Privacy Policy

1. Who we are

ProofAPI is operated by the ProofAPI team, based in Kazakhstan. We decide how and why your personal data is processed and act as its controller.

Contact for any privacy question or request: proofapiofficial@gmail.com.

2. Data we collect

We collect only what the service needs to work.

• Content you seal. The input text or uploaded document text, the AI result, metadata such as the declared model name, label and agent ID, and a random salt. In hash-only mode we receive only SHA-256 fingerprints, never the content.
• Account data from GitHub. When you sign in with GitHub we receive and store your GitHub user ID, login, display name and avatar URL. GitHub may share your email address during sign-in; we do not store it in our database. We never receive your GitHub password.
• API keys. We store a key's name, a hash of the key and its last four characters, and when it was created, last used and revoked. The full key is shown once and is not stored.
• Usage data. Which account or key created which record and when, used for monthly limits and the usage page.
• Network data. To limit abuse we store your IP address only as a salted hash that cannot be reversed. Our hosting provider processes raw IP addresses in its own request logs.
• Demo requests. Name, email, company, message and interface language you send through the demo form, together with a hashed IP address.

3. What becomes public

A certificate is public to anyone who has its link. In text mode, the certificate shows the AI result, and its evidence file contains the input, the output, the metadata and the salt, so that anyone can check it independently.

Salted SHA-256 fingerprints, the record number, the issuer and the time are written to the Solana blockchain. Blockchain records are public and permanent: neither we nor anyone else can change or delete them. The original content cannot be rebuilt from the fingerprints.

Do not seal personal or confidential information in text mode unless you are entitled to publish it to the people who will receive the link. Use hash-only mode for private data.

4. Why we use your data

• To provide the service: create, store, show and verify certificates, run the console, issue API keys. Legal basis: performance of our agreement with you.
• To keep the service secure and fair: rate limits, abuse prevention, protecting demo controls. Legal basis: our legitimate interest.
• To answer demo requests and messages. Legal basis: your request and consent, which you can withdraw at any time.
• To meet legal obligations where they apply.

We do not sell personal data, do not use it for advertising and do not build marketing profiles.

5. AI processing

When you upload a document for AI review on the website, its text (up to 30,000 characters) is sent to Google through the Gemini API to produce the review. Google processes it under its own API terms.

The API method /api/v1/seal, the SDK and the MCP server do not send your data to any AI provider: they record the answer you already have.

AI reviews can be wrong. A certificate proves that the recorded data has not changed; it does not prove that the AI result is correct.

6. Cookies

We use only cookies that the service needs. There are no analytics, advertising or tracking cookies.

7. Service providers

We use these providers to run ProofAPI. Each receives only the data it needs.

These providers may process data outside Kazakhstan, including in the United States and the European Union. We rely on their contractual terms and safeguards for such transfers.

8. How long we keep data

• Certificates and their content: while the service runs, or until you ask us to delete them. Fingerprints on Solana cannot be deleted.
• Account data and API keys: until you ask us to delete your account. Revoked keys remain as a hash so that past records stay attributable.
• Demo requests: as long as needed to respond and follow up, and deleted on request.
• Hashed IP addresses: kept with the records they relate to, for limits and abuse prevention.
• Hosting logs: according to Vercel's retention periods.

9. Security

All traffic uses HTTPS. API keys and IP addresses are stored only as hashes. Server keys and secrets are kept in protected environment settings, and access to the database is limited to the team.

No system is completely secure. If you find a vulnerability, please write to proofapiofficial@gmail.com.

10. Your rights

Depending on where you live, including under the Law of the Republic of Kazakhstan No. 94-V “On Personal Data and Their Protection” and the EU General Data Protection Regulation, you may:

• know what data we hold about you and get a copy;
• correct inaccurate data;
• have your data deleted;
• restrict or object to processing;
• withdraw consent at any time;
• complain to your data protection authority.

Send requests to proofapiofficial@gmail.com from the address linked to your data, or mention your GitHub login. We reply within 30 days. Data already written to the blockchain cannot be deleted, but we can delete everything stored in our database, after which the fingerprints can no longer be linked to you.

11. Children

ProofAPI is a service for businesses and developers and is not intended for children under 16. We do not knowingly collect their data.

12. Changes to this policy

We may update this policy as the service develops. The effective date at the top always shows the current version. We will announce significant changes on the website before they apply.

13. Contact

Questions, requests and complaints: proofapiofficial@gmail.com.