Privacy Policy

This privacy policy applies to www.proofbox.co including all subdomains, in particular the landing page onboarding.proofbox.co. A separate consent management platform is used on onboarding.proofbox.co; the cookies used there are listed in the cookie declaration of that subdomain. The General Terms and Conditions must be observed.

We, Proofbox, collect, process, and use your personal data only with your consent or on your behalf for the purposes agreed with you, or if another legal basis exists under the General Data Protection Regulation (GDPR); this is done in compliance with data protection and civil law provisions, in particular solely on the basis of legal regulations such as the GDPR and the Telecommunications Act 2021 (TKG 2021). We collect only the personal data necessary for the performance and processing of our services or data that you have voluntarily provided to us or that is publicly available. We will only process the data provided to us for the purposes for which you have given your consent or that are covered by a legal basis for data processing in accordance with the GDPR. The purposes of data processing include contract fulfillment, payment and invoicing, customer service, security measures, fraud prevention, and marketing activities, provided you have consented to them. Personal data includes any information relating to an identified or identifiable natural person, such as name, address, email address, phone number, date of birth, age, gender, social security number, video recordings, photos, voice recordings of individuals, and biometric data such as fingerprints. Sensitive data such as health information or data related to criminal proceedings may also be collected.

The entity responsible for data processing is Proofbox GmbH, Austria. You can contact us at any time at hello@proofbox.co.

As part of the Upload Service, uploaded documents are examined in an automated, AI-supported manner for indications of unlawful content or content contrary to public decency, and for indications of personal data whose publication may be inadmissible. The legal basis is our legitimate interest in preventing abuse and unlawful publications and in protecting the rights of third parties (Art. 6(1)(f) GDPR). Where a document is flagged, it may be inspected by a person at Proofbox for the purpose of assessment; such access is logged. A rejection of a publication is not based solely on automated processing. Further details are set out in section 3.3 of the Terms and Conditions.

As a customer or generally as a data subject, you have the right at any time to request information about your stored personal data, its origin and recipients, and the purpose of the data processing. You also have the right to correction, data portability, objection, restriction of processing, and blocking or deletion of incorrect or unlawfully processed data. If your personal data changes, please inform us. You have the right to revoke your consent to the use of your personal data at any time. Requests for information, deletion, correction, objection, and/or data portability — in the latter case, provided this does not entail disproportionate effort — can be sent to the address provided in this statement. If you believe that the processing of your personal data violates applicable data protection laws or your data protection rights have been infringed in any other way, you have the right to lodge a complaint with the competent supervisory authority. Users from California may opt out of data sharing and use the corresponding opt-out options. For inquiries, please contact us via email at hello@proofbox.co.

Your personal data is protected by appropriate technical and organizational measures. These measures specifically protect against unauthorized, unlawful, or accidental access, processing, loss, misuse, and manipulation. Despite our efforts to maintain a high standard of due care, it cannot be ruled out that information you transmit to us over the internet may be viewed and used by others. Please note that we assume no liability for the disclosure of information due to errors in data transmission not caused by us and/or unauthorized access by third parties.

In order to provide our services, it may be necessary to share your data with third parties. For example, your payment data is transmitted to an external payment service provider. This provider acts as a comprehensive payment service provider and is responsible for invoicing and tax calculation. Payment information is stored in the form of tokens, so that recurring payments or a fast checkout are possible. We do not store payment data ourselves. User and order data are managed in a protected database. Tax and accounting data may be transmitted to tax advisors or tax authorities. For maintenance and development purposes, technical service providers may be given access to your data. We currently use the following processors and service providers: Amazon Web Services (hosting and storage, EU), Cloudflare and World4You (provision and security of the website), Stripe (payment processing, invoicing and tax calculation), Sign8 (qualified electronic seals and timestamps), OpenAI (AI-assisted creation of abstracts for uploaded documents and operation of the FAQ chatbot), HubSpot (customer management and communication), Cookiebot (consent management), Google (Tag Manager and analytics), Stape (Stape, Inc., USA — server-side tag management; the tags are delivered via our subdomains load.user.proofbox.co and user.proofbox.co), Tally (Tally BV, Belgium — provision of the feedback forms), Cal.com (Cal.com, Inc. — appointment scheduling and booking management; embedded via the European instance cal.eu), Lovable (Lovable Labs Incorporated, USA — provision and hosting of the landing page onboarding.proofbox.co), Supabase (Supabase, Inc., USA — logging of consent decisions on the landing page onboarding.proofbox.co) and a marketing agency commissioned by us (operation and analysis of campaign landing pages, including the consent management used there). Insofar as these service providers process personal data on our behalf, data processing agreements under Art. 28 GDPR are in place. Note on the writing service and abstract creation: the contents of uploaded documents are transmitted to the AI provider used for the automated creation of abstracts and metadata. Any use of this content to train AI models is contractually excluded. If your personal data are processed outside the EU/EEA, we ensure an adequate level of data protection, for example through the European Commission's standard contractual clauses or adequacy decisions. The GDPR is the decisive framework for our processing. Users outside the EU can contact us at any time at hello@proofbox.co with data protection concerns; we handle such requests to the standard of the GDPR. We offer users in California the option to object to the sharing of their data.

In any event, we only transfer your personal data to countries for which the EU Commission has decided that they have an adequate level of data protection, or we take measures to ensure that all recipients have an adequate level of data protection.

We store your personal data only for as long as is necessary to fulfill our contractual or legal obligations. Data related to contract fulfillment is stored for at least seven years in accordance with tax regulations. Data processed based on your consent will be deleted immediately upon withdrawal. Technical data such as IP addresses are stored for a maximum of twelve months. After the applicable retention periods expire, the data will be deleted or anonymized.

We implement technical and organizational measures to secure your data. These include SSL/TLS encryption during transmission, encrypted storage and access restrictions on a need-to-know basis. However, please note that data transmissions over the internet may have security vulnerabilities, which is why seamless protection against access by third parties cannot be guaranteed. Your payment data is stored and managed exclusively by a third-party payment service provider. We do not store payment information ourselves, but rely on the tokens provided by the third-party provider for recurring payments.

Our website uses cookies to enhance user experience. These include necessary cookies, analytics cookies for optimizing our website, and marketing cookies for personalized content. Tracking tools and third-party pixels from providers such as Meta, LinkedIn, and Xing help us measure the effectiveness of our campaigns. Information such as IP addresses, device data, and click behavior is processed. Google Tag Manager and Google Analytics 4 are used to efficiently integrate these technologies and analyze metrics. The storage of marketing cookies and use of tracking tools only occurs with your explicit consent. You can change your cookie settings at any time or disable cookies in your browser. Users in the EU and California receive specific opt-in/opt-out options. Please refer to our separate Cookie Policy.

We strive to detect data breaches at an early stage and to notify you or the competent supervisory authority without delay, taking into account the categories of data affected. Affected persons will be informed if their rights are impacted by a breach. We carefully document all incidents in order to demonstrate our compliance with data protection obligations. We will not store data longer than necessary to fulfill our obligations.

Users who signed in to Proofbox via our OAuth app (e.g., Facebook Login or Apple Login or Google Login) or other social-login services may request deletion of their personal data at any time. To do so, send an email with the subject "Data Deletion" to hello@proofbox.co. Upon receipt of your request, all personal data that Proofbox obtained through the respective OAuth connection will be deleted within 30 days, unless legal retention obligations apply. The deletion includes, in particular, your profile data, account information, and associated usage data. If you have an active Proofbox account, it will be deactivated as part of the deletion process and then permanently removed.

Our privacy policy is supplemented by our terms and conditions and disclaimer. These provide further important information regarding legal and usage-related aspects, particularly in connection with the use of our platform and the content provided through it. Please read these documents carefully, as they contain important information on liability, product usage, and their legal recognition.

Our privacy policy may be updated as needed to reflect changes in legal requirements or technical developments. The current version is always available on our website.