Privacy Policy

Last updated: April 4, 2026

ProvenMachine LLC ("we," "us," or "our") is an Illinois limited liability company. We respect your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our website at provenmachine.com and our services.

1. Information We Collect

Information you provide:

Website URLs — When you use our audit tool, we collect the URL you submit for analysis.
Contact information — When you book a consultation or submit an onboarding form, we collect your name, email address, phone number, and business details.
Website access credentials — If you hire us to implement changes, we collect login credentials (such as CMS or hosting passwords) necessary to perform the work.
Communication content — Messages, feedback, and other content you send to us.

Information collected automatically:

IP address — Used solely for rate limiting and abuse prevention.
Usage data — Pages visited, audit requests made, timestamps, and interaction with our services.
Device and browser information — Browser type, operating system, and screen resolution transmitted via standard HTTP headers.

2. How We Use Your Information

To perform website audits you request
To generate AI-powered reports and recommendations
To communicate with you about our services
To implement website improvements you've purchased
To prevent abuse and enforce rate limits
To improve our services and develop new features
To comply with legal obligations

AI processing disclosure: When you submit a URL for audit, publicly accessible content from that website (such as HTML, CSS, text, and images) may be sent to third-party AI services (Anthropic Claude and Google Gemini) for analysis and report generation. We do not send your personal contact information or website credentials to any AI service. AI-generated outputs are included in your audit report and subject to the data retention periods described below.

3. Third-Party Services

We use the following third-party services to provide our product:

Anthropic (Claude AI) — We use Claude to analyze website data and generate audit recommendations. Publicly accessible website content you submit for audit may be processed by their API. See Anthropic's Privacy Policy.
Google Gemini AI — We use Gemini for image generation and visual analysis as part of our audit process. Website images and visual elements may be processed by this service. See Google's Privacy Policy.
Google PageSpeed Insights API — We use this service to analyze website performance metrics. Only publicly available data is sent. See Google's Privacy Policy.
Hetzner Cloud — Our infrastructure hosting provider, with servers located in Germany and the United States. See Hetzner's Privacy Policy.

We do not sell your data to any third party. These services receive only the minimum data necessary to perform their function.

4. Data Retention

Audit reports are retained for 90 days from generation, then permanently deleted.
Contact information (name, email, phone, business details) is retained until you request its deletion.
Website access credentials are permanently deleted within 7 days of project completion.
IP addresses and rate limit data are retained for 24 hours, then automatically purged.

5. Data Security

We implement robust security measures to protect your information:

Encryption at rest — All stored data is encrypted using AES-256 encryption.
Encryption in transit — All data transmitted between your browser and our servers is protected by TLS (Transport Layer Security).
Credential isolation — Website access credentials are never sent to any AI API (Anthropic, Google, or otherwise). Credentials are stored separately from all other data, are accessible only to the team member assigned to your project, and are permanently deleted within 7 days of project completion.
Access controls — Strict access controls on all administrative endpoints and internal systems.
Rate limiting — Automated abuse prevention to protect the integrity of our systems.

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Your Rights

Regardless of where you reside, you have the following rights regarding your personal information:

Access — Request a copy of the personal data we hold about you.
Deletion — Request that we delete your personal data.
Correction — Request that we update or correct inaccurate information.
Opt out — Unsubscribe from marketing communications at any time.
Data portability — Request your data in a structured, commonly used, machine-readable format.

To exercise any of these rights, email us at privacy@provenmachine.com. We will respond to your request within 30 days.

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with additional rights regarding your personal information.

Categories of personal information we collect:

Identifiers — Name, email address, phone number, IP address.
Internet or network activity — Browsing history on our site, audit requests, interaction data.
Professional or employment-related information — Business name, job title, and business details you provide.
Sensitive personal information — Website access credentials (login usernames and passwords) are treated as sensitive personal information under CPRA.

Sources of personal information: We collect personal information directly from you when you use our services, submit forms, or communicate with us. We collect technical data automatically through your use of our website.

Business purpose for collection: All personal information is collected and used for the business purposes described in Section 2 of this policy — primarily to provide, maintain, and improve our website audit and optimization services.

Third parties receiving personal information: We share data only with the service providers listed in Section 3 (Anthropic, Google, and Hetzner) solely for the purposes of providing our services. We do not share credentials with any third party.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

Your California rights include:

Right to know — Request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to delete — Request deletion of your personal information.
Right to correct — Request correction of inaccurate personal information.
Right to opt out of sale or sharing — We do not sell or share your data, but you may still submit such a request.
Right to limit use of sensitive personal information — You may request that we limit the use of sensitive personal information (such as credentials) to what is necessary to provide the services.
Right to non-discrimination — We will not discriminate against you for exercising any of your privacy rights.

Response timing: We will acknowledge your request within 10 business days and provide a substantive response within 45 days. If we need additional time, we will notify you of the extension (up to an additional 45 days) and explain the reason.

Authorized agents: You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide proof of written authorization and may verify your identity directly.

To submit a California privacy request, email privacy@provenmachine.com with the subject line "California Privacy Request."

8. Data Breach Notification

In accordance with the Illinois Personal Information Protection Act (815 ILCS 530), in the event of a data breach affecting your personal information, we will:

Notify affected individuals in the most expedient time possible and without unreasonable delay.
If website access credentials are involved, notify you via both email and phone to ensure prompt awareness.
Notify the Illinois Attorney General if the breach affects more than 500 Illinois residents or as otherwise required by law.
Provide details about the nature of the breach, the types of information involved, and steps you can take to protect yourself.

9. Cookies & Tracking

We do not use tracking cookies, third-party analytics, or any advertising trackers. We do not use Google Analytics, Facebook Pixel, or any similar tracking tools.

We may use strictly functional cookies for rate limiting and session management. These cookies do not track you across websites and contain no personal information.

Global Privacy Control (GPC): We recognize and honor Global Privacy Control (GPC) signals sent by your browser. When we detect a GPC signal, we treat it as a valid opt-out request.

10. International Data Transfers

Your data may be transferred to, stored, and processed in the United States and Germany (via our hosting provider, Hetzner Cloud). By using our services, you consent to the transfer of your information to these countries, which may have data protection laws that differ from those in your jurisdiction.

We take steps to ensure that your data receives an adequate level of protection wherever it is processed, including the security measures described in Section 5.

11. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal information from a child under 18, we will take steps to delete that information as promptly as possible. If you believe we have collected information from a child, please contact us at privacy@provenmachine.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of our services after such changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us at:

ProvenMachine LLC
Brookfield, IL 60513

Email: privacy@provenmachine.com
Website: provenmachine.com