This policy explains what personal data Proof Holdings processes, why, where it goes, how long it stays, and what you can do about it. Each statement describes what the service does today; the version and date at the top tell you which service.
Who we are
The controller of the personal data described here is LT Telecom (UAB "LT telekomunikacijos"), a company registered in Lithuania under code 304043870, VAT number LT100009427918, registered office at Buivydiškių g. 118, Zujūnai, LT-14162 Vilniaus r., Lithuania. You can reach us at [email protected].
If a business asked you to verify something through Proof Holdings — to confirm a phone number, approve a request, or prove you control a domain — that business decides why your data is processed and is the controller of it. We process it on their behalf under our Data Processing Agreement. Questions about why you were asked go to them; questions about how the service handles data can come to us as well.
What we process, and why
Your account. The email address or phone number you sign in with, the messaging-platform identifier if you sign in through Telegram or WhatsApp, an optional display name you choose, your settings, your sub-accounts, and the API keys you create (stored as hashes). We process this to open and run your account — the contract between us (Article 6(1)(b) GDPR).
Verifications and approvals. The identifier being verified — a phone number, an email address or a domain — or, for a delegation or an artifact lookup, the published artifact it names; the channel used, the messages exchanged to complete the verification, the result, its timestamps, and the approval decisions made by the people you ask. The content of an approval request and of the approver's reply is encrypted end to end between the business and its approver with keys we do not hold; we store it only in encrypted form and cannot read it. When a business asks you to verify, it is the controller of this data and decides the legal basis; we process it only on its instructions, under the Data Processing Agreement. When you verify something for your own account, the basis is the contract between us (Article 6(1)(b)). A successful verification of a phone number, an email address or a domain issues a signed proof token that carries a SHA-256 hash of the identifier, not the identifier itself. A delegation token names the domain and the artifact in clear, because that is the statement it makes.
Security records. The browser type of your sign-in sessions, kept with the session; the IP address and browser type recorded when a verification code is submitted, an authorisation is given, or a proof, domain or delegation is changed; for SMS verifications, a risk record holding the country of the phone number and of the IP address, whether they match, whether a VPN or proxy was detected and a risk score from the number-risk provider; a log of our staff's actions on accounts; and the web server's request logs, which record the IP address and browser type of every request and are deleted after 30 days. We process this to keep spoofed numbers, abuse and account takeover out of the service — our legitimate interest, and yours (Article 6(1)(f)). A risk record can lower the confidence we attach to a result; it never blocks a verification. We do not profile you, and we make no automated decision with legal effect about you.
Usage and billing. Counts of verifications per account and, where a paid plan is active, invoices and payment status. Usage is processed under the contract; invoices and payment records are kept because accounting law requires it (Article 6(1)(c)).
Email and messages from us. Verification codes, magic links, approval requests and account notices, sent as part of running your account (Article 6(1)(b)) — never marketing without your consent.
What we never ask for
We do not ask for your legal name, identity documents or postal address, and the service has no field for them. The only names in the system are the display name — and, for a business profile, the business name, short description and picture — you choose to publish on your public profile. When you buy a paid plan or top up your balance, the payment processor asks for billing details at checkout; we receive the payment status and the invoice details, not your card number.
Where your data goes
We do not sell personal data, and we do not share it with anyone to market to you. It reaches third parties only in these cases:
- Service providers, by category: hosting and backups in the European Union; the edge network in front of the site; the messaging platforms and the SMS carrier that carry verification messages; email delivery; phone-number risk checks; public DNS resolvers for domain verification; payment processing for paid plans and balance top-ups. Each category, what it does, the data it receives, where it processes and the basis for any transfer outside the EU is listed on the subprocessors page, which we update at least 30 days before a new category starts processing data.
- The business that asked you to verify, which receives the result of its own request.
- Public proof records. A proof token you publish is visible to whoever you give it to; a public profile you create is visible to anyone who opens its address. The public registry lines of proofs hold the proof's public handle, the id of the verification it refers to, its issue and expiry dates and its status; the identifier itself travels only as a hash inside the token.
- Authorities, where the law obliges us.
Transfers outside the EU. The service runs and stores data in the European Union. Some provider categories process data in the United States; those transfers rest on the European Commission's standard contractual clauses or another mechanism recognised under Chapter V of the GDPR, as stated per category on the subprocessors page.
How long we keep it
- Account data — for as long as your account exists, then as described under Data deletion below.
- Verification records (the identifier, the messages exchanged and the result) — for as long as the account that requested them exists.
- Verification attempts and webhook delivery records — deleted automatically 90 days after they are created.
- Proof tokens — until the expiry you or the requesting business set when creating them; revoked tokens stay listed as revoked.
- Data exports — the file you request is deleted 7 days after you request it.
- Invoices, payments and usage records — 10 years, as accounting law requires.
- Backups — daily backups are kept for 90 days, and one monthly backup for a year.
How we protect it
All traffic to the site and the API is encrypted in transit. Identifiers and credentials are encrypted at rest with AES-256-GCM. Identifiers are masked in application logs. Access to production systems is limited to the operators who run it, and secrets live in a managed store that is rotated. Backups are taken daily and encrypted, with a copy off the primary servers; daily backups are kept for 90 days and one monthly backup for a year. The full list of measures is Annex II of the Data Processing Agreement.
Your rights
You have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to its processing, and to receive it in a portable format. You can export and delete your account yourself from the dashboard, or write to [email protected]; we answer within one month.
You also have the right to complain to a supervisory authority. Ours is the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, vdai.lrv.lt. You may also complain to the authority of the country where you live or work.
Data deletion
You can delete your account at any time from the dashboard (Settings → Delete account), confirming with a one-time code, or by emailing [email protected].
- A 7-day grace period. Your account is locked as soon as you ask: you are signed out everywhere, your API keys stop working, your proofs and delegations are suspended — anyone who checks one is told it is not currently valid — and your public pages are hidden. During these 7 days you can download a complete copy of your data and cancel the deletion.
- Outstanding charges first. If you are on a paid plan, on day 7 we cancel your subscription and invoice anything not yet billed.
- Then we delete everything you own — your account, verified assets, domains, projects, API keys, settings and history — within 30 days of your request, with one exception: if a final invoice is unpaid, the account stays locked and the deletion waits until it is paid. What we keep afterwards is listed below.
After deletion we keep:
- Billing records and a deletion record — invoices, payments and usage, together with the account's display name, sign-in email or phone number and plan at the time of deletion, kept encrypted for 10 years because accounting law requires the billing history and we must be able to say whose invoices they were. Nothing in this record is used to run the service or to contact you.
- The public registry lines of proofs (public handle, verification id, issue and expiry dates and status). Your own proofs stay listed as revoked; proofs recording decisions already made, and proofs you issued to others, stay valid until they expire.
- Retired usernames. The usernames of deleted accounts and projects are never given to anyone else, so a badge embedded elsewhere can never show someone else.
- Audit records of delegation changes, with IP addresses and device information removed.
- Records of actions our staff took on the account (a plan change, a key revoked), kept for accountability; they name the account by an internal id only.
Backups expire on the schedule above; if we ever restore one, deletions made since are applied again. The same email address or phone number can open a new account afterwards.
Cookies and browser storage
We set three cookies ourselves, all first-party and none for tracking: a sign-in cookie that lasts 15 minutes and a refresh cookie that lasts 7 days and is sent only to the sign-in endpoints, which together keep you signed in to the dashboard, and, on verification pages, a cookie that ties the verifications you start to your browser and is kept for 30 days after your last verification. The edge network that filters abusive traffic before it reaches us may set one or two security cookies of its own to tell a browser from a bot; they identify no one and belong to the edge category on the subprocessor page. Your browser also keeps a few values locally so the site works between page loads — whether you have signed in before, a verification you started so it can resume, the project, the live or test mode and the theme you selected, where to return you after a security check, banners you dismissed, and the homepage demo's result for one hour. If you choose "remember this device" when approving a request, the browser also keeps an approval key for 7 days that can be used but not read out. None of these are read by anyone but the site itself.
Page views on the public pages, including the verification pages a business sends you to, are counted by a cookieless analytics script that records the page address, your IP address and browser type, and nothing across sites; it is not loaded on approval pages or inside the signed-in application. We use no advertising or cross-site tracking cookies. If we ever add analytics that set cookies, we will ask for your consent first and say so here.
Children
The service is for businesses and developers. We do not ask for age, name or identity, so we cannot tell whether a phone number or an email address belongs to a child; the business that asks its users to verify decides who may use its service and is responsible for that. If a parent or guardian tells us a child's identifier was verified through the service, we delete it on request.
Changes to this policy
We will change this policy when the service changes. The version and date at the top identify the policy in force; for a material change we tell account holders by email or in the dashboard at least 30 days before it takes effect.
Contact
LT Telecom (UAB "LT telekomunikacijos")
Buivydiškių g. 118, Zujūnai, LT-14162 Vilniaus r., Lithuania