ProvelyMacleod Labs is the controller of the personal data described here. This policy takes effect on 2026-09-06. Write to macleod@macleodlabs.ai to exercise any right in this policy.
What data do we collect?
| Data | Why we hold it | How long we keep it |
|---|---|---|
| Your name, email address, and the identity provider you signed in with | To create your account and to contact you | While the account is open, then 30 days |
| Your organisation name and billing details | To bill you and to meet tax law | Seven years, because tax law requires it |
| API keys, stored as a hash | To authenticate your calls | Until you rotate or delete the key |
| Provider credentials that you connect, stored encrypted | To read the evidence that your contracts name | Until you remove the connection |
| Operations, contracts, verdicts, and receipts | To verify your workflows and to show you the result | While the account is open, then 30 days |
| Raw provider responses | To explain a verdict while you investigate it | A short time to live, off by default |
| Request logs and error traces, with secrets redacted | To run the service and to find defects | 30 days |
| Website analytics without a cookie | To count page views and to compare page designs | 12 months, in aggregate |
What do we not do?
- We do not sell personal data.
- We do not use your data to train a model.
- We do not give evidence to a language model. The runtime evaluates evidence with operators.
- We do not write secrets to logs or to telemetry.
- We do not set an advertising cookie.
Why are we allowed to hold it?
- Contract: we need the data to give you the service that you asked for.
- Legal duty: tax law requires us to keep billing records.
- Legitimate interest: we keep short logs to run the service and to keep it secure.
Who else sees the data?
We use a small number of processors. Each one holds a contract that limits it to our instructions.
| Processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage, and backups | Ireland (eu-west-1) |
| Stripe | Payment and billing | United States, with standard clauses |
| Google and GitHub | Sign-in, when you choose that provider | United States, with standard clauses |
| Resend | Service email | United States, with standard clauses |
We give data to a public authority only when the law compels it, and we tell you unless the law forbids it.
What are your rights?
- Ask for a copy of your personal data.
- Ask us to correct data that is wrong.
- Ask us to delete your data.
- Ask us to limit how we use it.
- Ask for your data in a portable format.
- Object to a use that rests on a legitimate interest.
- Complain to your data protection authority. In the United Kingdom that is the Information Commissioner’s Office.
Write to macleod@macleodlabs.ai. We answer within 30 days.
Cookies
The public website sets no cookie for advertising and no cookie for cross-site tracking. The application sets one session cookie after you sign in. That cookie is necessary, so no consent banner appears.
The home page shows one of several designs, chosen at random. The choice is not stored in a cookie, and it identifies nobody.
Security
- We encrypt data in transit and at rest.
- We store API keys as a hash with a pepper, never in plain text.
- Verifier credentials are read only wherever the provider permits it.
- We redact provider responses before telemetry.
- We sign every receipt with Ed25519, so you can check it without trusting us.
Report a security problem to macleod@macleodlabs.ai. Describe the class of the problem. Do not send a working exploit.
Changes to this policy
We publish a new version on this page. We tell you by email before a material change takes effect.