Privacy Policy
Last updated 24 October 2026
This policy explains how [LEGAL ENTITY NAME — TO BE PROVIDED], [REGISTERED ADDRESS — TO BE PROVIDED] ("AccessProof", "we") handles personal data when you use tryaccessproof.com and the AccessProof service. Contact: support@tryaccessproof.com. [EU/UK REPRESENTATIVE (GDPR Art. 27), IF REQUIRED — TO BE PROVIDED].
1. Our roles
- Controller for account data: your sign-in email, account and billing records, support tickets, security audit log, and service logs.
- Processor (GDPR Art. 28) / service provider (CCPA) for customer organization data we fetch from GitHub and Microsoft Entra on your instruction — member and guest identities, roles, app credentials, reviewer decisions and evidence packs. Our Data Processing Agreement governs this processing; the customer is the controller.
2. Data we collect
| Data | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| Account: email address, name derived from it, company domain | Create and secure your account; sign-in links | Contract (6(1)(b)) | Until you delete the account |
| Sign-in / reviewer link tokens | Passwordless authentication | Contract | Login links expire in 15 min, deleted within 1 day; reviewer links expire in 30 days, deleted 7 days after expiry |
| Session cookie (signed account id) | Keep you signed in | Contract; strictly necessary (ePrivacy Art. 5(3)) | 30 days or until sign-out |
| Reviewer names and emails you add | Send review assignments | Processor, on customer instruction | Until removed or account deleted |
| Org data from GitHub / Entra (usernames, display names, emails/UPNs, roles, last activity, app secret owners/expiry), decisions and reasons, evidence packs | Run access reviews and produce audit evidence | Processor, on customer instruction | Until the customer deletes the account (or earlier on request) |
| Billing: Stripe customer and subscription IDs, plan | Billing, refunds, tax/accounting | Contract; legal obligation (6(1)(c)) | Account lifetime; invoices kept by Stripe as required by law |
| Support tickets (email, subject, message) | Answer your requests | Legitimate interest (6(1)(f)) / contract | 24 months |
| Security audit log (event type, time, masked actor email, request id) | Security, fraud prevention, accountability | Legitimate interest | 400 days |
| Service logs (request id, method, path with tokens removed, status, timing, account id, Cloudflare data centre, IP address processed by Cloudflare) | Debugging, reliability, abuse prevention | Legitimate interest | Cloudflare Workers Logs retention (currently 3–7 days) |
We do not collect special-category data, do not run advertising trackers or cookie-based analytics, and do not use your data to train AI models. Logs never contain sign-in links, tokens or full email addresses.
3. Cookies
We set only strictly necessary cookies, so no consent banner is needed: accessproof_session (HttpOnly, Secure, SameSite=Lax; 30 days) and gh_setup_state (one-time GitHub setup protection). No analytics, advertising or third-party cookies.
Analytics. Our public marketing pages (home, pricing, help, legal) use Cloudflare Web Analytics, which is cookieless: it sets no cookies, uses no local storage or fingerprinting, and reports only aggregate page views and performance metrics. It does not run on signed-in app pages, reviewer pages or sign-in links. Cloudflare processes this as our subprocessor (listed below).
4. Subprocessors and international transfers
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, compute, database (Workers + Durable Objects), CDN, DDoS protection, inbound email routing, request logs, cookieless aggregate web analytics (public pages only) | Global edge network; data at rest in Cloudflare region(s) chosen automatically | EU–US Data Privacy Framework + SCCs |
| Resend (Plus Five Five, Inc.) | Transactional email delivery (sign-in and reviewer links) | United States | SCCs |
| GitHub, Inc. (Microsoft) | Source of org membership / collaborator data; executes revocations the customer approves | United States | EU–US Data Privacy Framework + SCCs |
| Microsoft Corporation (Entra ID / Microsoft Graph) | Source of directory users, guests, roles and app credentials | Customer tenant region / United States | EU–US Data Privacy Framework + SCCs |
| Stripe, Inc. | Payments, subscriptions, invoices, refunds | United States | EU–US Data Privacy Framework + SCCs |
Where personal data leaves the EEA, UK or Switzerland we rely on the EU–US Data Privacy Framework where the recipient is certified and/or the European Commission's Standard Contractual Clauses (2021/914) with the UK Addendum, plus supplementary measures (encryption in transit, data minimisation). We will give 30 days' notice of new subprocessors on this page.
5. Your rights (GDPR / UK GDPR)
You may access, rectify, erase, restrict or object to processing, and receive your data in a portable format. Self-service: Account settings lets you download all account data as JSON and permanently delete your account. For anything else email support@tryaccessproof.com; we respond within one month. You can complain to your local data protection authority. For org data where we are a processor, we forward requests to the customer (your employer) and assist them.
6. California residents (CCPA / CPRA)
We do not sell or share personal information (as defined by the CCPA, including cross-context behavioral advertising), and have not done so in the past 12 months. We do not use or disclose sensitive personal information for purposes beyond those permitted by Cal. Code Regs. tit. 11 § 7027(m). Categories collected: identifiers (email, usernames), professional information (org roles and access), commercial information (plan, payments via Stripe), internet activity (service logs). Sources: you, your organization's GitHub/Entra tenant, Stripe. You have the right to know, delete, correct, and to not be discriminated against for exercising these rights; use Account settings or email us. Authorized agents may submit requests with proof of authorization. We honor Global Privacy Control signals as an opt-out of sale/sharing (there is none to opt out of). Retention periods are listed in section 2.
7. Security
TLS everywhere with HSTS, strict Content-Security-Policy, signed HttpOnly session cookies, single-use expiring sign-in links, least-privilege read-only GitHub permissions and read-only, admin-consented Microsoft Graph application permissions (Entra access tokens are held in memory only and never stored), hash-chained tamper-evident evidence, and an internal audit trail.
8. Children
AccessProof is a business service and not directed to children under 16.
9. Changes
We will post changes here and, for material changes, email account owners in advance.