Effective September 25, 2026
Privacy policy.
Provenance keeps purchase records useful without turning them into a profile for advertising. This policy explains what we hold, why we hold it and the choices available to customers and merchants.
Information we collect
When you create an account, we receive your email address and the sign-in identifier needed to keep the account secure. When you save a Proof, we hold purchase facts supplied by the issuing merchant, such as the merchant and location, purchase time, items, amounts, broad payment method, discounts, taxes, refunds and returns. We do not need or retain full payment-card or gift-card numbers in a Proof.
Merchants also provide business contact details, staff access choices, connected checkout-system information and the credentials needed to operate those connections. We collect bounded security, reliability and product-usage measurements so we can operate and improve the service.
How we use information
We use information to create and display Proofs, keep account and merchant access secure, record later purchase events, provide exports and support, operate checkout connections, prevent misuse, diagnose failures and meet legal obligations. We do not sell personal information or use purchase histories for third-party advertising.
Who can see it
A customer controls access to their saved Proofs and Things. An issuing merchant may access records for its own sales when it has a permitted operational reason; it does not receive access to a customer’s account, purchases from other merchants or full payment details. A person can share a bounded Item Passport, support packet or transfer invitation without sharing their whole account.
We use service providers for functions such as hosting, authentication, email and connected checkout systems. They may process only the information needed for their service. We may also disclose information when required by law, to protect the service or its users, or as part of a business transaction subject to appropriate safeguards.
Retention and account closure
Purchase evidence and Proof history may be retained as durable records even after an account closes. Closing an account removes the sign-in binding, anonymizes the account identity and revokes active sharing capabilities; it does not rewrite an issued Proof, erase a merchant’s transaction record or transfer ownership to someone else.
Your choices
Signed-in customers can export their customer-facing data, control optional communications and sharing, and schedule account closure from Privacy & your data. Merchants can manage staff access and disconnect checkout integrations, subject to the records that must remain for security, evidence or legal purposes.
Security and changes
We use access controls, encryption and operational monitoring designed to protect the information entrusted to us. No system can guarantee absolute security. If this policy changes materially, we will publish the new effective date and provide any notice or consent required by law.
Contact
Questions or privacy requests can be sent to [email protected]. Account exports and closure controls remain available from the signed-in privacy page.