Privacy policy

Last updated: 13 November 2026 · Controller: Hardnetics LLP, India.

1. Scope

This policy describes how ContractProof QA handles personal data when you visit this website, request a pilot, or use the application on behalf of a customer organization.

2. Data we handle

• Account data: name, email, role, authentication metadata and MFA factor status.
• Workspace data: customer and site names, checklists, inspections, answers, corrective actions and audit events.
• Evidence: photos and documents uploaded by authorized users, including images that may incidentally show people or premises.
• Technical data: sanitized application errors, IP-derived hashes for share-link abuse prevention, and request metadata.

3. Why we use it

To provide the service, authenticate users, enforce tenant access, generate reports, send transactional messages, prevent abuse, maintain backups, and meet legal obligations. We do not sell personal data or use it for advertising.

4. Roles

For workspace content, the customer organization is the controller and Hardnetics LLP acts as processor. For account and website data, Hardnetics LLP acts as controller. A data processing agreement is available for pilots.

5. Subprocessors

Supabase (database, auth, storage; Singapore), Cloudflare (hosting, compute, backup storage; global), and Resend (transactional email; United States, being configured). A current list is maintained in the DPA.

6. Retention

Workspace records are retained while the organization is active and according to the customer’s retention settings and legal holds. Share links expire by policy. Backups are retained on a short rolling schedule. A legally reviewed retention and deletion schedule is being finalized; irreversible purge is not currently automated.

7. Your choices

Depending on your role and jurisdiction, you may request access, correction, export or deletion of personal data. Workspace owners can export their workspace. Account deletion removes access and preserves the historical user identifier needed for business records. Some records may be retained to meet legal or contractual obligations.

8. Security

Tenant isolation is enforced in the database. Privileged roles require MFA. Evidence is stored privately. Backups are encrypted. No system is perfectly secure; report suspected issues through the contact page.

9. International transfers

Data may be processed outside your country by the subprocessors listed above. Appropriate contractual safeguards are being finalized with counsel.

10. Children

The service is for business use and is not directed at children.

11. Changes and contact

Material changes will be posted here. Questions: use the contact page or write to the address provided in your pilot agreement.