Privacy Notice

1. Who We Are

Provenance is operated by Trent Palacio, trading as Provenance. For the personal data described in this notice, Trent Palacio acts as the data controller and decides why and how that data is processed. For data your organization uploads about its own tenants and counterparties, we act as a processor on your instructions.

2. What We Collect and Why

• Account data — name, email, organization and role. Authentication credentials are handled by our managed authentication provider; Provenance does not receive plaintext passwords. Used to create your account, authenticate you, and scope access. Legal basis: performance of our contract with you.
• Workspace content — properties, leases, uploaded documents, facts, obligations, and audit entries. Used to provide the service and maintain your record. Legal basis: performance of our contract.
• Support messages — the content of emails and requests you send us. Used to answer you. Legal basis: legitimate interests in supporting customers.
• Usage and device data — IP address, browser and device identifiers, page and feature usage, and security logs. Used for security, fraud prevention, troubleshooting, and product improvement. Legal basis: legitimate interests.
• Billing identifiers — the subscription and customer identifiers returned to us by Paddle. Card details are collected and held by Paddle, not by us. Legal basis: performance of our contract and legal obligation.
• Marketing contact details — where you request a demo. Legal basis: your consent, which you may withdraw at any time.

3. Who We Share It With

We do not sell personal data. We share it only with:

• Paddle.com, our merchant of record, for the sale of subscriptions, subscription management, payments, invoicing, and tax compliance.
• Service providers and subprocessors — cloud hosting and database, authentication, file storage, AI document extraction, email delivery, and error monitoring.
• Collaborators you invite, limited to the properties you scope them to and subject to your approval.
• Professional advisers (legal, accounting) and authorities where required by law.

4. Security

We apply appropriate technical and organisational measures, including encryption in transit and at rest, role-based permissions, row-level security scoped to your organization, and append-only audit logging of record changes.

5. Retention

We retain workspace data for as long as your account is active. Provenance keeps an append-only record inside your workspace, so a verified fact is never silently altered or destroyed while the account exists — but that permanence applies within your workspace and does not override your right to delete. After cancellation your workspace remains readable for 30 days so you can export it. You may delete it yourself at any point in that window, in which case data is removed from live systems within 7 days; otherwise we delete it at the end of the window. Encrypted backups age out within a further 35 days. After that we retain only billing and tax records required by law, which do not include your lease documents or extracted facts.

6. International Transfers

Our infrastructure and subprocessors are located in the United States. Where personal data is transferred from the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

7. Your Rights

Depending on where you live, you may have the right to access, correct, delete, restrict, port, or object to the processing of your personal data, and to withdraw consent. You may also complain to your local supervisory authority. Contact us and we will respond within one month.

8. Cookies

We use essential cookies and local storage for authentication and session management. We do not use advertising pixels or third-party tracking cookies. You can clear or block cookies in your browser, though the service will not stay signed in without the essential ones.

9. Changes and Contact

We may update this notice and will tell you about material changes in the app or by email. For privacy questions or to exercise your rights, contact Trent Palacio at privacy@provenance.holdings.