Provenance

Privacy Policy

Last updated: April 5, 2026

1. Introduction

Provenance XL, Inc. ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use the Provenance platform ("Service"). By using the Service, you consent to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide

  • Account information: name, email address, password, account type (analyst, reviewer, or admin), and organization affiliation.
  • Content: Excel workbooks, checkpoint messages, review comments, and other documents you upload or create within the Service.
  • Communications: information you provide when contacting our support team or responding to surveys.

2.2 Information Collected Automatically

  • Usage data: pages viewed, features used, timestamps, and interaction patterns within the Service.
  • Device and connection data: IP address, browser type and version, operating system, and device identifiers.
  • Cookies and similar technologies: session cookies for authentication, preference cookies, and analytics cookies. See Section 7 for details.

2.3 Information from Third Parties

  • Authentication providers: if you sign in via Supabase Auth or another identity provider, we receive your profile information (name, email) as authorized by that provider.
  • Organization administrators: your organization admin may provide your email or role when inviting you to the platform.

3. How We Use Your Information

We use your information to:

  • Provide, operate, and maintain the Service.
  • Authenticate your identity and manage your account.
  • Process review workflows, version uploads, and collaboration features.
  • Send transactional notifications (review assignments, approvals, deadline reminders).
  • Analyze usage patterns to improve the Service and develop new features.
  • Generate audit logs and compliance reports for your organization.
  • Respond to your support requests and communications.
  • Comply with legal obligations and enforce our Terms of Service.

4. How We Share Your Information

We do not sell your personal information. We may share your information with:

  • Your organization:administrators within your organization can view member activity, audit logs, and review histories as part of the Service's collaboration features.
  • Service providers: trusted third-party vendors who assist us in operating the Service (hosting, analytics, email delivery), bound by confidentiality agreements.
  • Legal requirements: when required by law, subpoena, or legal process, or to protect the rights, safety, or property of our users or the public.
  • Business transfers: in connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Data Retention

We retain your account information for as long as your account is active or as needed to provide the Service. Uploaded content (checkpoints, workbooks) is retained according to your organization's retention settings. When you or your organization deletes data, we remove it from our active systems within 30 days and from backups within 90 days, unless retention is required by law.

6. Data Security

We implement industry-standard security measures to protect your information, including:

  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
  • Regular security assessments and penetration testing.
  • Role-based access controls and audit logging.
  • SOC 2 Type II compliance program.
  • Incident response procedures with timely breach notification.

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

7. Cookies and Tracking Technologies

We use the following types of cookies:

  • Essential cookies: required for authentication and core Service functionality. These cannot be disabled.
  • Analytics cookies: help us understand how users interact with the Service. You may opt out via your browser settings.

We do not use third-party advertising cookies or cross-site tracking technologies.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate information.
  • Request deletion of your personal information.
  • Export your data in a portable format.
  • Object to or restrict certain processing activities.
  • Withdraw consent where processing is based on consent.

To exercise these rights, contact us at support@provenancexl.com. We will respond within 30 days.

9. International Data Transfers

Your information may be processed in the United States or other countries where our service providers operate. We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses where applicable.

10. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the revised policy on the Service and updating the "Last updated" date. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: