Who we are

Proofsource is a product of Grovio Labs, Inc., a Delaware corporation in the United States ("Proofsource", "we", "us"). This policy explains what personal data we collect when you visit proofsource.co, use the Proofsource app at app.proofsource.co, or contact us, and what we do with it.

Proofsource is a business tool. It measures how AI answer engines mention and cite your brand, and helps you act on what it finds. It is meant for companies and the people who work for them, not for personal use.

The short version

We collect what we need to run your account and your workspace, and little else.
We don't sell personal data and we don't use it for advertising.
We don't use your data to train AI models.
You can ask us for a copy of your data, or to delete it, at any time.

What we collect

Account details: your name, email address, and a profile picture if you upload one. Your role in your workspace and the workspaces you belong to. If you sign up through an AI assistant, which assistant it was and whether your email address is a work or personal one.
Workspace content: the brands, domains, competitors, markets and prompts you track, your settings, reports, notes, content drafts, files you upload, and the questions you ask our assistant.
Measurement data: the answers AI engines give to your tracked prompts, the sources they cite, and copies of cited public web pages.
Data from services you connect: for example Google Search Console, Google Analytics, CDN analytics, server logs and your website. Logs we receive can include IP addresses and user agents of AI crawlers.
Credentials for services you connect, such as access tokens and keys. We store these encrypted.
Billing details: your billing name, email, address, country and tax details. Payment card and bank details are collected by our payment provider, Dodo Payments, not by us.
Messages: emails, contact form submissions and support conversations.
Security and usage data: IP address, browser and device type, sign-in times, and actions taken in your workspace.
Website analytics: see Cookies and analytics below.

Please don't put personal data about other people into your tracked prompts. Prompts are sent to AI engines as written, and the service doesn't need personal data to work.

How we use it

To provide the service: run your prompts on AI engines, analyze the answers, build your reports, send your alerts, and run the features you turn on.
To create and secure your account, sign you in, and prevent fraud and abuse.
To bill you and keep the records the law requires.
To talk to you: sign-in codes, results, alerts, service and billing notices, and replies to your questions.
To understand how our website is used and improve the product.
To meet legal obligations and enforce our Terms of Service.

Data we receive from Google is used only as described under Google user data below.

Legal bases

Where the GDPR or UK GDPR applies, we rely on these legal bases: performance of our contract with you or your company, to provide the service; our legitimate interests in securing, supporting and improving the service; your consent, where we ask for it, which you can withdraw at any time; and legal obligation. Where another country's data protection law applies, we process your personal data for the purposes described here with your consent, or on another basis that law allows.

AI models and your data

We don't use your data to train AI models.
To measure your visibility, we send your tracked prompts to AI engines, the same way a buyer would ask them.
Some features send workspace content to an AI model to do their job. We share with AI providers only what a task needs.
AI answers we capture are third-party content. We show them to you as evidence of what the engines said.

Google user data

Proofsource asks Google only for what each feature needs, and only when you start that feature.

Sign in with Google (scopes userinfo.email and userinfo.profile): Google shares your name, email address and profile picture. We keep your name and email address and use them only to create your account and sign you in. We don't keep a Google token for sign-in.
Connect Search Console (scope webmasters.readonly, read-only): we read the list of Search Console sites you can access, so you can pick the one for your brand, and that site's search performance: queries, pages, clicks, impressions, click-through rate and position.
Connect Google Analytics (scope analytics.readonly, read-only): we read the list of Google Analytics properties you can access, so you can pick the one for your brand, and that property's reports: sessions, traffic source and channel, landing pages, key events, transactions and revenue.

How we use it: only to show it back to you and your workspace in Proofsource. That means the Organic search and AI referrals pages, reports you create, agent steps you add, and ranking which of your tracked prompts matter most. We never write, change or delete anything in your Google accounts.

Storage and security: Google tokens are encrypted at rest. Imported data is stored in our database on AWS, kept separate per organization, and visible only to members of your workspace.

Sharing: we don't sell Google user data, use it for advertising, or use it to develop, improve or train generalized AI or machine-learning models. We transfer it only as needed to run the features above: to our hosting provider, and, if an agent you build feeds a Google Analytics step into an AI step, to the AI model provider that runs that step. Beyond that we share it only to comply with the law, or as part of a merger or acquisition with notice to you. Proofsource staff don't read your Google data unless you ask us to for support, it's needed for security, or the law requires it.

Disconnecting and deletion: you can disconnect Search Console or Google Analytics at any time on the Integrations page. When you disconnect, we delete our stored copy of the token and stop syncing. If no other connection of yours uses that Google account, we also ask Google to revoke Proofsource's access. Your other connections keep working. You can also remove Proofsource's access at myaccount.google.com/permissions. Data already imported stays in your workspace until you delete your account or ask support@proofsource.co to delete it. We then delete your Google tokens and imported data.

Proofsource's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We don't sell personal data, and we don't share it with advertisers or data brokers. We share it only with service providers that help us run Proofsource, each limited to what its job needs:

Hosting and network: Amazon Web Services and Cloudflare.
AI engines and models: OpenAI, Anthropic, Perplexity, Google Gemini, xAI, DeepSeek and TypeSafe.
Search and web data: Google Maps Platform, YouTube, DataForSEO, Firecrawl, TinyFish and Xpoz.
Email, notifications and messages: Resend, Knock and Slack.
Payments: Dodo Payments.
Analytics: PostHog.
Services you connect, such as Google, and ChatGPT or Claude when you connect them (see AI assistants you connect below).

Dodo Payments is our merchant of record: it bills you and handles sales tax. What each provider does, the data it receives and where it processes it are listed at proofsource.co/subprocessors. Questions go to privacy@proofsource.co.

We may also disclose personal data when the law or a valid legal process requires it, to protect the rights, property or safety of our users, the public or us, or as part of a merger, acquisition or sale of assets.

Services you connect

When you connect a service such as Slack, a webhook or your website, we send data to it because you asked us to. Those services handle the data under their own terms. You can disconnect any of them at any time on the Integrations page.

AI assistants you connect

You can connect Proofsource to an AI assistant, such as ChatGPT by OpenAI or Claude by Anthropic, so the assistant can call Proofsource tools for you. When you do:

Proofsource receives each tool call the assistant makes: the tool's name and its arguments, such as a brand, a domain or a question, with a token that identifies your account and workspace. We do not receive your chat history or the rest of your conversation beyond those tool call arguments.
The results of the tools you request, such as visibility figures, competitor names, cited pages and answer excerpts from your workspace, are sent to OpenAI or Anthropic so the assistant can show them to you. From then on they are handled under that provider's own terms and privacy policy, not this one.
The assistant can read only the workspace you chose when you connected it, and act only with your role in that workspace.
You can disconnect at any time in the app under Settings, then AI agents, then Connected apps. We then revoke the assistant's access, and its next tool call is refused. Removing Proofsource in the assistant's own settings stops it on the assistant's side.

International transfers

We store and process data in the United States, on Amazon Web Services. Our team and some providers access or process data from outside the United States: Amazon Bedrock may run an AI request in another AWS region, Cloudflare handles traffic at the location nearest the visitor, Google Gemini, Google Maps Platform and YouTube run in Google data centers worldwide, DataForSEO works from Estonia and Ukraine, Xpoz does not publish where it works and its terms follow Israeli law, Dodo Payments from the United States and other countries, and DeepSeek's own API, used only when Amazon Bedrock cannot answer for DeepSeek, is in China. Each provider's location is listed at proofsource.co/subprocessors. Where the GDPR or UK GDPR applies, we protect transfers with Standard Contractual Clauses or another lawful mechanism, and every transfer follows the data protection law of the country it leaves.

How long we keep it

We keep data only as long as needed to provide the service, meet legal obligations and resolve disputes:

Captured AI answers and your workspace content: while your account is active.
Assistant chats: 12 months after the last message.
Email delivery logs: 6 months.
Screenshots of AI answers and cited pages: 15 days.
Service and security logs: up to 12 months.
Account data: deleted 90 days after a free trial or a paid plan ends. We email the workspace owners at least 14 days before we delete it.
Backups: deleted data leaves our database backups within 35 days, as each backup expires.

You can ask us to delete your data at any time by emailing privacy@proofsource.co.

Security

We protect data with encryption in transit and at rest, access controls, and isolation between customers. No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authorities as the law requires. To report a vulnerability, email support@proofsource.co.

Cookies and analytics

The app (app.proofsource.co) uses only cookies it needs to work, such as keeping you signed in and remembering your active workspace. It uses no analytics or advertising cookies.
Our website (proofsource.co) uses PostHog for analytics. By default it sends page views and a few named events (opening or sending the demo form), without setting cookies or storing identifiers in your browser.
Each event reaches PostHog through our own domain with your IP address and browser type, which PostHog uses for approximate location and to count visits without cookies.
With your consent, PostHog sets a cookie to recognize a returning browser and records session replays of your visit. Anything typed into a form field is masked in replays, and the contact form is not recorded. We do not use heatmaps or autocapture. The demo form event carries the team size you pick, never your name, email or message.
If your browser sends Do Not Track or Global Privacy Control, we treat it as no.
You can change your choice any time through Cookie settings at the bottom of every page.
We don't use advertising cookies, and we don't let third parties track you across other sites through our website.

Your rights

Wherever you are, you can ask us to access, correct, update, export or delete your personal data, and you can withdraw consent you have given. Some laws give you more specific rights:

European Union, EEA and United Kingdom: the rights of access, rectification, erasure, restriction, data portability and objection, and the right to complain to your local data protection authority.
Other countries: wherever your local law gives you further rights, such as grievance redressal or naming someone to act for you, you can use them by writing to us, and you can complain to your local data protection authority if we do not resolve your request.
California: the right to know what personal information we collect, use and disclose, and to delete and correct it. We don't sell or share personal information for cross-context behavioral advertising, and we won't treat you differently for using your rights.

To use any of these rights, email privacy@proofsource.co. We may need to confirm your identity first. We reply within the time required by applicable law. If your request concerns a workspace your company controls, we may refer it to your workspace owner.

When your company is in charge

For data that customers put into Proofsource, the customer decides what goes in and we process it on their behalf as a processor. Our Terms of Service and any data processing agreement with the customer govern it. To request a data processing agreement, email privacy@proofsource.co.

Children

Proofsource is for businesses. It is not meant for anyone under 18, and we don't knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.

Changes to this policy

We will post any change on this page and update the effective date. If a change is material, we will tell you by email or in the app.

Contact and grievance officer

Privacy questions and requests: privacy@proofsource.co
Grievance Officer: Lokesh Basu, grievance@proofsource.co. We acknowledge and resolve grievances within the time the law requires.
Everything else: support@proofsource.co

Proofsource is a product of Grovio Labs, Inc., a Delaware corporation.

Registered office: 131 Continental Dr, Suite 305, Newark, DE 19713, United States

Privacy Policy