PILOT PROTOTYPE · NOT A LIVE SERVICEInvite-only pilot. Examples on this page use synthetic data; nothing is sent to a VitaProof gateway.
VITAPROOF

VitaProof privacy notice (pilot)

1. Who is responsible

VitaProof LLC, a New Mexico (USA) limited liability company. Contact for anything about your data: y.asqarray@vitaproof.io.

2. What we collect

  • Access requests: if you ask for access on our website: your name, work email, company, role, company size, what your company does, the systems you use, what you want to automate and the plan you are interested in, plus a one-way hash of your IP address (used only to stop abuse).
  • Account details: your email address, and the name and contact details you enter.
  • Meeting requests: company name, contact person, company size, preferred times and any notes you add.
  • Set-up data: the people, credentials, agents, automations and company details used to build your company's structure.
  • Terms acceptance: which version of the pilot terms and this notice you accepted, and when, with a one-way hash of your IP address and browser (never the raw values).
  • Sign-in and security logs: for example sign-in times and the device used.
  • Business records: VitaProof is designed so its gateway processes these in memory and does not store their content.

3. Why we use it

  • To review your access request and, if approved, invite you.
  • To give you access to the pilot and run it for you.
  • To arrange and hold meetings with our customer advisor, including the initiation ceremony with your company's owner or decision-maker.
  • To keep the service secure and to keep a record of who did what.
  • We do not sell your data, use it for advertising, or send marketing emails.

4. AI

Any AI output in VitaProof is a draft that a person must review and approve. The pilot website does not send your records to an AI service. If that changes, we will tell you and ask first.

5. Where it is held and who helps us

  • Amazon Web Services, EU region eu-north-1 (Stockholm): hosting and storage.
  • Supabase, EU region eu-north-1: accounts and sign-in.
  • Amazon SES: sends sign-in links, invitations and password resets.

These providers process data for us under their own security and data-processing terms. VitaProof LLC is based in the USA, so our team may access data from outside the EU to support you.

6. Who owns it

Your company owns its data. We use it only to run the pilot.

7. How long we keep it

  • Set-up data: deleted within 30 days after your company's structure is set.
  • After set-up, only the Mark: the structure and hashes the gateway needs to operate, designed to hold no information about your people or your company. In the Mark, approvers are identified by a reference, not by name or email; the link between a reference and a person is kept only in set-up data and is deleted with it. The hashes are designed to be anchored to a public ledger. Outsiders see only hashes (selective disclosure); this is not a cryptographic zero-knowledge proof.
  • Contact details for account access (email, name, sign-in records): kept while your account is active, deleted within 30 days after it is closed.
  • Closing your account: close it on your account page, or ask your customer advisor. Your access ends straight away. Your contact details and set-up data are deleted within 30 days. Afterwards we keep only the Mark and a record that the account existed and was closed; in that record your email is replaced by a reference, which we can match to you only if we already have your email.
  • Access requests: deleted 60 days after they arrive if not answered, or 30 days after they are approved or declined.
  • Terms acceptance records: kept while your account is active and afterwards for as long as needed to show what was accepted.
  • Logs: server logs are kept for 14 days and network logs for 3 days. Sign-in sessions are removed after 30 days without use.
  • Emails: we do not keep copies of the emails we send. Amazon SES keeps delivery records under its own terms.

8. Your choices

You can ask us to see, correct, export or delete your data at any time by emailing y.asqarray@vitaproof.io. We will reply within 30 days. Depending on where you live, you may also have the right to complain to your local data-protection authority.

9. Security

Access is by invitation only. Sign-in tokens are short-lived, and the server decides what each account can see. No system is perfectly secure; tell us at once if you notice anything wrong.

10. Changes

If we change this notice, we will show you the new version and ask you to accept it before you continue.

Version privacy-notice/0.2-draft-2026-11-12