Privacy. Security.
Built-in.
Proova is a revenue attribution platform. We earn trust by handling your data responsibly, maintaining strong security practices, and being transparent about everything we do with your information.
Privacy Policy
Proova, Inc. · Effective Date: April 2026 · Version 1.0
Proova, Inc. ("Proova", "we", "our", or "us") operates a revenue attribution and analytics platform that helps businesses track and measure marketing performance across online and offline channels. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our platform, website, and related services (the "Services").
By accessing or using our Services, you acknowledge that you have read and agree to this Privacy Policy. If you do not agree, please discontinue use immediately.
1. Who We Are
Proova, Inc. is the data controller responsible for personal data processed through our Services. For any privacy-related questions, contact us at privacy@proova.app.
Transparency
2. Information We Collect
We collect only the information necessary to operate our Services. Data falls into the following categories:
- Full name and professional title
- Business email address
- Company name and size
- Password (stored in hashed form — never readable)
- Billing contact information
- Click IDs, session tokens, referral parameters
- Timestamps of attribution events
- IP address (fraud prevention & analytics)
- Browser type, OS, device identifiers
- Features used and navigation patterns
- Order IDs, amounts, currency, status
- Product SKUs and categories (if provided)
- Offline and online conversion events
- CSV imports and webhook data you submit
- Last four digits of card (reference only)
- Billing address and postal code
- Transaction IDs and payment status
- Subscription tier and renewal history
Purpose
3. How We Use Your Information
3.1 Service Delivery
- Authenticate and maintain your account
- Provide attribution tracking, analytics dashboards, and reporting
- Process transactions and manage subscriptions
- Integrate with third-party platforms you authorize
3.2 Platform Improvement
- Analyze usage patterns to identify and fix bugs
- Develop new features and improve existing functionality
- Fraud detection and abuse prevention (using aggregated, anonymized data)
3.3 Communication
- Transactional emails: invoices, password resets, security alerts
- Product updates, release notes, and service announcements
- Responding to support and sales inquiries
- Marketing communications with your consent (opt-out available at any time)
3.4 Legal & Security Obligations
- Detect, investigate, and prevent fraud and unauthorized access
- Comply with applicable laws, regulations, and legal processes
- Enforce our Terms of Service
- Protect rights, property, and safety of Proova, users, and the public
4. Legal Bases for Processing (GDPR / UK GDPR)
For users in the EEA or United Kingdom, we process data under the following legal bases:
| Legal Basis | When We Apply It |
|---|---|
| Performance of Contract | Delivering the Services you subscribed to |
| Legitimate Interests | Analytics, fraud prevention, product improvement, direct marketing to existing customers |
| Consent | Marketing communications, non-essential cookies (withdrawal possible at any time) |
| Legal Obligation | Compliance with applicable laws, tax regulations, and court orders |
Third Parties
5. Data Sharing & Disclosure
We do not sell, rent, or trade your personal data. We share data only in the following circumstances:
5.1 Service Providers (Sub-processors)
We work with trusted sub-processors who access data only as needed to perform their contracted functions. All sub-processors are bound by Data Processing Agreements (DPAs) and must maintain adequate security standards.
| Category | Examples | Purpose |
|---|---|---|
| Cloud Infrastructure | AWS, Google Cloud | Hosting and data storage |
| Payment Processing | Stripe | Subscription billing |
| Customer Support | Intercom, Zendesk | Support ticket management |
| Error Monitoring | Sentry, Datadog | Platform reliability |
| Email Delivery | SendGrid, Postmark | Transactional emails |
A current list of sub-processors is available upon request at privacy@proova.app.
5.2 Business Transfers
If Proova undergoes a merger, acquisition, or sale of assets, your information may be transferred to the successor entity. We will notify you via email with at least 30 days' advance notice.
5.3 Legal Disclosures
We may disclose data when required by law, subpoena, or court order, or to protect the rights and safety of Proova, our users, or the public. We will notify you of such requests where legally permitted.
5.4 Aggregated Data
We may share aggregated, anonymized data (from which individuals cannot be identified) for research, industry reports, or with partners. This is not personal data.
Your Rights
6. Your Privacy Rights
Depending on your location, you have the following rights. To exercise any of them, email privacy@proova.app with subject "Privacy Rights Request". We respond within 30 days.
Security
7. Security Measures
We implement industry-standard technical and organizational safeguards to protect your data:
8. Payments Security
Payments are processed exclusively by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. Proova does not collect, store, or transmit raw credit card numbers, CVV codes, or banking credentials. We retain only the last four digits of your card for reference, billing address, and transaction metadata.
Cookies
9. Cookies & Tracking Technologies
We use cookies and similar technologies. You can manage preferences through our Cookie Settings panel (in the platform footer) or your browser settings. Disabling certain cookies may affect platform functionality.
| Cookie Type | Purpose | Can Opt Out? |
|---|---|---|
| Strictly Necessary | Authentication, security, core platform functionality | No — required |
| Functional | Language preferences, session state, UI settings | Limited |
| Analytics | Aggregate usage patterns (e.g., Google Analytics) | Yes — via cookie banner |
| Marketing | Ad retargeting and campaign measurement | Yes — consent required |
Global
10. International Data Transfers
Proova may transfer personal data outside your country of residence. When transferring from the EEA, UK, or Switzerland to countries not deemed to provide adequate data protection, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- UK International Data Transfer Agreements (IDTAs) where applicable
- Other lawful transfer mechanisms as required by applicable law
Details of applicable transfer mechanisms are in our Data Processing Agreement (DPA), available on request at privacy@proova.app.
11. Children's Privacy
Our Services are not directed to individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware we have inadvertently done so, we will delete it promptly. Contact privacy@proova.app if you believe a child has submitted data.
Retention
12. Data Retention
We retain personal data only as long as necessary to fulfill the purposes described in this policy, or as required by law.
| Data Type | Retention Period |
|---|---|
| Account data | Duration of subscription + 90 days after closure |
| Transaction & billing data | 7 years (tax and financial reporting obligations) |
| Usage logs & analytics | 24 months identifiable, then anonymized |
| Support communications | 3 years from date of last contact |
| Deleted data in backups | Up to 30 days before permanent deletion |
13. Your Data Control
You may request deletion of your data at any time. Contact privacy@proova.app. Note that some data may be retained to fulfill legal obligations even after deletion requests.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When material changes occur, we will:
- Post the updated policy with a new Effective Date
- Notify you via email at the address associated with your account
- Request re-consent where required by applicable law
Your continued use of the Services after the effective date constitutes acceptance.
Compliance
15. Compliance Posture
Proova is designed for global businesses. We take a proactive approach to privacy and compliance as we grow.
- Standard Contractual Clauses for transfers
- Data Processing Agreements available on request
- 72-hour breach notification process
- Privacy by design principles applied
- No sale of personal information
- Right to know what data is collected
- Right to request deletion
- Non-discrimination for exercising rights
- Paddle manages tax collection and remittance
- Payment data governed by Paddle's PCI-DSS compliance
- Subscription terms disclosed at checkout
- Refunds processed via original payment method
- Region-appropriate bank linking via Open Banking / aggregators
- CSV import fallback for all regions
- DPA available for enterprise customers
- Security questionnaires fulfilled on request
Contact
16. Contact Us
If you have questions, requests, or concerns about this Privacy Policy or our data practices, please reach out through any of the following channels: