Privacy Policy

1. Introduction

Proofwork Labs ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our website, MCP servers, APIs, and related services ("Services").

2. Information We Collect

Account information: When you create an account, we collect your email address, display name, and authentication provider (Google, Microsoft, or email/password). If you sign in via a third-party provider, we receive your name and email from that provider.

Organization information: If you create or join an organization, we collect the organization name, billing email, and email domain for automatic team member association.

Billing information: Payment processing is handled by Stripe. We do not store credit card numbers. We store your Stripe customer ID, subscription status, and billing history references.

Tool inputs from your AI assistant (MCP): When you connect Proofwork to an AI assistant such as Claude or ChatGPT, the assistant sends us only the arguments of each tool call it makes: a product description and, optionally, materials, intended use, country of origin, and HTS headings or codes. We do not receive your conversation, chat history, files, or the assistant's memory. Tool inputs are processed in memory to look up reference data and are returned to your assistant; we do not write them to our database or application logs, we do not send them to any AI model, and we do not use them to train AI models. There is one narrow exception, which is off unless your organization deliberately switches it on: coverage measurement, described immediately below. Please do not include personal data in product descriptions.

Coverage measurement (off by default, per organization): Our published accuracy figures differ depending on whether a US Customs ruling already exists for the goods being classified, and we would like to know how often that is true in real use. An organization can opt in to help us measure it. This is off for every organization unless an owner, admin or billing contact of that organization turns it on, and they can turn it off again at any time. While it is on, each classification lookup adds one record containing: whether a matching CBP ruling was found and how close the match was (as a band, not an exact score), whether the matching rulings agreed on a single current code, the number of the CBP ruling that matched, how many words the product description contained, and the skill, tool name and time. We still do not store the product description, the materials, the intended use, the country of origin, the HTS code, or which member of your organization made the lookup, and these records carry no user ID or request ID, so they cannot be linked to an individual or to a usage record. A CBP ruling number is a public document reference; be aware that when a ruling matches your description closely, that published ruling describes a similar product. These records are deleted after 90 days by default (your organization may choose a shorter period when opting in), and your organization can delete all of them at any time.

Usage records: For each tool call we record your user ID, your organization (if any), the MCP server and tool name, a random request ID, whether the call succeeded, how long it took, and the time. We use these records to apply free-tier limits, for billing, and to monitor reliability. They do not contain the content of your request or the result.

Authorization records: When you authorize an AI assistant, we store the OAuth client it registered and the tokens that let it call Proofwork on your behalf, until they expire or are replaced. Access tokens contain your user ID, email address and display name.

Technical data: Our hosting and network providers (Google Cloud and Cloudflare) record standard request logs including IP address, user agent, requested URL, response status and timing. These logs do not include the body of tool calls.

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Services
• Authenticate your identity and manage your account
• Process billing and manage subscriptions
• Track usage for freemium tier limits and billing
• Send transactional communications (account verification, billing notifications)
• Monitor and prevent abuse or unauthorized access
• Comply with legal obligations

4. What We Do Not Do

• We do not sell your personal information to third parties
• We do not use your product descriptions or inputs to train AI models
• We do not share your data with third parties for their marketing purposes
• We do not serve advertising

5. Information Sharing

We share information only in the following circumstances:

• Service providers: The following providers process data on our behalf under their respective terms and privacy policies:
  • Google Cloud (hosting, databases, logging; United States)
  • Google Cloud Identity Platform / Firebase Authentication (sign-in)
  • Cloudflare (DNS and network security for proofworklabs.com)
  • Stripe (payments and subscription management)
  • Resend (transactional email such as welcome and billing messages)
  • Google Analytics (website usage statistics; not used on MCP tool calls)
• Your AI assistant: Tool results are returned to the AI assistant you connected (for example Claude by Anthropic or ChatGPT by OpenAI), which handles them under its own terms. We do not send your account information to the assistant.
• Legal requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
• With your consent: We may share information for other purposes with your explicit consent.

6. Data Security

We implement appropriate technical and organizational measures to protect your information, including encryption in transit (TLS/HTTPS), encrypted storage for sensitive credentials, and access controls. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

• Tool inputs and results: not stored; they exist only in memory while a request is handled.
• Coverage measurement records: only for an organization that opted in; deleted automatically 90 days after the lookup, or sooner if the organization chose a shorter period or deleted them.
• Account, organization and usage records: kept while your account is open, and deleted within 30 days of an account deletion request.
• Authorization records: access tokens expire after one hour; client registrations and related records are kept until they expire or you ask us to delete your account.
• Infrastructure request logs: kept for up to 30 days.
• Billing records: kept for as long as tax and accounting law requires, by us and by Stripe.

8. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Object to or restrict certain processing activities
• Export your data in a portable format

To exercise these rights, contact us at [email protected] from the email address on your account. Step-by-step instructions for deleting your account and data are on our support page. You can disconnect Proofwork from your AI assistant at any time in that assistant's connector settings, and revoke API keys from your account page.

9. Cookies and Tracking

We use Google Analytics to understand how visitors use our website. We use authentication cookies (session tokens) to maintain your signed-in state. We do not use third-party advertising cookies or cross-site tracking.

10. Children's Privacy

The Services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly.

11. International Data Transfers

Our Services are hosted in the United States (Google Cloud, us-central1). If you access the Services from outside the United States, your information will be transferred to and processed in the United States.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the email address associated with your account. Continued use of the Services after changes constitutes acceptance of the updated policy.

13. Contact

Questions about this Privacy Policy may be directed to [email protected].