Privacy notice

Who we are

Proof Forge is a programme run by Rajat Agarwal, a sole proprietor trading as IT Services by Rajat Agarwal, B-1105, Shipra Krishna Vista, Indirapuram, Ghaziabad, Uttar Pradesh 201014, India. We decide why and how your data is used, so we are the data fiduciary. Grievance Officer: Rajat Agarwal, rajatsiroffice@gmail.com, +91 96503 97480.

What we collect, and why

• At payment: your name, startup name, e-mail, mobile number and the number of startups.To take and confirm your payment, send your private access link, and contact you about your seat. The payment itself is handled by Razorpay for IT Services by Rajat Agarwal. We never see your card or bank details.
• Your work inside Proof Forge: your answers, numbers, uploads' names and progress.To run the programme for you. This is locked on your own device before it reaches us. We store only the locked copy and we cannot read it.
• Answers other people give about you: funders, accountants, customers and visitors you invite.To check the proof you submit. Each answer is locked with a key that only you hold. We cannot read it.
• An activity record: time, what happened (for example "vault saved"), your vault id, a random id made by your browser, the software version, and a scrambled (hashed) form of your internet address.To keep the service safe, prevent fraud in refund claims, and prove which software version did what. It never contains what you typed.
• If you claim a refund: an audit pack you choose to send, locked so that only our audit team can open it.To check your claim before we pay.

Your consent

We ask for your consent when you pay (the tick box) and you can see and change your e-mail choice under My data. You can withdraw consent at any time by deleting your vault under My data, or by writing to the Grievance Officer. Withdrawing does not undo processing already done, and a payment record has to be kept (see below). The programme is for people aged 18 or more. We do not knowingly collect data from children.

E-mails we send

When you pay, when your vault is created, when you pass a step, and when a refund is earned or sent. They are about your own progress. We do not send marketing e-mails. Your e-mail address travels inside your private access link and is used only to send these e-mails. You can turn them off under My data.

Who else handles your data

• Cloudflare (hosting, and storage of locked data)Data is held on Cloudflare's global network, which can be outside India.
• Resend (sending e-mail)
• Razorpay (payments, for IT Services by Rajat Agarwal)

We use no advertising, no analytics and no tracking cookies. Your browser keeps only a vault id and a random browser id so the app can find your vault and tell your devices apart. We do not sell your data.

How long we keep it

• Your locked vaultUntil you delete it. If you do nothing, until 12 months after your last activity, after which we may delete it and tell you first by e-mail.
• The activity record12 months, or until any refund claim and dispute is closed, whichever is later.
• Payment recordsAs long as tax and accounting law requires (currently up to 8 years).
• Refund claims and audit packsUntil the claim is paid or refused, plus 3 years for disputes.

How we protect it

Your data is encrypted on your own device before it is stored (AES-256-GCM, with a key made from your passphrase). We cannot read it, and we cannot recover it for you: if you lose both your passphrase and your recovery code, it is gone. Connections use HTTPS. Each release of the app is signed, and we check the live site against the signed release regularly so tampering would be noticed. If a breach affecting your data happens, we will tell you and the Data Protection Board of India as the law requires.

Your rights

• See what we holdMy data shows it.
• Take it with youMy data, "Download my data".
• Correct itIt is your own vault: edit your answers any time. To correct payment details, write to us.
• Erase itMy data, "Delete my vault". A refund you have not yet claimed cannot be claimed afterwards.
• ComplainWrite to the Grievance Officer above. We acknowledge within 7 days and aim to resolve within 30 days. If you are not satisfied you can approach the Data Protection Board of India.
• Nominate someone to exercise your rights if you die or cannot actTell the Grievance Officer in writing.