AccessProof Privacy Notice
Effective October 22, 2026
1. Who is responsible
Scott Corlett operates AccessProof in California, United States. This notice covers the AccessProof website and service. The initial paid offer is for US business customers, but their collaborators may be elsewhere. This eligibility rule does not guarantee that every person or processing system is in the United States. Privacy questions and requests: support@accessproof.net. Security reports: security@accessproof.net.
2. Account, repository and access information
AccessProof processes GitHub account names and stable identifiers, organization and repository names and identifiers, App bindings, owner-membership observations, selected collaborators and provider-reported permissions. We store expiry policies, optional business reasons, findings, operation metadata and evidence to carry out customer instructions and report outcomes. Avoid secrets and sensitive personnel details in optional business reasons. The supported Apps request no Contents permission and the workflow does not download repository source-code contents.
3. Business and subscription information
When you subscribe, AccessProof stores your business name and full US business address, including street, optional second line, city, state, ZIP and country. It also stores business/country declarations, GitHub organization and current owner identifiers, the accepted terms version and the server-recorded acceptance time. We provide the business name and address to Stripe for billing and tax handling. Pending address-change records can contain a proposed profile until provider confirmation; completed change intents are removed. These are supplied and field-validated details, not independent identity, address, residency or geolocation verification.
4. Payments
Stripe hosts payment details and billing interactions. AccessProof stores scoped customer, subscription, invoice, payment and refund identifiers, and verified statuses, amounts, accepted-offer and acceptance information used for billing controls and entitlement. Do not email card details to us. A provider-confirmed refund is distinct from the date your bank credits it.
5. Authorization, sessions and safeguards
Authorization credentials support the connection and permitted operations. Saved record values are encrypted at rest and web access uses HTTPS. These controls do not constitute a certification or guarantee against incidents. Browser sessions are valid for 24 hours and OAuth state for 10 minutes. After disconnecting, an optional billing-only Reader authorization is session-bound, lasts up to 10 minutes and has no refresh-token path. It freshly checks identity and current organization ownership without restarting monitoring or Executor. Validity expiry is not a promise that every associated database record is immediately erased.
6. Website, films and email
Website and hosting systems process connection and requested-file information to serve pages and operate the site. Public films are same-origin MP4 files with native browser playback, captions and static transcripts; they do not use a third-party embedded video player. Stylesheets request Google Fonts, so a visitor’s browser contacts Google for fonts. The hosting edge can set its __cf_bm bot-management cookie and maintain platform or server logs. These descriptions are not a promise that hosting providers keep no technical records. If service-email updates are enabled and you opt in, verified notification preferences, queued transactional messages, delivery/bounce/complaint feedback and suppression state support those updates and sending controls. Automated customer-email updates are currently disabled and are not included as a launch feature. Support/security messages and operational, backup and security records support service handling and investigation. A marketing-email service is not included in this offer.
7. Service providers and purposes
GitHub supplies identity and access operations. AWS supports application hosting, recovery and the transactional-email path. Stripe processes billing, payments and approved tax operations. The public site uses the Sites hosting platform and Cloudflare edge; Google serves the requested fonts. Business support/security mail uses iCloud Mail. We use the described data to authenticate authority, implement customer instructions, produce evidence, manage billing, send authorized service notices, handle requests and operate and protect the service. These providers can keep records under their own terms and obligations; local deletion in AccessProof does not automatically erase their records or ensure one processing location.
8. Retention
Bounded maintenance removes eligible recurring access-check receipts older than 30 days from the active database, including stopped or disconnected workspaces. Maintenance runs in hourly passes and bounded batches, so scheduling or backlog can delay removal. This cleanup does not cover enforcement or job receipts, policies, contracts, business profiles, billing/history, contacts, support/security records or backups. Complete automated account-data deletion is not implemented. We retain other operational records while reasonably needed to deliver or manage the account and instructions, then minimize or delete them when no longer needed. Necessary transaction, accepted-contract, dispute, security and legally required records may be retained for their relevant purpose and period. Session lifetimes are not whole-account erasure deadlines.
9. Your requests and choices
Send a request to know, correct or delete personal information to support@accessproof.net. We verify identity and authority appropriate to the requested information and scope, protect other customers’ data, assess applicable exceptions and address local records, provider records and backups as appropriate. We communicate the actual outcome and retained-record exceptions. An individual request is not rejected merely because the requester is not an organization owner. This is a controlled request process, not an instant all-records deletion feature. Stopping, disconnecting, canceling billing and uninstalling Apps are separate actions; none alone deletes every record. Manage optional service-email preferences in the service. Browser controls can affect cookies and font or media requests.
10. Updates
We will disclose material changes before they affect an existing subscription. This notice does not restrict privacy rights that applicable law does not allow us to waive. Contact support@accessproof.net about this notice or a request.