Privacy Policy

1. Who this is for, and who is responsible

In short: read this first: it decides whether this document governs your data, or the studio's does.

Proofroom is made by ProofRoom, a Delaware company in the United States — the company took the capital R, the product didn't; §13 is how to reach us. Three kinds of people read this: studio members, who have an account; guest reviewers — clients who review images without one, and §2 is for you; and visitors to proofroom.app. Throughout, a project is a shared gallery, a review is a set of images in it, and a markup is a pin, box, arrow or drawing on an image.

Responsibility splits in two. The studio decides about its own content — the images, markups, comments and approvals inside its projects. It chose the images, invited the reviewers and decides how long to keep them, so it is the controller and we act only on its instructions. §16 of our Terms of Service sets that out, and it applies from the first upload. Clients: questions about what's in a project, or about taking a comment down, go to the studio first.

We decide about everything else. Accounts and organisations. Support messages and waitlist entries. How we recognise a returning reviewer, and the records we keep to protect the service and fix faults. The choice to email someone when their comment gets a reply, and what that email says. For those we are the controller, the legal bases in §4 are ours, and you write to us.

2. If you're a client reviewing images

In short: no account needed, a name we don't check, and an email only if you want one.

The password. If the studio set one, you type it and we check it — we never keep what you typed. Your browser then remembers that you got through, for that one project. If the studio changes the password, everyone enters the new one, you included. A project with no password needs only the link.

Your name is required, your email isn't. The name appears beside every markup you leave and in any PDF the studio exports; we don't verify it, and without one you can read but not comment. An email is used for one thing — telling you someone replied — and is never shown in the app or printed in an export. Leave it blank and you get no email.

How we know your feedback is yours. Your browser holds a marker for the project you're reviewing, and that's what lets you delete your own markups. It works for that project only — nothing follows you between projects or to other websites — and it stops working after a month. Clear your browser data or switch device and we can't recognise you: you'll enter the password and a name again, read everything as before, but you won't be able to delete what you left earlier.

Nothing can be edited once posted, by you or by the studio. Feedback can only be deleted; studio members with write access can delete yours, and otherwise it stays with the project. To remove something once your browser no longer recognises you, ask the studio — write to us and we'll usually route it through them anyway, because a browser can't prove who you are.

One thing about your address. If you gave one, it sits with your reviewer details and is also attached to the feedback you left. We can stop future email at any time; taking the address out everywhere means deleting that feedback too. Tell us which you'd rather have.

3. What we collect

In short: grouped by where it comes from.

Your account. Your name, email, whether it's verified, and your password, kept in a form nobody — us included — can read back. An address and a password, or a Google account, are required, and so is a name, so colleagues can tell who you are — without them we can't open an account for you, and until you click the verification link you can't sign in. With Google: your Google name, email and profile-picture link, and permission to sign you in — we ask only for basic profile and email, and can't read your Gmail or Drive. With two-factor authentication on, we keep what's needed to check your codes. Each sign-in records your IP address and which browser you used.

Your organisation. Its name and web address, your studio logo, client logos and names, invitations including the address invited, invite links, who has which role, upload limits, and the email domain you allow colleagues to join from, if you enable that.

Billing. When an owner or admin chooses a paid plan or trial, Stripe collects payment and billing details, including the billing address and any tax identification you provide. We store Stripe customer and subscription identifiers, plan and payment status, renewal/trial dates, capacity usage and billing-event identifiers to operate your subscription and reconcile payments. We do not store full card numbers or card security codes. Owners and admins can access invoices and update billing details through the Stripe-hosted billing portal. Stripe's handling of payment information is described in Stripe's Privacy Policy.

The images you upload, with their original filename, type, dimensions and size. Filenames are never changed: they're visible to everyone with project access and printed as captions in exported PDFs, so client-x-unreleased-campaign.jpg is shared by design. And we don't strip the information cameras embed in a photo — device, capture time, author, sometimes GPS coordinates — which travels with downloads and exports, including to whoever a link is forwarded to. Strip GPS before uploading if it matters.

Review activity. Markups and where they sit on the image, comment text, the author's name, their email where given, approvals, and when each happened — plus, for each client reviewing each project, the name they typed, the optional email and the date they arrived.

Support, bug reports and the waitlist. Your message, name and email, the page you were on, which browser you used, and an optional screenshot — which can hold anything that was on your screen, including other people's images. Signed in, it's also linked to your account, organisation and review; only the message is required. A waitlist entry is an address, an optional name and note, the page, and your browser. Email you send to legal@proofroom.app stays in our mailbox with whatever you put in it, including complaints about content and what we decided about them.

When someone else gave us your address. Sometimes we hold an email address because another person typed it in: a studio invited you to join its organisation, or someone replied to a comment on a thread you're part of. We got it from them, not from you. We use it to send that one invitation or notice, we don't put it on any list, and everything in §9 applies to it — write to legal@proofroom.app and we'll tell you where it came from, or take it out.

Keeping the service safe and working. We note the IP address behind password attempts, guest sign-ins, bug reports and waitlist signups — that's what stops someone guessing their way into a private project. Our hosting provider keeps technical records of requests and errors, which identify the project, review or image involved and, for email we send, the address it went to and its subject line; a waitlist signup puts your address in that subject.

4. Why we use it, and on what legal basis

In short: one line per purpose, and which hat we're wearing for it.

Where we rely on legitimate interests we've weighed them against your rights, and you can object at legal@proofroom.app. Where we rely on consent you can withdraw it at any time — email that same address and we'll stop, without affecting what we did before you asked.

5. What we store in your browser

In short: all of it needed for something you asked for. No tracking, no ads, no analytics.

Proofroom stores a small amount of data on your device, and every piece of it does a job you asked for: keeping a studio member signed in, remembering that a client got past a project's password, and linking a client to the feedback they leave. A studio member's sign-in lasts a month and renews itself for as long as they keep using Proofroom; a client's access to a project ends a month after they typed the password, whether or not they came back. None of it is shared with another website or follows you from one project to the next.

Your browser also remembers display preferences — tiles or a list, which rounds you last ticked in an export, whether the arrow keys switch between versions. Those never reach us, but the law covers anything kept on your device, so they're mentioned here.

Analytics: none. Advertising: none. Session recording: none. Third-party error monitoring: none. Our web fonts are served from our own domain. That's why there's no cookie banner — there is nothing non-essential to agree to. If that ever changes we'll ask for your consent before anything optional goes on your device, and this page will say so first.

6. Who else touches it

In short: our service providers, and the people your studio chooses.

That's the whole list; there's no separate sub-processor page. These providers operate internationally, so your data can be processed in the United States — §7 is what that means in practice. If we take on another provider, it appears on this list before it handles anything of yours.

Three details worth knowing. Images load into your browser directly from the provider that stores them, so it sees your IP address and browser whenever a gallery opens. Our email provider handles the content of a reply notification — the comment text and the writer's name — not just the address it goes to. And a studio member who signed in with Google has their profile picture fetched from Google on every page of the studio app.

Then there are people:

• Everyone in a studio's organisation can see its projects, whatever their role, and anyone given a project link — plus its password, if it has one — can see, mark up and export it.
• A bug report sent from inside a project goes to that studio's owners and admins: your name, email, the page you were on and the screenshot.
• A bug report sent from our public support page isn't attached to any studio, so it's visible to the owners and admins of every studio on Proofroom — same contents. Don't put anything confidential in one; use the form inside a project instead.

We may share data if the law requires it, to protect people from harm, or if the business is sold or merged — in which case we'll tell you. We don't sell your data, it doesn't go to ad networks, and your content is never used to train an AI model. Proofroom has no AI features today; if we add one that sends your content anywhere, it will be opt-in and described here first. The one thing we couldn't make optional is a model used purely to keep the service safe — spotting malware or illegal imagery — and we'd describe that here before switching it on.

7. Where it lives, and when it crosses a border

In short: we're a US company using US providers, so assume the United States is in the picture.

We won't tell you your data never leaves the EEA, because we can't. Here is what actually happens to it:

• Requests reach us through a global network, so your IP address, what you asked for and your browser's details are handled at the network location nearest you before the request is answered.
• Your images and everything we record about them sit with a single provider. This page doesn't claim a country for them; if we commit to one, we'll say so here.
• Email leaves with our email provider, carrying the comment text and the writer's name, not just an address.
• We are a US company, as are all four providers in §6. Wherever your data is stored, it is reached from the United States when we run and support the service.

The safeguards covering a transfer out of the EEA are in §6, and you can ask us about any of them at legal@proofroom.app.

8. How long we keep it

In short: we'd rather tell you what triggers a deletion than invent a schedule we don't run.

The law lets us give the criteria we use instead of a fixed period for everything, and that's the honest option here: almost nothing in Proofroom is deleted on a timer. It goes when someone deletes it.

Your content. Images, markups, comments and approvals stay until someone removes them. Delete an image and the feedback on it goes too; delete a review and its images go; delete a project and everything in it goes, including what we hold about the clients who reviewed it; delete an organisation and it takes its projects, files, logos and invitations. Archiving a project only hides it, and deleting a folder deletes nothing — whatever was inside moves up a level. Nothing is deleted for sitting idle — we don't clear out projects because they've gone quiet, and we'd say so here before we started.

One gap we'd rather name than hide. A small preview copy of a deleted image, or a logo you replaced, can linger in storage out of reach of the app until we remove it by hand — ask us and we will.

Your account lasts until you ask us to delete it. There's no self-service delete button yet: email legal@proofroom.app and we'll do it within the time §9 promises, after an export if you want one. If an account or agreement ends some other way, Terms §10 gives you 30 days to export before we remove the content. Canceling a paid subscription alone does not delete content. Billing records held by Stripe may be retained for payment, accounting and legal obligations.

Everything else. A studio member's sign-in lasts a month and renews while they keep using Proofroom; a client's access to a project ends a month after they typed the password. A shared image link stops working within the hour. Support messages, bug reports, their screenshots and waitlist entries have no expiry: marking one handled in our inbox hides it rather than removing it, so removal is something we do by hand — ask us and we'll do yours. The counts we keep against an IP address to slow down password guessing are ours, and they stay until we clear them out by hand. The technical records our hosting provider keeps expire on its schedule. And deleted data can survive in our database provider's routine backups until the backup holding it is rotated out.

9. Your rights, and how to use them

In short: email legal@proofroom.app. You don't need to write like a lawyer.

You can ask us for a copy of your data, to correct it, delete it, restrict or object to how we use it, receive it in a portable format, and to withdraw consent you've given. We answer within one month, free of charge; if a request is unusually complex we can take up to two months longer and will tell you inside the first month. We may ask you to confirm who you are. Nothing in Proofroom makes automated decisions about you, and we don't profile you: decisions about content under our Terms are made by people. If that ever changes we'll say so here, and in the reasons we give for the decision.

If you're a studio member, most of your data is already editable in the app. If you're a client, your feedback sits inside a studio's project and the studio controls it, so we'll usually pass your request on and make sure it's handled — a browser can't prove identity. If a studio doesn't respond, tell us: we'll chase them, and where the law requires us to act ourselves, we will. What we can't do is overrule a studio about its own data on request.

If you're in the United States, your state's law may use different words for the same things. In those words: we do not sell personal information, we do not share it for cross-context behavioural advertising, we don't use it for targeted advertising, and we don't use sensitive personal information beyond running the service — noting §3, where we admit we don't strip GPS coordinates out of uploaded images. What we hold maps onto the statutory categories as identifiers (name, email, account details), internet or network activity (IP address, browser, technical records), visual information (the images a studio uploads), and geolocation inside those. For the content in a studio's projects we act as that studio's service provider, on its instructions. You can ask to know, delete, correct and port, you can use an authorised agent where your state allows one, and we won't treat you differently for asking. If we turn a request down you can appeal: ask us to look again and we'll answer in writing with our reasons.

Come to us first if we've got something wrong — that's usually the quickest way to fix it. You can also complain to a data protection authority: the one where you live, the one where you work, or the one where you think the problem happened. In the United States, that's your state Attorney General.

10. How we protect it, and the limits we're honest about

In short: here's what's built, and here's what it can't do.

What's in place. Everything travels over HTTPS. Images are never left open to the public web; a link to one works for a while and then stops. Account passwords are stored so nobody can read them back, must meet a minimum strength, and can be backed by two-factor authentication. Project passwords are protected the same way, and changing one immediately cuts off everyone still using the old one. What each person can see and do follows their role, and every gallery listing and export is checked against it. Password attempts and public forms are limited, to slow anyone guessing. Review images must be JPEG or PNG — nothing that could carry a script. We hold no security certification and make no compliance claims. Report anything you find to legal@proofroom.app.

The limits, stated plainly:

• A project link and its password can be forwarded to anyone, a project without a password needs only the link, and anyone who can see an image can screenshot or export it.
• An image link already open in someone's browser keeps working for up to an hour after their access is taken away. Deleting the image stops it at once.
• We keep no record of who viewed which image, or of feedback that was deleted.
• The JPEG-and-PNG rule covers review images only: logo uploads and bug-report screenshots accept more formats, and both end up on pages people look at.
• Our limits on guessing aren't absolute: if we can't check them, we let the request through rather than lock everyone out.
• No system is perfectly secure. If something puts your data at risk we'll tell the studios affected without undue delay, so they can meet their own 72-hour deadline. Telling the reviewers in a studio's projects is the studio's job, and we'll give it what it needs.

11. Email we send

In short: all of it transactional, and clients get none unless they typed an address.

Transactional email keeps the product working, so it carries no unsubscribe link: verification when you sign up; invitations, sent to the address the inviter typed; "someone joined" notices to owners and admins, with the new member's name and email; and reply notifications to anyone on a thread who left an address, carrying the replier's name, the review name, the text of the comment and a link to the project. To stop those, leave the email field blank when you enter a project, or ask as described in §2.

We send no marketing email, and we run no mailing list. The waitlist works the other way round: joining it emails us what you submitted — address, name and note as you typed them — so we know someone is interested. If we ever start sending product news it will be because you opted in, and every message will carry a one-click unsubscribe link. Studios: if you collect an address from a client, make sure they know it will be used this way.

12. Children, and people in the pictures

In short: two different questions, and only one is about who signs up.

People who use Proofroom. It's a tool for professionals, and our Terms require you to be at least 18. We don't ask your age at signup, so we have no way to spot a younger account ourselves. We don't knowingly collect personal information from children under 13, and if we find out we have, we delete it and close the account. If you think a child has an account here, or is leaving feedback in a project, tell us at legal@proofroom.app.

People shown in images. A studio can upload photographs of anyone, including children, and we have no way to know when it has. The studio is the controller for that content: it's its job to have a lawful basis for photographing and sharing the images, to hold any release required, and to decide who gets a link — our Terms ask it to confirm that before uploading. The same applies to images showing what the law treats as sensitive, such as health, ethnicity, religious dress or political affiliation. If you believe an image shouldn't be in a Proofroom project, tell the studio, and tell us at legal@proofroom.app if you can't reach them or they won't act.

13. Changes, and how to contact us

We'll update this page as Proofroom changes, and the version you're reading is always the one in force. Small edits go in quietly. Anything material — a new purpose for your data, a new kind of recipient — we'll set out at the top of this page before it takes effect. We won't treat carrying on using Proofroom as agreement to a change that needs your consent; we'll ask.

Privacy questions, data requests, security reports and everything else go to legal@proofroom.app. That address reaches the people responsible for this policy, and it's the right place to start whether you're a studio, a client who reviewed something, or someone who appears in an image.