Agreement. If they publish it, your name, role, rating, and words appear on their public wall, in embeds on their website, and in a public data feed that other websites can read.

When you submit, our hosting provider logs your IP address and browser details like any other page request (see section 6). To correct or withdraw a testimonial, contact that business, or email us at legal@proofloft.com and we will pass on your request and help remove the content. You can withdraw your permission at any time; it doesn’t affect use before you withdrew it.

5. Service providers (subprocessors)

We share data only with the providers needed to run Proofloft, all in the United States:

• Netlify, Inc. — application hosting, delivery, and server logs
• Neon — database hosting (Postgres, US region)
• Resend, Inc. — sending transactional email, and receiving email sent to @proofloft.com addresses
• Google LLC (Gmail) — the inbox where email sent to @proofloft.com is forwarded and read
• Stripe, Inc. — payment processing, tax calculation, and invoicing (Stripe acts as its own controller for payment data)

Each provider processes data under its own security and privacy commitments. We never share your data with advertisers or data brokers. We may disclose data if the law requires it, or to a buyer if Media Yard LLC or Proofloft is sold, under this policy.

6. Retention

• Account data, testimonials, and product events: kept while your account is open. When your account is closed, we delete them within 30 days, except records we must keep for tax and accounting.
• Deleted data in backups: our database provider’s point-in-time recovery keeps deleted data for up to 30 days before it is gone for good.
• Server logs: kept by our hosting provider for up to 30 days.
• Email you send us: kept while the conversation is useful, then deleted.
• Tax and billing records: kept as long as US tax law requires, typically up to 7 years.

7. Your rights

Depending on where you live (including the EU/EEA, UK, Switzerland, and California), you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent you gave. Email legal@proofloft.com and we will respond within 30 days. Account holders can export testimonials and consent records as CSV or JSON any time from Account → Your data. We do not discriminate against you for exercising these rights.

If you are in the UK, EU/EEA, or Switzerland, you can also complain to your data-protection authority — in the UK the Information Commissioner’s Office (ico.org.uk), in the EU the authority in your country, in Switzerland the FDPIC. We’d appreciate the chance to fix it first.

8. Security

Data is encrypted in transit (TLS) and at rest by our database provider. Sign-in uses single-use, expiring magic links and one-time codes — no passwords to leak. Access to production systems is limited to the operator of the Service.

9. International transfers

Our infrastructure is in the United States. If you sign up from outside the US, you give your account data directly to us in the US. Where a customer in the UK, EU/EEA, or Switzerland sends us personal data to process on its behalf — testimonials — the transfer is covered by the Standard Contractual Clauses and UK Addendum in our Data Processing Agreement. We are not certified under the EU–US Data Privacy Framework or the UK–US Data Bridge.

10. Children

Proofloft is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child submitted a testimonial, email legal@proofloft.com and we will help remove it.

11. Changes

If we materially change this policy, we will notify account holders by email or in the dashboard before the change takes effect.

12. Contact

Media Yard LLC · PO Box 73, Pennsauken, NJ 08110 · legal@proofloft.com