Privacy Policy

1. Who is responsible for your data

ProveitGo is operated by ProveitGo, which acts as the data controller for the personal data described on this page.

You can reach us about anything on this page, including any request to access, correct, export or delete your data, at support@proveitgo.com.

2. What we collect when you create an account

An account is required to use the product. Depending on how you sign up, we collect:

• Your name and email address, which you give us directly or which Google gives us when you choose to sign in with Google.
• Your password, stored only as a cryptographic hash. We never store it in a form we can read.
• A profile picture, when your sign-in provider supplies one.
• A one-time code sent to your email address when you sign in that way. The code is deleted once used or expired.
• Your country and the IP address of your last sign-in, used to detect abuse and to show you the right language and currency.
• How you heard about us, when you choose to answer that question.

3. What we request from Google, and what we do with it

When you sign in with Google, we request three scopes and nothing more: openid, email and profile.

We use them for one purpose: to create or recognise your account. We read your email address, your name and your profile picture. We do not request access to your Gmail, your Drive, your contacts, your calendar or your YouTube account, and we cannot read them.

We do not sell this data, we do not use it for advertising, and we do not transfer it to third parties for their own purposes.

4. What creators provide about their channels

If you use the creator side of the product, you build a media kit. That involves data you give us and data we measure from public sources.

• The social accounts you claim, and a verification code you temporarily place in your public bio so we can confirm the account is yours.
• Figures we measure from the public pages of those accounts: follower counts, engagement rate, median views, and recent posts with their public metrics.
• Audience figures you declare yourself: top countries, age ranges and gender split, together with a screenshot of your platform statistics, which a human on our team reviews before your kit goes live.
• A contact email address or WhatsApp number, used to let a brand reach you. Neither is ever printed on your public page.
• Past collaborations you choose to display.

5. What brands provide

On the brand side, we store your company name, your website and social handles, a description of your brand, the briefs you publish, the applications you receive, and the decisions you take on them.

If you connect an online store, we store the connection and the orders attributed to a campaign, so that a creator's results can be measured. We do not read your customers' personal details.

6. Campaign tracking

When someone clicks a tracked link in a creator's post, we record the click: the link, the time, the IP address, the browser's user agent, the referring page and the country derived from the IP.

This exists so a brand can tell which creator produced which result. We do not use it to build advertising profiles, and we do not sell it.

7. Payments

When a creator requests a payout, we store the Mobile Money number, the operator and the account holder's name, so the payment can be made and proof attached.

Card and mobile money payments are processed by FedaPay. We never see or store full card numbers.

8. Messages

Brands and creators exchange messages inside the product once a collaboration starts. We store those messages, their attachments and delivery links so both sides keep a record of what was agreed.

We do not read them except where strictly necessary to answer a support request or to investigate a report of abuse.

9. Data about people who do not have an account

Our discovery feature searches public social profiles. The information shown comes from pages that are already public, and relates to accounts acting in a professional or public capacity.

If a profile about you appears in the product and you want it removed, write to us at the address above and we will remove it.

10. Cookies and analytics

We use a small number of cookies, and no advertising cookie is set before you have interacted with the product.

• A session cookie, which keeps you signed in. The product does not work without it.
• A language cookie, which remembers whether you chose French, English or Russian.
• Campaign parameters, when you arrive from a link we published, so we know which channel brought you.
• PostHog, which measures how the product is used so we can fix what does not work.
• The Meta pixel and Google Analytics, on our marketing pages only, to measure our advertising.
• Google reCAPTCHA, on sign-up and public forms, to block automated abuse.

11. Who else processes your data

We use a small number of providers to run the service. Each of them processes data only on our instructions.

• Vercel, which hosts the application.
• MongoDB Atlas, which hosts the database.
• Resend, which sends transactional email such as sign-in codes and notifications.
• Cloudinary, which stores images you upload, including audience screenshots.
• FedaPay, which processes payments and payouts.
• ScrapeCreators and Apify, which retrieve public figures from social platforms.
• The YouTube Data API, which supplies public figures for YouTube channels.
• OpenAI, which generates suggested text when you ask the product to rewrite your profile description. We do not send it your audience figures or your messages.
• PostHog, for product analytics.
• Google reCAPTCHA, for abuse prevention.

12. What we never do with your data

ProveitGo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, and for all the data described on this page, not only Google's:

• We do not sell it, and we do not transfer it to data brokers.
• We do not use it for targeted or personalised advertising.
• We do not use it to assess creditworthiness or for lending purposes.
• We do not allow humans to read it, except with your explicit consent, to answer a support request you made, for security reasons such as investigating abuse, or where the law requires it.

13. Artificial intelligence

The product uses a third-party language model in one place only: when you ask it to rewrite your own profile description. The text you wrote is sent to OpenAI, which returns a suggestion. Nothing else is sent, and the feature does nothing unless you press the button.

ProveitGo does not use data obtained through Google Workspace APIs to develop, improve or train generalised artificial intelligence or machine learning models.

We do not use your data to train any model of our own.

14. Where your data is held

Our providers host data in the European Union and in the United States. Where data leaves the European Economic Area, the transfer relies on the European Commission's standard contractual clauses, which those providers publish in their own terms.

15. How long we keep it

We keep your account and the content attached to it for as long as your account exists.

Measured figures are refreshed rather than accumulated: a new reading replaces the previous one, and we keep only the latest.

Sign-in codes are deleted as soon as they are used, and in any case within 15 minutes.

Click records attached to a campaign are kept for 24 months, so a campaign's results remain auditable after it ends.

Audience screenshots are kept for as long as the declaration they prove is displayed on your kit, and are deleted when you replace or remove it.

An account left unused for 24 months is deleted, after we have written to the address on file and given you 30 days to object.

When you delete your account, we delete your profile, your media kit, your applications, your messages and your social connections. You can ask us to delete it at any time by writing to the address above, or from the account settings screen. Deletion is permanent and takes effect within 30 days.

16. Your rights

If you are in the European Union or the United Kingdom, the GDPR gives you the right to access your data, to correct it, to have it deleted, to object to certain processing, and to receive a copy in a portable format.

Write to support@proveitgo.com and we will answer within one month. You can also lodge a complaint with your national data protection authority.

You do not need an account to exercise these rights, and we will not charge you for it.

17. Children

The product is not intended for anyone under 16. We do not knowingly create accounts for children. If you believe a child has an account with us, tell us and we will delete it.

18. Security

Passwords are hashed. Traffic is encrypted in transit. Access to the production database is restricted to the people who operate the service.

No system is perfect. If we discover a breach affecting your personal data, we will notify you and the relevant authority as required by law.

19. Changes to this policy

If we change how we use your data in a way that affects you, we will update this page and change the date at the top. Where the change is significant, we will tell you by email.