Privacy policy

Draft for legal review. Version 2026-10-draft-1, effective 19 October 2026. Counsel review for the launch markets, the EU representative appointment and the Standard Contractual Clauses are pending.

1. Who we are

The controller of personal data processed through ProvenReel is Start Learn LLC, Limited liability company (Wyoming, USA), 3402, 1603 Capitol Avenue, Suite 413A, Cheyenne, WY 82001, United States of America, trading as ProvenReel. Privacy contact: hello@provenreel.com. EU representative under Article 27 GDPR: [EU representative (Art. 27 GDPR) — to be confirmed by the founder]. UK representative: [UK representative — to be confirmed by the founder].

Where a brand uses the platform to manage its own creator relationships (for example its CRM contacts or brand-kit approvals), that brand is the controller of those records and ProvenReel is its processor under the data processing agreement.

2. What we collect

• Account data: name, email address, password hash, interface language, timezone, two-factor settings, passkeys, sessions and login events.
• Organization and workspace data: organization and brand details, memberships and roles, invitations, brand kits, products, claims libraries, encrypted product-access instructions.
• Creator profile data: the profile you publish (channels, languages, audience description, availability), self-declared social identities, verification checks and the evidence you upload for them, badges.
• Collaboration data: briefs, applications, offers, agreements, deliverables and their versions, review comments, publication evidence, licences, cases and appeals, reviews.
• Messages and files: conversations, attachments and private notes, scanned for malware on upload.
• Money data (when payments are enabled): payment and payout records, fee snapshots, ledger entries, invoices; bank and identity details are collected by the payment provider, not by us.
• Attribution data (with consent): referral-link click identifiers, promo-code usage, conversion events imported from connected stores or apps.
• Consent, request and audit records: policy acceptances with version and hashed IP, cookie choices, data requests, audit events with actor id.
• Technical data: hashed IP addresses, user agent, correlation ids, diagnostic logs with secrets and emails redacted.
• Contact form messages from the public site.

We do not collect special categories of data on purpose; do not put health information, identity documents or card numbers in messages or uploads unless a feature explicitly asks for it.

3. Why we process it and on what legal basis

Purpose	Legal basis (GDPR Art. 6)
Creating and running your account and workspaces, matching, applications, agreements, messaging, content review, payouts	Performance of a contract (Art. 6(1)(b))
Security, fraud detection, abuse prevention, audit trails, backups	Legitimate interest (Art. 6(1)(f)) in keeping the platform and its members safe
Verification badges and double-blind reviews	Legitimate interest in a trustworthy marketplace; contract for the parties concerned
Financial record-keeping, tax and regulatory reporting, responding to lawful requests	Legal obligation (Art. 6(1)(c))
Referral-click identifiers, optional cookies, marketing emails	Consent (Art. 6(1)(a)), withdrawable at any time
AI drafting assistance (only when enabled by the founder and requested by you)	Contract / legitimate interest; the text you submit is processed by the AI provider listed below
Service emails about your account, agreements and security	Contract; you can tune non-essential categories in notification preferences

We do not sell personal data, do not run advertising trackers on this site and do not make decisions with legal or similarly significant effects by automated means alone: fraud rules only flag, a human decides.

4. Who can see your data

• Members of your own organization, according to their role.
• The counterpart in a collaboration, for what you share in it: a brand sees your public profile, application, deliverables and messages; a creator sees the brief, the brand members in the thread and the agreement.
• Our operations team for support, review, dispute handling and trust & safety, through masked views and time-limited, audited access grants you can revoke.
• Processors that run the service for us, listed in section 9.
• Authorities when the law requires it, and professional advisers under confidentiality.

Private notes, other brands' data and your payout details are never shown to counterparts.

5. International transfers

ProvenReel is operated from the United States and hosted on infrastructure in the United States (region to be fixed at deployment). Personal data of people in the EU/EEA, the UK and Switzerland is therefore transferred to the United States. We rely on the Standard Contractual Clauses adopted by the European Commission (Module 1 controller-to-controller and Module 2 controller-to-processor as applicable), supplemented by a transfer impact assessment — placeholder: the clauses are being prepared with counsel and will be referenced here — and, where a processor is certified, on the EU–US Data Privacy Framework. You can request a copy of the safeguards in place from hello@provenreel.com.

6. How long we keep it

Periods below are proposals from our retention policy (config/retention.php); counsel review per market is pending. Account data is kept for the life of the account; after deletion we anonymise within 30 days and backups age out under the backup retention.

Data	Period	Status
Temporary files and data exports	7 days	proposal
Incomplete uploads	7 days	proposal
Diagnostic logs	30 days	proposal
Security audit events	365 days	proposal
Contact form messages	365 days	proposal
Financial records	10 years	statutory — confirm per contracting entity (D01, D07)
Contractual records	5 years	statutory — confirm per launch market
Consent records	5 years	proposal
Newsletter and e-mail series delivery logs	365 days	proposal

Financial and contractual records are retained for the statutory period even after account deletion; the request outcome lists exactly which records are kept, in anonymised form.

7. Your rights

Depending on where you live you can: access and export your data, rectify it, request deletion, restrict or object to processing based on legitimate interest, withdraw consent at any time without affecting prior processing, obtain portability, and lodge a complaint with your supervisory authority (for the EU, the authority of your country of residence; for the UK, the ICO).

Use Settings → Privacy to export or delete your data; requests are verified with your password and answered within 30 days. Without an account, write to hello@provenreel.com. We never discriminate against you for exercising a right.

8. California and other US state privacy rights (CCPA/CPRA notice)

If you are a California resident: in the preceding 12 months we collected the categories of personal information listed in section 2 (identifiers, commercial information, internet activity, professional information, audio/visual content you upload, inferences limited to matching) for the business purposes in section 3. We do not sell personal information and do not share it for cross-context behavioural advertising; we do not use or disclose sensitive personal information for purposes requiring a right to limit. You have the right to know, delete, correct, port, and to non-discrimination; exercise them from Settings → Privacy or at hello@provenreel.com. We honour Global Privacy Control signals as an opt-out of any future sale or sharing. An authorised agent may act for you with written permission. Residents of Virginia, Colorado, Connecticut, Utah and other states with comparable laws have similar rights, exercised the same way.

9. Processors and sub-processors

Processor	Purpose	Data	Location	Transfer safeguard	Status
Laravel Cloud (Laravel LLC) on Amazon Web Services	Hosting and infrastructure	all platform data	United States (region to confirm at deployment, D20)	EU Standard Contractual Clauses (to be executed — placeholder)	In use
Postmark (ActiveCampaign, LLC)	Transactional email	email address, name, message content	United States	EU Standard Contractual Clauses (to be executed — placeholder)	In use
Stripe, Inc.	Payments and payouts	payment and payout details, identity data collected by Stripe	United States / EU (Stripe Payments Europe Ltd)	EU Standard Contractual Clauses (to be executed — placeholder)	In use
PayPal (placeholder — not integrated)	Payments and payouts	payout details	United States / Luxembourg	EU Standard Contractual Clauses (to be executed — placeholder)	Not in use
Shopify Inc. (optional, per brand connection)	Commerce connector (per brand)	order and refund events of the connected store	Canada / United States	EU adequacy decision (Canada)	Not in use
Anthropic, PBC (only when AI assistance is enabled)	AI drafting assistance	text of briefs, messages and profiles sent for drafting	United States	EU Standard Contractual Clauses (to be executed — placeholder)	Not in use
Postmark (ActiveCampaign, LLC) — broadcast message stream	Marketing e-mail (newsletters and e-mail series, consent-based)	email address, first name, language, delivery/bounce/complaint events (open/click only if tracking is enabled)	United States	EU Standard Contractual Clauses (to be executed — placeholder)	In use
Founder CRM (Brevo — to confirm)	Customer relationship management	contact name, email, relationship notes	European Union	Processing in the EU	Not in use

We will update this list before adding a processor; brands under the DPA are notified in advance and may object.

10. Cookies

We set essential cookies only by default. Functional, analytics and marketing/attribution cookies are set only after you accept them in the consent manager, which you can reopen from "Cookie settings" in the footer. Details are in the cookie policy.

11. Children

ProvenReel is for adults: you must be 18 or older to hold an account. We do not knowingly collect data from children under 16 (or the age set by your country). If you believe a child has created an account, contact hello@provenreel.com and we will delete it.

12. Security

Data is encrypted in transit and at rest; provider credentials and product-access instructions are encrypted with keys we hold; access is role-based, operator access requires two-factor authentication and is logged; uploads are malware-scanned; logs are redacted. No system is perfectly secure: report security concerns to hello@provenreel.com.

13. Changes

We publish every version of this policy with its date. Material changes are announced in the workspace and, when required, you will be asked to confirm the new version before continuing.

14. Contact

Start Learn LLC, 3402, 1603 Capitol Avenue, Suite 413A, Cheyenne, WY 82001, United States of America — hello@provenreel.com.