FXProof Privacy Policy
Version: 2026-09-08
Effective date: 2026-09-08
This Privacy Policy explains what personal data FXProof processes, for which purposes and legal bases, who may receive it, how long it is kept, and how you can exercise privacy rights. It is written with GDPR, UK GDPR, PIPEDA, CASL, and applicable US privacy rules, including CCPA/CPRA for California residents where those rules apply, in mind.
On this page
- Privacy requests
- Processors and recipients
- Retention matrix
- California privacy rights
- EU and UK representatives
- B2B DPA and security package
1. Who we are and how to contact us
Controller: FXProof LLP (Republic of Kazakhstan).
BIN: 250840007747.
Registered address: Republic of Kazakhstan, Astana, Beibitshilik St. 25.
Actual address: Republic of Kazakhstan, Astana, Beibitshilik St. 25, office 114.
Privacy contact: privacy@fxproof.org.
2. Information we collect
- Account data: name, email, password hash, country, language, preferences, authentication records, and account state.
- Payment and billing data: provider order or transaction identifiers, subscription or entitlement state, billing status, amount, currency, and provider event metadata. FXProof does not store full card data.
- Service use data: API token metadata, request metadata, IP address, user agent, timestamps, rate-limit and quota counters.
- Proof request data: parameters used to create, open, or verify a Proof Bundle, such as source, dataset, selected date, document id, payload hash, source URL, verification metadata, and generated proof files.
- Communications: support requests, privacy requests, billing questions, email subscriptions, and notification settings.
- Cookies and similar technologies: necessary session, security, checkout, and consent storage, plus optional Analytics or Advertising measurement technologies only where enabled and allowed.
FXProof does not seek to collect special-category data or children's data.
3. How we use information and legal bases
- Performance of contract: registration, authentication, proof generation, proof bundle access, public verification, billing, support, and account workflows.
- Legitimate interests: security, fraud prevention, abuse prevention, service reliability, product improvement, and proof/evidence workflow integrity, subject to minimisation and proportionality.
- Legal obligations: tax, accounting, corporate records, sanctions/export checks where applicable, regulator responses, and lawful authority requests.
- Consent: optional Analytics and Advertising measurement cookies or tags, marketing emails where consent is required, and other consent-based processing.
Where CCPA/CPRA applies, personal information is used for the business purposes described in this Policy. FXProof does not sell personal data. FXProof does not share personal data for cross-context behavioral advertising without providing and honoring the required opt-out.
4. Cookies and optional measurement
Necessary cookies and browser storage support secure sessions, forms, authentication, checkout and cookie choices. These functions remain available when optional measurement is refused. Public-page request totals are operational counts of requests, not unique visitors or browser sessions; they contain only a UTC day, a fixed page group and an HTTP status class. They do not use a visitor identifier or link requests to an account or advertising source.
Optional measurement is off until you make a current choice. Analytics allows Google Analytics 4 to measure permitted site events. Advertising measurement separately allows FXProof to remember the first permitted Google campaign observed before registration and relate it to registration, first access to your own proof and confirmed payments. A later campaign does not replace that first source. This choice does not permit personalized advertising, remarketing lists or Customer Match.
With Analytics alone, advertising storage, advertising user data and personalization remain denied; FXProof does not retain a personal campaign link or export a purchase to Google. With Advertising measurement alone, FXProof can measure that source locally, but does not load Google Analytics or send events to Google. Only both choices together permit valid Google click parameters on a public landing page and server-side purchase measurement using a browser-observed Google client and session identifier. No Google requests or optional measurement identifiers are created before a choice or after rejecting both categories.
You can accept, reject or change these choices using Cookie settings in the footer, including on login, account and checkout pages. Global Privacy Control (GPC) prevents Advertising measurement while it is active. A choice for an older purpose version does not authorize these new purposes. A new explicit choice is required after withdrawal or expiry; FXProof does not reconstruct a lost source from an email address, IP address or fingerprint.
Withdrawal stops optional browser processing immediately. A successfully saved withdrawal also stops the corresponding server processing and cancels pending purchase exports across the signed-in account. A server-save error is shown in the interface: local preferences have changed, but server withdrawal is not yet confirmed and must be retried. Previously sent Google data is not automatically recalled; contact privacy@fxproof.org for an applicable deletion request. Withdrawal does not invalidate earlier lawful processing or remove necessary payment, proof or consent evidence.
FXProof keeps a separate tamper-evident consent journal recording the selected categories, previous categories, notice and policy versions, safe page path and referrer category, IP address, user agent, GPC/DNT signals, request reference and record hashes. This journal proves choices and is not used as advertising history. Account permission state enforces withdrawals. The browser receives an opaque protected measurement cookie only after Advertising measurement is allowed; it contains no campaign or account details.
| Category | Recipient | Purpose | Duration |
|---|---|---|---|
| Necessary | FXProof | Security, requested service, choices and consent evidence. | Session or the applicable service/evidence retention period. |
| Analytics | Google when enabled and allowed | Permitted usage events; no advertising permission from this choice alone. | Provider retention and cookie controls; local withdrawal stops further collection. |
| Advertising measurement | FXProof; Google purchase measurement only with both choices | First permitted campaign and measured business outcomes; no personalization or remarketing. | Acquisition window up to 30 days; personal links up to 90 days from first observation, without renewal on later visits; shorter Google delivery limits apply. |
5. Marketing and CASL
FXProof sends commercial emails only with a proper legal basis. Each message identifies the sender and includes an opt-out method where required; opt-outs are honored within 10 business days where CASL applies.
6. International transfers
Hosting and access. The production application and primary database are hosted in France. Backups are stored in the European Union. FXProof LLP is established in Kazakhstan; authorized personnel may access data to provide the service. Optional Google services and the owner's configured ChatGPT service may involve processing outside the EEA. Hosting in France or consent to measurement does not by itself provide a legal mechanism for an international transfer.
EU and UK transfers. Where providers are certified under an available data transfer framework, FXProof may rely on that framework. Otherwise, FXProof may use standard contractual clauses, the UK International Data Transfer Addendum or IDTA, and supplementary measures as appropriate.
Canada, US, and other countries. Equivalent contractual and technical measures apply where required.
7. Processors and recipients
FXProof uses a limited set of processors and recipients to run the service. Exact provider names may depend on the active deployment, payment configuration, and optional tools enabled. Where a provider is confirmed in the product flow, it is named below.
| Processor or recipient category | Purpose | Data involved | Safeguards |
|---|---|---|---|
| FXProof personnel and contractors | Operate the service, support users, investigate abuse, maintain proof/evidence workflow. | Account, proof request, support, billing status, and operational metadata as needed. | Least-privilege access, confidentiality duties, access review, and logging. |
| Hosting/runtime infrastructure provider | Run the web application, database, queues, cache, sessions, and logs. | Account, service use, proof request metadata, and operational logs. | Contractual controls, access controls, encryption in transit, and infrastructure security controls. |
| File storage provider | Store generated proof PDFs, signed files, proof bundles, source-capture artifacts, and related metadata. | Proof files, source files, hashes, document ids, and storage metadata. | Access controls, signed access paths, storage isolation, and transfer safeguards. |
| Configured email provider | Deliver account, support, billing, and service emails. | Email address, message metadata, and message content required for delivery. | Transport security, provider contractual controls, and data minimisation. |
| Paddle when Paddle processes an order | Merchant of Record checkout, payment processing, receipts, tax/VAT, billing communications, and refund/payment support. | Buyer details, payment status, order/subscription identifiers, and billing events. FXProof does not store full card data. | Provider terms, payment security controls, and minimised service-side records. |
| Google Analytics 4 when enabled and allowed | Permitted usage events after Analytics consent; purchase measurement only after both choices. | Google client/session identifiers, safe page groups and events. A purchase contains an opaque transaction reference, confirmed amount, currency, time and permitted product category. FXProof excludes email, account and payment identifiers, proof contents, document ids/hashes, API keys and raw URLs. | Separate consent controls, restricted payload, short local identifier retention and applicable provider terms. |
| Google advertising measurement when enabled and allowed | Campaign and conversion measurement; no personalized advertising, remarketing lists or Customer Match. | Valid click parameters on public landing pages only when both choices are allowed; consent signals. FXProof locally retains the first permitted campaign identifier for the limited acquisition purpose. | Advertising measurement choice, GPC enforcement, minimisation and applicable transfer safeguards. |
| Configured ChatGPT service used by the FXProof owner | Private business analysis of aggregate traffic, cohorts and confirmed sales. | Fixed aggregate reports checked for small groups and revealing complements; no user rows, click/client IDs, proof contents, payment references or raw logs. | Authenticated read-only access, minimum group protection and the applicable service terms and transfer controls. |
| Operational monitoring, security, and audit tooling | Structured logs, payment event reconciliation, operational alerts, cookie consent audit, financial audit, and security review. | Event metadata, IP/user agent where needed, correlation ids, alert state, and audit hashes. | Separate log scopes, retention controls, tamper-evident consent audit, and least-privilege access. |
| Professional advisers, banks, tax/accounting providers, regulators, and lawful authorities | Legal, tax, accounting, dispute, compliance, fraud prevention, and regulator responses. | Only data needed for the specific legal or operational purpose. | Legal basis review, minimisation, confidentiality, or statutory duties. |
Third-party websites and payment-provider pages have their own privacy notices. FXProof does not control those external practices.
8. Retention
FXProof keeps personal data only as long as needed for service delivery, proof/evidence integrity, customer access, legal claims, tax/accounting duties, security, fraud prevention, regulatory duties, and backup/restore needs. Archive access in a plan controls how far back a user may search or open bundles; it is separate from legal and operational retention.
| Category | Examples | Period or criteria | Start event | Deletion limitation |
|---|---|---|---|---|
| Account and authentication data | User profile, email, password hash, account status, preferences, API token metadata. | While the account is active, then as needed for legal claims, tax/accounting, security, and fraud-prevention purposes. | Account creation or last account activity. | Deletion may be limited where proof/evidence, billing, audit, or legal records must remain. |
| Billing and payment state | Provider order ids, subscription state, entitlement state, billing status, amount, currency, and provider events. | As required for contract performance, tax/accounting, payment disputes, fraud prevention, and statutory limitation periods. | Payment, order, subscription, or provider event. | Full card data is handled by the payment provider and is not stored by FXProof. |
| Proof artifacts and metadata | Signed PDFs, proof bundles, source files, document ids, payload hashes, source URLs, verification metadata. | By default at least 10 years, unless law, plan, storage contract, proof-integrity requirement, or legal hold requires a different period. | Proof generation, bundle opening, or verification event. | Deletion requests may not remove records needed to preserve verification, legal, tax, or dispute integrity. |
| Download and API usage records | Download events, endpoint use, dataset/date context, daily counters, IP address, user agent where needed. | Used for quotas, abuse prevention, security, and operational reporting. No automatic deletion schedule is currently promised for this category. | API request, Web lookup, or file download. | Records may be aggregated, minimised, or retained where needed for security, billing, or dispute reasons. |
| Operational alerts and security logs | Alert type, severity, source, fingerprint, subject reference, security events, runtime errors. | Open alerts are kept while investigation is needed. No automatic deletion schedule is currently promised for this category. | Alert or security event creation, update, or resolution. | Security and abuse-prevention needs may delay deletion or require anonymisation instead. |
| Cookie consent audit records | Consent categories, previous categories, versions, path/referrer host, IP, user agent, GPC/DNT, request id, hash chain. | Default 10 years for consent evidence unless law or legal hold requires a different period. | Consent choice or change. | Consent evidence is kept separately from optional analytics and may be retained to prove compliance. |
| Support and privacy correspondence | Support emails, privacy requests, verification correspondence, complaint handling. | For the time needed to handle the request, then for legal claims, compliance evidence, and dispute limitation periods. | Message receipt or case close. | Identity documents are minimised and requested only when needed for verification. |
| Backups and disaster recovery copies | Database, file, and system backups or snapshots. | According to backup schedule, restore needs, and legal hold requirements. | Backup creation. | Deletion from live systems may not immediately remove data from rotating backups. Before restored optional measurement can resume, current prohibitions and expiry must be enforced. If newer consent evidence cannot be proven complete, restored optional grants are invalidated, old exports cancelled and a new choice is required. |
| Optional acquisition links | First permitted source/campaign, observation time, registration and protected account link. | Registration must occur within 30 days of observation; personal links expire no later than 90 days from first observation. Later visits do not extend this limit. | First permitted observation. | Withdrawal excludes the link immediately after server confirmation; scheduled cleanup removes revoked or expired links within 24 hours. |
| Google purchase delivery | Browser-observed client/session identifiers, opaque transaction identity and delivery state. | A delivery attempt is allowed for at most 72 hours after payment and only within shorter applicable Google session/join limits. Local personal measurement records never exceed 90 days. | Original observation or payment event, as applicable. | Withdrawal cancels unsent events and removes the identifiers. Previously delivered data requires the applicable provider deletion process. |
| Protected measurement aggregates | UTC request totals and fixed cohort totals with a common numerator/denominator cutoff. | Up to 400 days from the aggregate day. | Aggregate day. | Only aggregates passing small-group and complement checks remain; they contain no personal source links and are not recomputed to expose a removed individual. |
9. Security
FXProof applies organisational and technical measures appropriate to the service and data involved: encryption in transit, role-based and least-privilege access, environment separation, structured logs, audit trails, backup controls, provider due diligence, payment-provider webhook verification, proof bundle access controls, and operational monitoring. No method is absolute, but FXProof regularly assesses risks and improves safeguards.
10. Privacy and data protection requests
You may contact FXProof at privacy@fxproof.org to exercise privacy and data protection rights that may apply to you, including access, correction, deletion, restriction, objection, portability, consent withdrawal, California privacy rights, and other privacy-related questions. You do not need a paid plan to submit a privacy request.
Please include the right you want to exercise, the email address or account involved, your jurisdiction if known, and enough context for us to locate the relevant records. Do not send sensitive documents unless we ask for them.
FXProof verifies identity in a way that is proportionate to the request and the risk. It may ask you to confirm control of the account email, provide additional information that matches account records, or, for an authorized agent, provide proof of authority. Verification information is not used for a new unrelated purpose.
For GDPR/UK GDPR requests, FXProof aims to respond within one month after receiving the request. If the request is complex or you submit several requests, the response period may be extended by up to two additional months and FXProof will explain why. For California requests where CCPA/CPRA applies, FXProof aims to respond within 45 days and may use the legally available extension when necessary.
If FXProof cannot fully fulfill a request, it will explain the reason, such as legal retention duties, proof/evidence integrity, tax or accounting obligations, security needs, rights of other people, or a request that is manifestly unfounded or excessive. You may ask FXProof to review the response. You may also contact the regulator listed in the Regulators section below.
11. California privacy rights
Where CCPA/CPRA applies, California residents may request to know/access, delete, correct, opt out of sale or sharing, limit use or disclosure of sensitive personal information, and avoid discrimination for exercising these rights.
FXProof does not sell personal data. FXProof does not share personal data for cross-context behavioral advertising without providing and honoring the required opt-out. Optional Advertising measurement technologies are off by default, require separate consent, and are kept off when a browser sends a recognized GPC signal. If California opt-out rules apply to a request, FXProof aims to honor the opt-out as soon as practicable and no later than required by law.
Submit California privacy requests through privacy@fxproof.org. If an account workflow is available, you may also use the account contact/support path, but email remains available. FXProof may verify your identity and, for authorized agents, request proof of authority. FXProof will explain its response and any legal reason that prevents full fulfillment.
FXProof does not use sensitive personal information to infer characteristics and does not seek to collect sensitive personal information for the proof workflow.
12. EU and UK data protection representatives
FXProof does not currently have an appointed representative in the European Union under Article 27 GDPR.
Privacy-related questions, data protection requests, and supervisory authority communications may be sent directly to FXProof at privacy@fxproof.org.
If representative details are required to be published or an EU representative is appointed, this Privacy Policy will be updated with the representative's name, postal address, and contact details.
FXProof has not currently published details of an appointed UK GDPR representative. UK privacy-related questions, data protection requests, and supervisory authority communications may be sent directly to FXProof at privacy@fxproof.org.
13. B2B DPA and security package
B2B customers and procurement/security reviewers can use this public section as a starting security and privacy package. For a countersigned DPA, security questionnaire, or subprocessor update request, contact privacy@fxproof.org and include your company name, account email, intended use, and required review deadline.
- This Privacy Policy, including processors and recipients, retention, international transfers, security, and privacy request workflow.
- Terms of Service, including electronic notices, proof/evidence workflow, and regional terms.
- Refund Policy, including checkout, provider receipt, and consumer-rights references.
- Disclaimer, including the scope of FXProof as a proof/evidence service, not a trading, money-transfer, or investment service.
- Public proof verification by document id and payload hash.
- Security and privacy contact: privacy@fxproof.org.
FXProof processes customer account, proof request, proof artifact, usage, and support data only to provide the service and related support; uses subprocessors and recipients listed above; applies transfer safeguards where needed; uses least-privilege access and audit controls; does not store full card data; and does not use proof contents for advertising.
14. Consumer digital rights and checkout evidence
Paid checkout is handled by the configured payment provider when active. For Paddle-processed orders, Paddle acts as Merchant of Record for checkout, payment processing, receipts, tax/VAT handling, and certain billing emails. FXProof provides and supports the proof/evidence service itself.
FXProof keeps payment-provider event records and account entitlement state after verified provider events are processed. Provider receipts, cancellation/refund handling, and mandatory consumer-rights information are described in the Refund Policy and Terms of Service. FXProof does not claim a separate checkout checkbox or separate email receipt flow unless that flow is actually implemented and visible in the product.
15. Automated decisions
FXProof does not make decisions producing legal effects based solely on automated processing without human involvement. Anti-fraud, rate-limit, quota, checkout-risk, and security systems may use automated rules; you may request human review when a rule materially affects your access or request.
16. Children
The Service is not intended for children under the applicable age of consent. FXProof does not knowingly collect such data; if discovered, FXProof will delete it and close access where appropriate.
17. Changes to this Policy
FXProof may update this Policy. Material changes will be announced via the interface or email where required or appropriate. The effective date is shown at the top.
18. Regulators
- EU: your local supervisory authority.
- UK: Information Commissioner's Office (ICO).
- Canada: Office of the Privacy Commissioner of Canada.
- California: California Privacy Protection Agency / Attorney General.
19. Legal notes
GDPR/UK GDPR relate to lawfulness, transparency, data-subject rights, processors/recipients, and international transfers. ePrivacy relates to cookies and consent. DPF, UK-US Data Bridge, standard contractual clauses, IDTA, and similar tools may support transfers where applicable. PIPEDA/CASL relate to fair information principles and commercial messages. CCPA/CPRA relates to California residents' rights where applicable.
20. Languages
This Policy may be available in several languages. If versions differ, the English version prevails.
Contact: privacy@fxproof.org.