Privacy Policy

Every [SQUARE BRACKET] is a placeholder or a lawyer question. Labels: Decided by user 2026-11-07 — pending lawyer review and DEFAULT — confirm with user / lawyer. Questions for the lawyer are in README.md.

This policy explains what personal information Questproof collects, why, who sees it, where it is kept, how long we keep it, and how you can see, correct or delete it.

It is written to follow the New Zealand Privacy Act 2020 and its information privacy principles (IPPs). Because Questproof is sold worldwide, other laws such as the EU and UK GDPR may also apply. [LAWYER P1: which laws apply and what each adds. UNVERIFIED.]

1. Who we are

Questproof is run by HANALIGHT LIMITED, a company registered in New Zealand.

• Address: [POSTAL ADDRESS]
• Email: [CONTACT EMAIL]
• Privacy contact: [PRIVACY CONTACT NAME]
• [EU/UK representative, if needed: LAWYER P2. UNVERIFIED.]

2. The short version

• There are two groups of people: freelancers who use Questproof, and their clients, who open a link a freelancer sends.
• When a client accepts a scope or decides on a change order, we keep a record of agreement: what they saw, the name they typed, the server time, their IP address and their browser details (user agent).
• We keep information until the freelancer's account is deleted. Projects cannot be deleted, only archived. A client's IP address and user agent are removed 6 years after their decision. [Q6: Decided by user 2026-11-07 — pending lawyer review.]
• Our database runs on Supabase in the EU region, in Frankfurt, Germany (eu-central-1). [for lawyer review.]
• We do not sell personal information. Questproof has no analytics, advertising or tracking.

3. Freelancers: what we collect and why

3.1 What you give us

3.2 What is recorded automatically

• Sign-in and request logs. Our hosting and database providers record technical information such as the IP address, time and browser details when you use the app. [CONFIRM: exactly what Supabase and Cloudflare log, and for how long. UNVERIFIED.]
• Email notices. When your client decides, we email you (section 5.3 lists what the email contains). We keep a record of whether each notice was sent: its status, attempts, times and internal ids, not the email content. The email never contains your client's IP address, browser details or link code.
• Deletion requests. If you ask to delete your account, we record your internal account id and the dates (section 6.4).
• Bot check on the sign-in screens. Sign up, Sign in, Forgot password and the password check in Delete account use Cloudflare Turnstile to check that a person is using the form. Cloudflare's script runs on those screens, so Cloudflare sees your IP address and browser details there. The check passes a one-time token to our sign-in provider (Supabase Auth). We do not store the token or the result in our own tables. Turnstile does not run on the page your clients open. [for lawyer review: LAWYER P9: how to describe Cloudflare's role, and whether Cloudflare also uses this data for its own purposes. UNVERIFIED: Cloudflare's own terms were not read.]
• Account emails. To confirm your email address when you sign up, and to send a password reset link when you ask for one, our sign-in provider sends an email through Resend. Resend receives your email address and the link. [for lawyer review: LAWYER P11.]

3.3 From Paddle (when paid plans are available)

Paddle is the Merchant of Record and handles payment. Paddle tells us about your subscription, and we store: the Paddle customer id and subscription id, the plan you chose (Pro monthly, Pro yearly or the Founders price), the subscription status (for example active, past due or cancelled), and its dates (when the current period ends and when a cancellation takes effect). We do not store the amount you paid, and we do not receive your card details. We also keep a short log of the Paddle event ids and subscription ids we have processed, and a list of subscription ids we must cancel by hand if a deletion could not cancel them in Paddle, each with no name, email or payment details. These ids are kept after your account is deleted, because they are needed to avoid processing an event twice and to finish a cancellation. They are pseudonymous, not anonymous, because Paddle can link them to you. [for lawyer review: LAWYER P4: lawful basis and how long to keep these ids.] Paddle holds your billing details under its own privacy policy. [LAWYER P3: Paddle partly uses data for its own purposes. How should we describe that? UNVERIFIED.]

4. Your clients: what we collect and why

The freelancer's clients do not have an account. They reach Questproof only through a link the freelancer sends.

4.1 What we hold about a client

4.2 Why

• To keep a record of agreement between the freelancer and their client: what was agreed, by whom, and when. The IP address and user agent help show that the record is genuine.
• To protect the links from automated abuse (rate limiting).

The PDF a freelancer downloads shows the client's typed name, the UTC time and the fingerprint. It does not show the IP address or user agent. [D-B: DEFAULT — confirm with user / lawyer.] Those stay in the database and in the freelancer's "Download my data" file.

4.3 Who is responsible

The freelancer decides which clients to add and what to send them. For clients' information, the freelancer is responsible for it and we hold it on the freelancer's behalf (see our Data Processing Agreement). [Q7: DEFAULT — confirm with user / lawyer. The controller / processor split and the NZ Privacy Act s 11 agent position are UNVERIFIED.]

[LAWYER P4: legal basis for recording IP and user agent (for example GDPR legitimate interests), and whether the client page needs its own short notice. UNVERIFIED.]

5. Who sees it

5.1 The freelancer

A freelancer sees their own projects and their clients' decisions, including the IP address and user agent in "Download my data". No freelancer can see another freelancer's data.

5.2 The client

A client sees only the page their link points to.

5.3 Our service providers (processors)

Regions stay UNVERIFIED until each provider's own page is read.

5.4 Anyone else

Only where the law allows or requires it, for example a court order.

6. How long we keep it

6.1 The main rule

We keep your information until your account is deleted. Projects cannot be deleted, only archived, because the records are evidence. Archived projects are kept like active ones.

6.2 Client IP address and user agent

A client's IP address and user agent are removed 6 years after their decision. A daily job clears them. [The job is built and is scheduled when the app is deployed. UNVERIFIED: it has not yet been confirmed running on the live service (launch spec L14). for lawyer review.] The typed name, server time, stored copy and fingerprint stay until the account is deleted. [Q6: Decided by user 2026-11-07 — pending lawyer review. The 6 years follows the NZ Limitation Act 2010 primary period for money claims; that statute text was not read, and other countries differ: UNVERIFIED.]

6.3 Rate-limit keys

IP addresses used as rate-limit keys are kept for up to 1 day. Older entries are cleared the next time the rate limiter runs.

6.4 When a freelancer deletes their account

[D-A: DEFAULT — confirm with user / lawyer.]

• The account is deleted 30 days after the request (the grace period). Until then the freelancer can cancel, and links keep working.
• After the 30 days we delete the account and everything in it, including clients' decisions and the details recorded with them. Then clients opening a link see "This link is no longer active. Please contact your freelancer."
• We keep a deletion log with the internal account id and dates, but no name, email or content, for [RETENTION PERIOD].
• Copies inside backups end when those backups expire [IF BACKUPS ARE IN PLACE; CONFIRM PERIOD].

6.5 Billing records

Paddle keeps billing records under its own policies [when paid plans are available]. [CONFIRM what HANALIGHT LIMITED must keep for tax, with the accountant.]

7. Cookies and tracking

Questproof has no analytics, advertising or tracking. The app uses only the browser storage it needs to keep you signed in. So we do not show a cookie banner. [UNVERIFIED: LAWYER P5 to confirm no banner is needed for EU/UK visitors, including with Cloudflare Turnstile on the sign-in screens: whether Turnstile stores anything in the browser was not read from Cloudflare's pages. If analytics are ever added, this changes first.]

8. Sending information overseas

HANALIGHT LIMITED is in New Zealand. Our database is in the EU region, in Frankfurt, Germany (eu-central-1) [for lawyer review], and some providers may be in other countries.

• A provider that only stores or processes for us is not treated as a disclosure under the NZ Privacy Act (s 11), and we stay responsible.
• A provider that uses information for its own purposes is a disclosure under IPP 12, which needs comparable safeguards or permission.
• [LAWYER P6: which providers are which, and what EU/UK GDPR transfer rules require for data sent from the EU to New Zealand and elsewhere. UNVERIFIED.]

9. How we keep it safe

• Every row belongs to one freelancer, and database rules (row-level security) stop one freelancer from reading another's data.
• Clients never reach the database directly. The client page goes through one server function.
• We store only a SHA-256 fingerprint of each link's secret code, never the code itself.
• Client decisions and accepted scopes cannot be edited or deleted (except as in section 6).
• Data is sent over encrypted connections.

If a privacy breach is likely to cause serious harm, we will tell the people affected and the regulator as the law requires. [LAWYER P7: who notifies for clients' data, the freelancer or us, and the time limits under NZ and EU/UK law. UNVERIFIED.]

10. Your rights, and how to contact us

10.1 Freelancers

You can ask to see, correct or delete the personal information we hold about you. Much of it you can do yourself: edit your profile in Settings, download all your data, or delete your account. For anything else, email [CONTACT EMAIL]. We will reply as soon as we reasonably can, and within 20 working days (the NZ Privacy Act limit as flagged in the SousMate drafts; the section was not read at the primary source: UNVERIFIED).

10.2 Clients of a freelancer

If a freelancer sent you a Questproof link and you want to see, correct or delete your information:

• Ask the freelancer first. They decide what is kept about you, and they can download it.
• Or email us at [CONTACT EMAIL]. We will pass your request to the freelancer within [N] working days and help them answer it as they instruct. [Q7: DEFAULT — confirm with user / lawyer.]

Accepted records cannot be changed. If something is wrong, you can ask for a statement of correction to be kept with the record. [LAWYER P8: is this enough for the right to correction and, under GDPR, erasure? UNVERIFIED.]

10.3 Complaints

Please contact us first at [CONTACT EMAIL]. If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner in New Zealand (privacy.org.nz), or to the data protection authority where you live. [CONFIRM: the OPC phone number and the EU/UK wording. UNVERIFIED.]

11. Changes to this policy

We will update this policy before we add a new provider or use personal information in a new way. We will tell freelancers by email or in the app before a significant change, and ask them to accept the new version.

Last updated: [DATE].