Privacy Policy

This is the English-language Privacy Policy for ProofAware. A German-language Datenschutz notice is also available at /datenschutz.

The data controller is:

Badr Mouslik
Am Bach 2a
78247 Hilzingen
Germany
Email: hello@proofaware.com

This policy covers personal data we process through the ProofAware website (proofaware.com), the managed EU Cloud service, and our sales and support communications.

We process: (a) contact and account data you provide (such as name, email, company, Workspace details); (b) content you submit to the Service, including training assignments and completion records; (c) communications such as demo or support requests; and (d) technical data such as logs and limited usage information needed to operate and secure the Service.

We process personal data to provide and secure the Service, to respond to your requests, and to comply with legal obligations. We do not process card payments today. Depending on the activity, the legal basis under the GDPR is performance of a contract (Art. 6(1)(b)), our legitimate interests (Art. 6(1)(f)), consent (Art. 6(1)(a)), or a legal obligation (Art. 6(1)(c)).

There is no live checkout and no Paddle payment flow today. Early paid pilots may be invoiced directly by the Provider. When self-serve billing is available and Paddle seller verification has succeeded, paid subscriptions will be sold by Paddle.com Market Limited ("Paddle") as Merchant of Record. You would then provide payment details to Paddle, not to ProofAware. Paddle would process that data as an independent controller under its own privacy policy. We will update this notice before that flow goes live. We do not operate a newsletter.

The marketing website (proofaware.com) is served via Cloudflare Pages. The managed Cloud service (web.proofaware.com) is hosted on Hetzner in Germany (EU data residency), including object storage for files and backups. We use only the processors that actually run the Service:

• Cloudflare — website hosting, CDN, and delivery logs
• Hetzner / Dokploy — application compute, database, object storage
• Resend — transactional email (sign-in links, invites, reminders)
• PostHog EU Cloud — privacy-friendly analytics and feature flags
• Sentry (de.sentry.io) — error monitoring
• Better Stack — uptime and heartbeat monitoring
• Inngest Cloud — background jobs (reminders, scheduled workflows)

Microsoft Entra is used only if a customer connects it for sign-in. Paddle is not a current processor. We do not use a newsletter or marketing-automation vendor.

We use PostHog for privacy-friendly website analytics on proofaware.com. We collect only aggregate, non-identifying usage data - such as page views and clicks on calls-to-action - to understand traffic sources and improve the site. PostHog runs on EU Cloud (data processed in the EU) and acts as our processor under a data processing agreement.

Our analytics is cookieless and stores nothing on your device (PostHog is configured with in-memory persistence, with autocapture and session recording disabled). Because no information is stored on or read from your device, the consent requirement (Art. 5(3) ePrivacy Directive / Section 25 TDDDG) does not apply and no cookie banner is shown. We do not capture personal data, do not identify visitors, and IP addresses are discarded. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in measuring and improving the site. Events stay in PostHog EU Cloud only as long as needed for that purpose. You may object by emailing hello@proofaware.com (Art. 21 GDPR).

We keep personal data only as long as necessary for the purposes described here or as required by law, after which it is deleted or anonymized.

Under the GDPR you may have rights to access, rectification, erasure, restriction, data portability, and objection, and to withdraw consent at any time. You also have the right to lodge a complaint with a competent supervisory authority. To exercise your rights, contact us at the address below.

Where we process personal data on behalf of a business customer (for example, your employees' training records in the Cloud), we act as a processor and the customer is the controller.

We may update this Privacy Policy from time to time. The "last updated" date above reflects the latest version.

Privacy enquiries: hello@proofaware.com