Provaex — Privacy Policy

Applies to provaex.com, the dashboard, and the test-execution API.

What we collect

• Account data: name, email, organization name — provided at signup.
• Endpoint data: the target URL you add, its verification status, and

which environment (production or staging) you've labeled it.

• Test data: prompts sent during a run and the raw responses

received, stored so your report can be regenerated and so you have

an audit trail of what was actually tested.

• Billing data: handled by Stripe directly — we store your Stripe

customer ID and subscription status, not your card details.

What we don't collect

We don't store API keys or credentials for your target system beyond

what's strictly needed to run a test you've authorized, and never for

an unverified endpoint — see the Rules of Engagement for what

"authorized" means here.

Who else touches this data (subprocessors)

• Supabase — database and authentication (EU-region hosting)
• Railway or Render — runs the test-execution worker
• Stripe — payment processing
• Anthropic — grades test outputs against each test's pass condition

None of these receive more than the specific data needed for their

function. We don't sell data, and we don't use one client's test

results to market to another without separate written permission —

see the Rules of Engagement, Section 5.

Retention

Test results and reports are retained for the period agreed in your

Rules of Engagement, and deleted on request. Account data is retained

for as long as your account is active, plus what Italian tax law

requires us to keep for invoicing records afterward.

Your rights

Under GDPR, you can request a copy of what we hold on you, ask for

corrections, or ask for deletion, subject to the invoicing-retention

requirement above. Email privacy@provaex.com.

Changes

If this policy changes in a way that affects what we do with your

data, we'll email active accounts before the change takes effect, not

just update this page silently.