Privacy and information handling

Who this applies to

This page applies to contact made with Proof Harbour Ltd through this website, the current Register Interest route, public verification pages, email, and later Proof Harbour routes only after those routes are separately approved for launch.

The current public processing is limited to high-level route-finding and enquiry information for digital asset, tokenised asset, protocol, company, lender, collateral, training, clinics, ongoing evidence support, and evidence-readiness enquiries.

Data controller

Proof Harbour Ltd is the data controller for personal information submitted through this website and for business enquiries sent to Proof Harbour.

Proof Harbour Ltd is registered with the Information Commissioner's Office as a data protection fee payer. Proof Harbour has not appointed or published a named Data Protection Officer or Data Protection Lead.

Current Register Interest information

If you use the Register Interest route, Proof Harbour collects your first name, email address, selected service or enquiry, submission language, your privacy acknowledgement, and technical bot-check information needed to protect the form. The English route also allows an optional short high-level note. Phase 2C non-English routes use structured fields only and do not collect free text.

The submission language is recorded automatically from the active public route. It supports the correct language journey and accountability and is not presented as a language preference question. Proof Harbour does not infer it from nationality, IP address, browser settings, or location.

No pack language or quote currency is selected at Register Interest, and the current form does not collect a requested language or requested quote currency.

Historic Register Interest records may retain a preferred quote currency, requested language, or requested quote currency where those fields were lawfully collected under the previous contract. Those legacy fields are not collected by the current form and remain subject to the same retention, rights, objection, and complaint controls described on this page.

The selected support route may indicate an interest in digital assets, tokenised assets, tokenised credit, real-world asset tokens, protocol activity, collateral, company records, banking or lender evidence, training, clinics, ongoing evidence support, or another early-stage support question.

On the English route, the short note is optional, limited to 300 characters, and checked before acceptance. If it appears to contain configured evidence, wallet or transaction data, documents, identity details, credentials, access material, or links, the form rejects it before a Register Interest record or notification email is created. Phase 2C non-English routes keep this field disabled until the relevant language has a separately approved free-text control.

These checks reduce risk but cannot guarantee that every form of sensitive information will be detected. Keep the note high level.

Privacy acknowledgement

The required checkbox records that you have read this Privacy page and understand how Proof Harbour will use your details to respond to the high-level enquiry.

The checkbox is a privacy acknowledgement. It is not consent to the processing and is not the lawful basis relied upon by Proof Harbour.

Why Proof Harbour uses the information

Proof Harbour uses the information to validate and protect the public form, review and respond to requested enquiries, route enquiries for human review, prevent recent duplicates, understand proportionate service demand, and maintain limited business and accountability records.

Demand reporting should use anonymous aggregate information where an individual identity is not needed.

Proof Harbour does not use the current Register Interest route for direct marketing and does not sell Register Interest records.

Lawful basis and legitimate interests

Proof Harbour relies on Article 6(1)(f) UK GDPR legitimate interests for the current high-level Register Interest processing.

The legitimate interests are receiving and responding to a requested enquiry, operating a secure and controlled public intake route, understanding proportionate service demand and use of published language routes, and maintaining limited enquiry and accountability records.

Proof Harbour has assessed whether the processing is necessary and balanced these interests against your interests, reasonable expectations, rights, and freedoms.

Proof Harbour does not rely on consent for this processing.

Bot screening and automated checks

Proof Harbour uses Cloudflare Turnstile to reduce spam and automated abuse. Turnstile can process technical signals such as IP address, TLS fingerprint, user-agent information, the sitekey, and the website origin.

Cloudflare processes those signals to provide the contracted site-protection service under the applicable data-processing terms. Proof Harbour reviews the current provider terms, subprocessor position, transfer safeguards, and account settings before a release depends on them.

The Register Interest route also validates fields, checks the optional note, and prevents recent duplicate submissions. These controls do not make a legal or similarly significant decision about you.

Service providers and recipients

Proof Harbour uses carefully selected providers to operate the current lane:

• Vercel hosts the website and runs the server-side application.
• Neon / Databricks provides the managed PostgreSQL database used for the controlled enquiry and notification-delivery records.
• Cloudflare Turnstile provides bot screening and server-side token verification.
• Resend sends the internal transactional notification.
• Proton Business hosts the internal mailbox that receives the notification and any reply thread.

These providers receive only the information needed for their contracted role. Their current data-processing terms, subprocessors, regions, support-access arrangements, and retention settings are reviewed as release evidence. Proof Harbour may also disclose information where required by law, necessary for security, or needed to establish, exercise, or defend legal claims.

Proof Harbour does not sell enquiry information and does not send public-form evidence because evidence is not accepted through the current route.

International processing and safeguards

Some service-provider processing, support, security, or subprocessor access may take place outside the UK. Proof Harbour records the relevant provider region and transfer position from the current account and contractual evidence rather than relying on a general provider description.

The location and access path differ by provider, selected region, account plan, support arrangement, and subprocessor. Proof Harbour limits transfers to what is needed for the current Register Interest route and reviews material changes before relying on a provider setting.

Proof Harbour uses provider data-processing agreements and the applicable UK transfer mechanism or adequacy basis for the relevant transfer. You can contact office@proofharbour.co.uk for more information about the safeguards relevant to your information.

Internal notification emails

After a new enquiry is stored, Proof Harbour may send one internal notification containing the contact details, selected service or enquiry, submission language, optional high-level note, and submission time. It does not include a pack language or quote currency selection or request from the current form.

The notification is sent through Resend to the controlled Proton Business mailbox. The submitter's email address is used as the reply-to address.

The notification must not contain evidence, attachments, wallet-control material, token contract addresses, transaction IDs, private files, or credentials.

Retention

Register Interest records receive a deletion-review date normally 90 days after submission. This is a review date, not automatic deletion and not permission to keep every record for the full 90 days.

The normal outcome is deletion when the enquiry is no longer needed. A short extension or longer restriction is used only where there is a recorded reason, such as requested active follow-up, an information-rights request, a complaint, an incident, a legal obligation, or legal claims.

Vercel runtime-log availability depends on the Proof Harbour plan and Observability configuration recorded at release. Resend processes internal-notification content and delivery metadata under its current service terms and data-processing agreement. The Proton Business mailbox copy and any reply thread are reviewed with the underlying enquiry and removed when no longer needed, subject to a valid restriction or hold.

Anonymous aggregate demand information may be retained where it can no longer reasonably identify you.

Human review, automated decisions, and AI

Human review is required before any next step. The current route does not make a solely automated decision that produces legal or similarly significant effects.

The production Register Interest AI queue is off. The current public lane does not send Register Interest information directly to an external AI model.

No AI system may send a customer reply, create a quote, request evidence, open a matter, or make a final decision through the current lane.

What not to send

Do not send private keys, seed phrases, recovery phrases, wallet backups, wallet passwords, exchange passwords, bank login details, browser-wallet access details, or any file that gives control over funds, wallets, tokens, assets, or accounts.

Do not send wallet addresses, transaction IDs, token contract addresses, issuer documents, subscription documents, offering documents, bank statements, exchange statements, ID documents, screenshots, raw evidence, portfolio files, legal opinions, tax memos, or sensitive evidence through the public website.

If Proof Harbour later opens a paid matter, evidence is requested only through the controlled matter process after scope, invoice, cleared payment, matter reference, and matter setup.

Future-gated Free Checkup and human scope review

The full Free Digital Asset Evidence Checkup, result generation, human scope workflow, production backoffice, payment, matter, and evidence routes remain behind later approval gates.

The current Register Interest route does not create a Free Checkup result, quote, invoice, payment request, matter, secure matter workspace, evidence request, tokenised asset conclusion, or final Proof Harbour output.

If a later route is approved, Proof Harbour will update the relevant privacy information and complete any required assessment before that processing starts.

Document verification pages

Public document verification pages, where used, are designed to show status only. They do not publish client evidence, wallet data, transaction data, document contents, private workspace links, payment status, matter folders, or internal notes.

Public verification is not an evidence portal and is not a client document-download route.

Your information rights

Depending on the circumstances, you may ask Proof Harbour to:

• confirm whether it processes your personal information;
• provide a copy of your personal information;
• correct inaccurate or incomplete information;
• erase information where the right applies;
• restrict processing where the right applies;
• stop or limit processing following an objection;
• explain the current human-review and automated-decision position.

Because Proof Harbour relies on legitimate interests for this lane, the statutory right to data portability does not normally apply. You can still ask for a copy of your information under the right of access.

Rights are not always absolute. Proof Harbour will explain any case-specific restriction, exception, or retained information.

To exercise a right, email office@proofharbour.co.uk. You do not need to use legal terminology or a particular form.

Contact about privacy

For privacy questions, information-rights requests, objections, or data-protection complaints, contact: