This policy covers prfd.io, the prfd dashboard, and the prfd API (together, the "Services"), operated by prfd, Inc. ("prfd," "we," "us"). It explains what we collect, why, who we share it with, and the choices you have.
Two different relationships run through this policy, and they get different treatment. First, the businesses that create an account to use prfd ("Customers") and the people on their team who log in ("Users"). Second, the photos and files a Customer submits through the API for sealing or verification ("Submitted Content"), which usually depict or relate to that Customer's own end users, drivers, or transactions, not ours. For Account and User data, prfd is the controller. For Submitted Content, prfd acts as a processor on the Customer's instructions, and the Customer remains responsible for having the right to submit that content and for giving its own end users whatever notice applicable law requires.
Information we collect
- Account and billing information. Name, work email, company name, and plan tier. Passwords are hashed, never stored in plain text. API keys are stored the same way; we never have access to the plaintext secret once it is issued.
- Submitted Content. The photos and files a Customer sends to the API, any metadata already embedded in that file (camera make and model, capture timestamp, GPS coordinates if present), the hashes, signatures, and verdicts prfd generates from it, and any reference fields a Customer attaches, such as an order or claim ID.
- Usage and log data. API requests, timestamps, IP addresses, endpoints called, and similar technical data we need to operate, secure, and bill for the Services.
- Cookies. A session cookie and a CSRF-protection cookie on the dashboard, both required for it to function. We do not use third-party advertising cookies. See "Cookies" below for the marketing site.
- What you send us directly. Messages through our contact form or to our email addresses, used only to respond to you.
What we don't do
- We do not run facial recognition on submitted photos or generate biometric identifiers from them. If your use case would involve that, talk to us before sending us that content.
- We do not sell personal information, and we have not sold any in the preceding twelve months.
- We do not use Submitted Content to train generative models.
How we use information
- To operate the sealing and verification service and return a result to the Customer that submitted the request.
- To secure the Services, detect and prevent abuse, and enforce our terms.
- To maintain and improve our forensic analysis methods, in aggregate or de-identified form wherever we can do that.
- To communicate with Customers and Users about their account, including service, security, and billing notices.
- To meet our legal and tax obligations.
Who we share information with
We share information with the service providers that help us run prfd, each bound by contract to use it only to provide services to us: cloud hosting, email delivery, and the form provider behind our contact form. We may also disclose information in response to valid legal process, to protect rights or safety, or as part of a merger, acquisition, or sale of assets, in which case this policy would continue to apply or we would tell you about any material change. We do not sell personal information.
How long we keep it
We keep account data while an account is active and for a reasonable period after closure to meet legal, tax, and security obligations. Submitted Content and the seals generated from it are kept for the retention period a Customer configures, which is often long-term by design, since the purpose of a .prfd seal is to stay independently verifiable, sometimes years after capture. A Customer can request deletion of its own account's content, within those limits.
One thing we want to be direct about rather than overpromise: deleting a photo from our systems does not retroactively undo the fact that a seal was issued over it. The cryptographic signature and hash are built to remain independently checkable even without us, because that is what makes the seal useful as evidence. We cannot offer the kind of complete, no-trace erasure that would be true of a system that wasn't built to produce durable proof in the first place.
Security
We encrypt data in transit, hash credentials rather than storing them in reversible form, and restrict internal access to customer data to the staff who need it for their role. No method of transmission or storage is completely secure, and we can't guarantee absolute security, but we built the system to fail safely: a tampered file is detectable, not silently trusted.
Your rights and choices
- Users can view and update their account information directly in the dashboard, or by contacting us.
- If a Customer submitted your photo or data to us on their own behalf (a delivery photo, a return photo, a claim), we are usually not your direct point of contact. Reach out to the business you dealt with directly; we support our Customers in responding to requests about the people they serve, as required by law.
- California residents have rights under the CCPA/CPRA, including to know what we collect, to delete it, to correct it, and to opt out of the sale or sharing of personal information. We don't sell or share personal information as those terms are defined under California law.
- EEA and UK residents have rights under the GDPR, including access, rectification, erasure, restriction, portability, and objection, and the right to complain to your local supervisory authority.
- To exercise any of these, email us at hello@prfd.io.
Cookies
The dashboard uses a session cookie and a CSRF cookie, both required for the app to work securely; neither is used for advertising or cross-site tracking. The marketing site you're reading this on does not currently run third-party analytics or advertising trackers.
International data transfers
We may process and store information in the United States and other countries where we or our service providers operate. Where that involves a cross-border transfer subject to additional legal requirements, we rely on appropriate safeguards to cover it.
Children's privacy
The Services are built for businesses and are not directed at children. We do not knowingly collect personal information from children under 13, or the relevant minimum age where you live.
Changes to this policy
We may update this policy as the Services change. If a change is material, we'll tell our Customers directly rather than let it sit quietly in a diff.
Contact us
Questions about this policy, or a request about your information: hello@prfd.io.