Privacy Policy

Last updated: 5 October 2026

This policy explains what data ProofMyAI collects, why, and your choices. ProofMyAI is operated by Muhammad Usman, sole proprietor, Pakistan. Contact us at contact@usmanabbas.dev with any privacy question.

For the conversations and other content you send us about your customers, you are the data controller and we are your processor under our Data Processing Agreement. Full details are in the Trust Center.

What we collect

• Account data: your email address and a securely hashed password (we never store the password itself).
• Content you provide: chat transcripts, knowledge base articles, test questions, AI agent runs and workflow execution data you upload or send.
• Connection details: API keys and webhook URLs for n8n, Make, bots and alert channels, stored encrypted.
• Technical data: basic server logs (such as IP address and time of request) to keep the Service secure.
• Sign-in devices: the browser and device type (for example “Chrome on Windows”) and dates of sign-ins, so we can warn you about sign-ins from a new device. If you turn on two-factor authentication, its secret is stored encrypted and recovery codes are stored hashed.

Personal data masking

By default, emails, phone numbers, card numbers, IBANs, IP addresses, UK postcodes, UK number plates and self-introduced names inside transcripts and agent runs are masked before they are stored or sent to an AI model. Each project can add its own words to mask, keep results only (no conversation text), switch the AI provider off, and delete data automatically after 7 to 365 days (Settings → Data & privacy).

How we use data

Only to provide the Service: grading answers, running checks, sending alerts and reports you set up, account emails (such as password resets) and security. We do not sell your data and do not use it for advertising.

Support requests

When you submit a support ticket we store your name (optional), email, the issue you describe and the page it happened on, so we can reply and you can track it. Tickets are deleted with your account, or on request. If you choose to message us on WhatsApp, WhatsApp (Meta) processes that conversation under its own privacy policy.

Free audit requests and free tools

When you request a free chatbot audit we store your name (optional), email, website, the chatbot you use, your message and which link or website brought you to the form, only to do the audit, send it to you and follow up about it. Ask us any time and we delete it. Text you paste into the free chatbot answer checker is checked and then discarded; it is never stored.

Feedback and testimonials

If you send feedback from your dashboard we store it with the name, role and company you enter. It is only shown on our website if you ticked the permission box and we approved it, exactly as you wrote it. Ask us any time and we remove it; it is also deleted with your account.

Service providers

• Hosting: Railway (application and database), US West.
• AI checking: Anthropic (Claude), only for projects with AI checking on. Only the masked content needed for a check is sent. Anthropic does not train its models on data sent through its commercial API. If we change AI provider, we update this page and the Trust Center first.
• Email: Resend, for alerts, summaries and password resets.
• Payments: Paddle.com is our online reseller and Merchant of Record. Paddle collects and processes your billing details; we never see your full card number.
• Password breach check: when you choose a password, we send only the first 5 characters of its SHA-1 hash to Have I Been Pwned to check it hasn't appeared in a data breach. Your password and email are never sent.

Cookies

We use one essential cookie to keep you logged in, one to remember your cookie choice, and your browser's local storage to remember your light/dark theme. We do not use advertising cookies. On our public pages (not inside the dashboard) we use Google Analytics to count visits and see which pages are useful, but only if you click Accept on the cookie banner. It then sets analytics cookies and IP addresses are anonymised. You can change your choice any time with the "Cookie settings" link at the bottom of every page; rejecting deletes the analytics cookies. If you accepted analytics cookies and then sign up, send a form, start a trial or pay, our server tells Google Analytics that this happened (with the analytics ID from that cookie, the plan and price, never your name, email or any content) so we can see which marketing works. If you accept, we also remember for 90 days which link or website first brought you here (for example "linkedin" or "google.com" and the page you landed on) in a first-party cookie, and store it with your account if you sign up. It contains no personal data and rejecting deletes it. Our videos are hosted on YouTube and only load (from youtube-nocookie.com) after you click play.

Retention and deletion

Your data is kept while your account exists, or for the shorter period you set per project. You can delete individual audits and projects at any time, or delete your whole account in Account → Delete account, which permanently removes all your data. Encrypted daily backups are deleted within 30 days.

Your rights

You can access, export (CSV and JSONL exports in the app), correct or delete your data. Email contact@usmanabbas.dev for any other request and we will reply within 30 days.

Security

Passwords are hashed with scrypt, credentials are encrypted with AES-256-GCM, connections use HTTPS, and every page checks that you own the data you view. Sign-up and login are protected by a CAPTCHA, rate limits and account lockout, and you can turn on two-factor authentication.

Changes

If we change this policy we will update the date above and, for important changes, email account owners. See also our Terms of Service.