Privacy statement

1 · Who is responsible

PROVENA B.V., Keizersgracht 241, 1016 EA Amsterdam, is the controller for data about visitors to this site and about account holders. For asset data processed on behalf of a customer we act as processor, governed by the data processing agreement.

2 · What we hold, and for how long

Ledger entries are the one category we cannot delete on request while an account is active: an append-only record that can be edited is not evidence. They contain hashes and identifiers, not asset content, and are removed with the workspace.

3 · What we deliberately do not do

• ✗No advertising or marketing cookies, on any page
• ✗No third-party analytics; aggregate request counts only, no visitor identifiers
• ✗No storage of files submitted to the public verification tool
• ✗No training of models on customer assets, ever, under any plan
• ✗No sale or sharing of personal data with anyone

4 · Your rights

You may request access, correction, deletion, restriction, portability or object to processing. Write to [email protected]; we answer within 30 days and usually within five working days. You can lodge a complaint with the Autoriteit Persoonsgegevens or your local supervisory authority.

5 · Security and breach notification

Encryption in transit and at rest, enforced two-factor authentication, role separation for signing operations, append-only audit logging. If a breach affects your data we notify you within 72 hours with what we know at that point, and update as we learn more.

6 · Changes

Material changes are announced 30 days ahead by email to account holders and on this page. The previous version stays available on request.