EntryProof Privacy Policy

What we collect

• Readiness Checker submissions: your store URL and HTS code, plus a hashed (SHA-256, one-way) copy of your IP address for rate-limiting and abuse prevention. We do not store your raw IP address.
• Email address — if you request the full readiness report.
• Standard web analytics (page views, no cross-site tracking) via Vercel/Sentry for uptime and error monitoring.

Where it's sent / who processes it

• Supabase (US-region hosted database) — stores readiness scans and email captures.
• Resend — sends the transactional readiness-report email.
• We do not sell your data or share it with any other business or broker without your explicit request.

Retention

Readiness scan data (store URL, HTS code, hashed IP) is retained 30 days, then deleted. Email opt-ins are retained indefinitely, or until you unsubscribe / request deletion, whichever is sooner.

Your rights

You can unsubscribe from emails at any time via the link in every email we send. To delete your data yourself (GDPR right to erasure, CCPA right to delete), use our self-serve deletion form — we'll email you a confirmation link, and clicking it permanently deletes your waitlist signup and readiness-checker email captures. For a data export or any other request, email hello@citationsafe.com. California residents: EntryProof does not sell personal information, so there is nothing to opt out of under CCPA's "Do Not Sell" provision.

Data breach notification

If we discover a security incident that affects your personal data, we will notify you without unreasonable delay. For users in the EU/UK, we will notify affected users within 72 hours of becoming aware of the breach in accordance with GDPR Art. 33 and, where applicable, the corresponding supervisory authority. For California residents, we will notify you in the most expedient time possible and without unreasonable delay in accordance with Cal. Civ. Code §1798.82. State-law notice requirements for other U.S. residents will be honored as applicable.

How we notify: primary channel is email to the address on file (waitlist or readiness-checker email capture). We may also post a public update on the EntryProof landing page. What we will include: a description of the incident, categories and approximate number of records/users affected, likely consequences, and the mitigation and remediation steps we are taking. Breach concerns: hello@citationsafe.com.

v0 — attorney-review-pending. This breach-notification commitment is authored in-house and has not yet been reviewed by outside counsel; it is offered as a good-faith statement of practice and does not waive any statutory rights you may have.

Contact

Questions about this policy or a data request: hello@citationsafe.com.