Privacy Policy

This Privacy Policy explains how BESC LLC, a New Hampshire limited liability company ("BESC", "we", "us"), collects and uses personal information when you use Proofline. Questions or requests: legal@proofline.systems.

#Information we collect

Account information. Email address, handle, display name, optional bio and country, your account type (researcher, project, mediator), a password hash (scrypt, never the password itself), and, if you enable it, an encrypted two-factor secret.

Wallets. Wallet addresses you link, and the signatures proving you control them.

Reports and case activity. Report content, evidence files, messages, decisions and rebuttals. These are encrypted with a per-case key and are visible only to the case's participants (the researcher, the project's authorized members and, where requested, the assigned mediator). Each event is recorded in a tamper-evident, hash-chained history.

Security and usage records. Session records (IP address and browser user agent, kept with each sign-in so you can review and revoke devices) and an audit log of privileged actions (for example, who viewed or downloaded case material, and when).

Identity verification results. If identity or sanctions screening is enabled, our verification provider collects your identity documents directly. We store only the outcome (for example approved, rejected, or a sanctions match), never your documents.

Integration settings. For project organizations: integration destinations, encrypted integration credentials, and hashes of API keys.

We don't use advertising or analytics trackers. Proofline sets only the cookies needed to keep you signed in and to complete two-factor sign-in. While you write a report, the draft is saved in your own browser's local storage so you don't lose work. It never leaves your device until you submit, and it's removed once you submit.

#How we use it

• To run Proofline: accounts, programs, Casefiles, decisions, mediation, notifications and payouts.
• To keep it secure: authentication, rate limiting, abuse prevention, audit logs, and malware scanning of uploaded files.
• To meet legal obligations: sanctions screening, tax or regulatory requirements, and responding to lawful requests.
• To communicate with you about your account and cases. Emails point you to the platform and never contain vulnerability details.

Where the GDPR or similar laws apply, our legal bases are performing our contract with you, our legitimate interests in operating a secure and fair platform, compliance with legal obligations, and your consent where we ask for it.

#What is public

Some information is public by design:

• researcher profiles (handle, display name, bio, country if provided, Proof score, verified findings counts, acknowledgements and whether identity is verified, never documents);
• program pages and their track records;
• disclosed reports, to the extent the program's disclosure policy and the parties allow.

Blockchain data is public and permanent. Wallet addresses and on-chain payouts can be seen by anyone and can't be deleted by us.

#Who we share it with

We use these service providers, under contracts that limit their use of your data:

Provider	Purpose
Railway	Hosting, database, encrypted file storage (United States)
Resend	Sending email notifications and password-reset links
Sumsub	Identity and sanctions verification, only when enabled and required for a payout

We share case information only with that case's participants, with an independent mediator when mediation is requested, when you direct us to (for example, through integrations you configure), or when required by law. We don't sell personal information.

#Retention

• Casefile records (reports, evidence, decisions and their history) are kept for as long as the related program exists and for as long as needed to resolve disputes, honor payout obligations and meet legal requirements. Because the history is tamper-evident and shared with other participants, we can't delete individual events from it. When you close your account, we can remove or pseudonymize your profile and contact details while preserving the case record.
• Sessions expire after 12 hours. Password-reset links expire after one hour.
• Integration delivery logs are deleted after 30 days (successful) or 90 days (failed).
• Audit logs are kept for security and accountability for as long as the related records exist.

#Security

Report content, evidence and messages are encrypted with per-case keys. Evidence is malware-scanned on upload and stored only as ciphertext. Access is limited per case, privileged access is audit-logged, project and mediator accounts require two-factor authentication, and passwords are hashed with scrypt. No system is perfectly secure. If you believe you've found a vulnerability in Proofline itself, please report it to legal@proofline.systems.

#Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. To make a request, email legal@proofline.systems from your account's address. We'll respond within the time required by applicable law, and we won't discriminate against you for exercising your rights. Some requests are limited by the case-record retention described above. You may also complain to your local data protection authority.

#International transfers

Proofline is hosted in the United States. If you use it from elsewhere, your information is processed in the United States, where data protection law may differ from yours. Where required, we rely on appropriate safeguards for these transfers.

#Children

Proofline is not for anyone under 18, and we don't knowingly collect information from children.

#Changes

We'll post updates here and change the date above. For material changes, we'll notify you in the product or by email before they take effect.

#Contact

BESC LLC, New Hampshire, USA · legal@proofline.systems