Privacy Policy

1. Information we collect

We collect information in the following categories.

Account and workspace information

When you create or use a Proofrun account, we may collect information such as your name, email address, authentication information, workspace membership, role and account preferences.

Discovery content

Proofrun stores the information you provide or generate while using the product. This may include product questions, hypotheses, project context, research instructions, uploaded or connected source material, Research Artifacts, Evidence, Research Briefs, research gaps and related workspace content.

Usage and technical information

We may collect information about how the service is used, including feature interactions, request metadata, timestamps, browser and device information, IP address, diagnostic logs, errors and security events.

Billing information

If paid services are enabled, payment processing may be handled by third-party payment providers. Proofrun does not need to store full payment card numbers. We may retain billing status, transaction references, plan or balance information and related accounting records.

Connected service data

If you choose to connect a third-party service, Proofrun may access information from that service according to the permissions you authorize.

Connected services are optional. You control whether they are connected and, where supported, which accounts, properties, projects or other resources Proofrun may access.

2. Google Analytics and Google user data

Proofrun can connect to Google Analytics through Google OAuth.

When you connect Google Analytics, Proofrun requests the read-only scope:

https://www.googleapis.com/auth/analytics.readonly

Depending on the properties you select and the research being performed, Proofrun may access:

• Google Analytics account and property metadata;
• property identifiers and names;
• analytics dimensions;
• analytics metrics;
• event and behavioral measurement data;
• aggregated report results;
• date ranges, filters and other parameters required to execute the report you requested through Proofrun.

Proofrun does not request permission to modify your Google Analytics data.

How we use Google Analytics data

We use Google Analytics data only to provide and improve user-facing Proofrun features that you request.

For example, Proofrun may use analytics data to:

• investigate product behavior relevant to a Discovery;
• compare observed behavior with product hypotheses;
• identify behavioral patterns, drop-offs or research gaps;
• create Research Artifacts;
• support Evidence Analysis;
• update a Research Brief;
• monitor a Discovery when you have explicitly enabled an applicable monitoring feature.

Analytics data is treated as first-party behavioral evidence. Proofrun does not treat analytics data alone as proof of user motivation, buyer intent, willingness to pay or causal explanation.

How we do not use Google Analytics data

Proofrun does not:

• sell Google user data;
• use Google Analytics data for advertising;
• use Google Analytics data to build advertising profiles;
• make Google Analytics OAuth credentials available to other Proofrun customers;
• write data back to Google Analytics through this integration;
• use Google user data for purposes unrelated to the user-facing Proofrun functionality you requested.

Google API Services User Data Policy

Proofrun's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we use information

We use information collected through Proofrun to:

• provide, operate and maintain the service;
• run user-requested product research;
• create and maintain Discoveries;
• analyze source material and generate Research Artifacts;
• evaluate hypotheses, contradictions and research gaps;
• produce and update Research Briefs;
• operate connected integrations;
• authenticate users and enforce workspace permissions;
• protect accounts, workspaces and infrastructure;
• diagnose errors and improve reliability;
• provide support;
• administer billing and accounting;
• comply with legal obligations;
• prevent fraud, abuse and misuse.

We do not use customer content to advertise to you.

4. AI and automated processing

Proofrun uses automated systems and artificial intelligence to perform product research, analyze evidence, compare hypotheses, summarize findings and produce Research Briefs.

Automated outputs may be incomplete, incorrect or inconclusive. Proofrun is designed to support human product judgment, not replace it.

Where necessary to provide these features, relevant customer content and connected source data may be processed by infrastructure, search, analytics or AI service providers acting on our behalf.

We limit these transfers to what is reasonably necessary to provide the requested Proofrun functionality and apply contractual, technical and access safeguards where appropriate.

Proofrun does not sell customer data to AI providers.

5. How we share information

We may share information with service providers that help us operate Proofrun, such as:

• cloud infrastructure providers;
• database and storage providers;
• authentication providers;
• AI and model infrastructure providers;
• search and browser infrastructure providers;
• analytics and observability providers;
• payment processors;
• security and operational service providers.

These providers may process information only as necessary to perform services for Proofrun and subject to applicable contractual and security obligations.

We may also disclose information if required by law, legal process or valid government request, or when reasonably necessary to protect Proofrun, our users or others from fraud, abuse, security threats or legal harm.

If Proofrun or INTNT is involved in a merger, acquisition, financing, reorganization or sale of assets, information may be transferred as part of that transaction subject to applicable law.

We do not sell personal information or Google user data.

6. Data storage and security

Proofrun uses technical and organizational measures designed to protect customer information.

These measures may include:

• encrypted network connections;
• access controls;
• workspace isolation;
• restricted infrastructure permissions;
• secure credential storage;
• audit and diagnostic logging;
• bounded access to connected services;
• separation of integration credentials from ordinary application data.

OAuth access tokens and refresh credentials are not intended to be exposed to the browser.

Connected service credentials are stored separately from ordinary workspace content and are accessed only when required to operate the integration.

No method of transmission or storage is completely secure. We cannot guarantee absolute security.

7. Data retention

We retain account and workspace information for as long as needed to provide Proofrun and for legitimate operational, legal and security purposes.

Discovery content may remain stored until it is deleted, archived or otherwise removed according to available product controls and applicable retention requirements.

Connected service credentials are retained only while the connection remains active or as otherwise necessary to safely process disconnection or revocation.

Research Artifacts and Evidence previously created from a connected source may remain part of the Discovery after the integration is disconnected. This preserves the historical research record.

Where legally required or operationally necessary, limited records may remain in backups, security logs, billing records or audit systems for an additional period.

8. Your choices and controls

Depending on your account, workspace role and applicable law, you may be able to:

• access or update account information;
• manage workspace membership;
• choose which connected sources are available to a Discovery;
• disconnect connected services;
• revoke Google access through your Google Account;
• request deletion of certain account or personal information;
• contact us regarding access, correction, deletion or other privacy rights.

Disconnecting Google Analytics prevents future access through that connection.

You can also revoke Proofrun's access from your Google Account permissions. Revocation may cause the integration to stop working immediately.

9. International processing

Proofrun and its service providers may process information in countries other than the country where you live.

Where required, we use appropriate measures intended to protect information transferred across borders in accordance with applicable law.

10. Children's privacy

Proofrun is intended for professional and business use.

The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If you believe a child has provided personal information to Proofrun, contact us so we can review and address the situation.

11. Changes to this Privacy Policy

We may update this Privacy Policy as Proofrun evolves.

When we make material changes, we will update the date at the top of this page and may provide additional notice where appropriate.

Your continued use of Proofrun after an updated Policy becomes effective is subject to the updated Policy and applicable law.

12. Contact

For privacy questions, requests or concerns, contact:

Proofrun's use of information received from Google APIs is subject to the Google API Services User Data Policy, including the Limited Use requirements.