Privacy Policy

ProofVector is built and run by one person — Mohamed Aziz Taamali, based in Tunisia. There's no company structure between you and me; if you have a question about your data, you're emailing the person who can actually answer it.

This policy covers your use of proofvector.vercel.app and any service offered from it — the anonymous report generator, account sign-up, the dashboard, and everything in between.

Contact: aziztaamalli4@gmail.com

Effective date: September 12, 2026.

Here's exactly what we collect, and when:

Account data

When you sign up: your email address, your name (if you sign up with Google and it's attached to your Google account), and which authentication method you used (Google OAuth or email/password).

Product data

When you set up your product in the dashboard: the description of what you sell and who you sell to. This is what every report we generate for you is built around.

Prospect data

When you add or search for prospects: business names, website URLs, Google Maps links, and any notes or reviews you paste in. All of this describes businesses you're researching, not individuals.

Generated reports

The proof reports ProofVector generates for you — the analysis, the proof sections, the outreach message — stored in your account so you can come back to them.

Anonymous try-before-signup data

If you use the anonymous "try it" flow on the landing page without creating an account, we collect: a SHA-256 hash of your IP address (never the raw IP itself), a session cookie (pv_anon_id), and whatever you typed into the form — what you sell, who you sell to, and an optional prospect URL. If you sign up afterward in the same browser, this data is linked to your new account so the report you already generated isn't lost.

Usage data

Standard server logs: request timestamps, the page or endpoint requested, and user-agent strings. We don't run any third-party analytics or tracking script — the only usage data that exists is what Vercel, our hosting provider, logs by default to operate the service.

Plainly, in order of how much data it touches:

• To provide the service — generate your reports, save your product and prospects, keep you signed in.
• To rate-limit the anonymous flow (one report per IP per 24 hours), using the hashed IP described above.
• To protect the anonymous form against bots, via Cloudflare Turnstile.
• To email you about the product when it's actually relevant — not a newsletter, not marketing cadence, just account-relevant updates sent to the address you signed up with.

We do not sell your data. We do not use your data to train AI models. We do not share your data with advertisers. There is no ad network or data broker anywhere in this product.

ProofVector is one person, not an infrastructure team — so, like almost every small SaaS product, it's built on top of other companies' infrastructure. Here's every service that touches your data, and exactly what each one sees:

Supabase — authentication, database, storage

Stores your account, product, prospect, and report data. Hosted on AWS, region eu-west-1 (Ireland) — your primary data stays in the EU.

Vercel — hosting

Serves the website and processes every request, on their edge network.

Cloudflare Turnstile — CAPTCHA

Verifies that a submission to the anonymous report form isn't a bot. Cloudflare receives a challenge token; no personal data is sent to them.

LangSearch — prospect discovery

When ProofVector searches for a prospect matching your criteria (the "what you sell / who you sell to" inputs), those inputs are sent to LangSearch to find publicly listed businesses that match. We don't send any of your personal account data to LangSearch — only the search inputs you typed.

Google PageSpeed Insights, WhoisJSON, Microlink — prospect research

We send prospect website URLs (ones you provide, or ones we discover) to these services to gather public information about those websites — performance scores, domain registration data, page metadata. No personal data about you is sent.

Google Gemini and NVIDIA (Nemotron) — AI analysis

We send the product/target inputs and the prospect research data collected above to these providers' APIs to generate the AI proof analysis. Per Google's and NVIDIA's own terms for their API products, this data is not used to train their models.

iLoveAPI — HTML to PDF conversion

When you export a report to PDF, the report's HTML is sent to iLoveAPI for conversion. Per their terms, files are deleted from their servers after processing.

If you're in the EU (or anywhere else — we apply these rights to everyone, not just where the law requires it), you have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure ("right to be forgotten") — delete your account and everything tied to it.
• Portability — get your data in a machine-readable format.
• Objection — object to how we're processing your data.
• Withdrawal — withdraw consent at any time, where processing is based on consent.

To exercise any of these, email aziztaamalli4@gmail.com. We respond within 30 days.

• Account data — kept while your account is active. Deleted within 30 days of a deletion request.
• Anonymous try-before-signup data — IP hashes are deleted after 30 days (they're only needed for the 24-hour rate limit, plus a short buffer for troubleshooting abuse). Anonymous reports stay live at their public /r/[slug] URL for 7 days, then are deleted unless you claim them by signing up.
• Server logs — 90 days.

• pv_anon_id — session cookie for the anonymous try flow. 7-day expiry. HttpOnly, Secure, SameSite=Lax.
• Supabase auth cookies — manage your signed-in session, expire on logout.
• Cloudflare Turnstile cookies — temporary challenge cookies set by cloudflare.com, governed by Cloudflare's own privacy policy.

No advertising cookies. No analytics tracking cookies.

ProofVector isn't intended for anyone under 18. We don't knowingly collect data from minors.

Your primary data — account, product, prospect, and report data — is stored with Supabase in AWS eu-west-1 (Ireland), within the EU.

Other providers we rely on for parts of the service (Vercel for hosting, Cloudflare for bot protection, and the AI and research APIs listed in Section 4) may process data outside the EU, including in the United States, as part of operating their own infrastructure. Where that happens, standard contractual clauses govern the transfer.

We may update this policy as the product changes. Material changes are announced by email to your account address. Non-material changes — wording, clarity — just update the "last updated" date above.

For any privacy question, data request, or complaint: aziztaamalli4@gmail.com.

If you're in the EU and we haven't resolved your complaint to your satisfaction, you have the right to lodge a complaint with your national data protection authority.