PROVE · Policies
Data Processing Agreement
The terms between your company and PROVE for the records you put into the platform.
Version dated 5 November 2026 · Applies to company accounts from this date
Who is who
Controller and processor
In data-protection terms your company decides what is entered and why. PROVE processes it on your instructions to deliver the service.
Controller
The company account holder (you). You decide what customer, team and job information is entered into PROVE and what you do with it.
Processor
PROVE, operated by Ryan Morrow. We process that information only to provide the service, on your instructions, under the terms below.
1. Subject matter and duration
Processing needed to run PROVE for your company account: storing and returning your team, customer, job, evidence, form, financial and audit records for as long as your account is open, or until you ask us to remove what can be removed.
2. Nature and purpose
Collection, storage, retrieval, display to authorised people, transmission to you and your customers through checked access and share links, and deletion where permitted. We do not sell your data, use it for advertising, or use it to train products for other businesses.
3. Categories of data subject
Your own staff and their accounts; your customers and their contacts; people who sign or approve documents; visitors to the public website (analytics only, after consent).
4. Types of data
Identity and contact details, job and site details, quotes, invoices and payment records, photographs, voice recordings, form answers, signatures and timestamps, device and session information, subscription references.
5. Confidentiality
Access is limited to people who need it. Every account is bound by company role and permission checks, and access is logged in the audit and event history.
6. Security measures
The measures listed on the Trust Centre, including Row Level Security on every table, private storage with signed short-lived file addresses, permission and job-assignment checks, append-only audit history, and rules that stop writes when a subscription has ended.
7. Sub-processors
We use the service providers listed in the Privacy Policy. We will tell the account email before adding or replacing a provider that handles your data, and you can object by email before the change takes effect.
8. Helping with your customers' rights
If someone asks you to access, correct or delete their information, we will help: records can be corrected in the app, and we will remove or restrict what we can when you ask us by email.
9. Breach notification
If we become aware of a personal-data breach affecting your records, we will tell the affected account holders without undue delay, describe what happened and what we are doing, and keep you updated.
10. Information and audits
We will provide the information you reasonably need to show compliance with these terms. We cannot offer on-site audits of our hosting provider, but we can show you the controls, the checks we ran and the audit history of your own account.
11. End of the agreement
On request we will return your records in a usable format and delete what we can. Records that must be kept for tax, legal or contract reasons are retained, and we will tell you which apply.
12. International transfers
Our providers may process or store data outside the United Kingdom. Where that happens, we rely on the transfer protections our providers operate for their services. Ask us by email for the details of any provider.
Sub-processors
The providers we use, and what each one handles.
Lovable Cloud (managed hosting, database, authentication, storage and email delivery)
Runs PROVE: stores records, checks who may see them, signs people in, holds files and sends account and notification emails
Data involved: All company records listed above
Paddle (payment provider)
Takes card payments, calculates and pays VAT, and provides the subscription reference PROVE reads to apply your plan
Data involved: Company name, billing country, subscription and payment status. Card details are held by Paddle, not by PROVE
Xero (optional accounting sync)
Sends the invoices you choose to sync and matches contacts, only while you keep the connection switched on
Data involved: Invoice and customer contact data you choose to sync. Xero tokens are stored encrypted
Google Analytics (website only, consent-gated)
Counts visits and trial signups on the public website
Data involved: Page visits, clicks and campaign source. No names, email addresses, phone numbers or job records, and advertising features are switched off
Google (optional sign-in)
Confirms your identity when you choose Google sign-in instead of a password
Data involved: Your Google email address and name
Security measures we maintain
- Row Level Security on every application table, so the database enforces company separation
- Company-scoped storage with private buckets and short-lived signed addresses for every file
- Role and permission checks, plus job-assignment checks, enforced in the database
- Email confirmation for new accounts, and password handling by the authentication service
- Append-only audit, event and decision history that cannot be edited or deleted
- Database rules that block writes when a trial or subscription has ended
- Encrypted storage of accounting connection tokens
- No card details stored by PROVE: the payment provider is the merchant of record
Full detail, including the checks run against the running application and the limits we have not built yet, is on the Trust Centre.
Signing, copies and changes
These terms apply to company accounts from the date shown above. If you need a signed or PDF copy for your own records, or a paper agreement with your own terms attached, email us and we will arrange it. We will tell the account email address before adding or replacing a sub-processor that handles your data.
omni-projects@hotmail.com
Operated by Ryan Morrow. PROVE does not publish a registered company number or registered office address. If you need our legal entity details for a contract, purchase order or complaint, email us and we will confirm them in writing.