Legal & privacy

PROVEN policies.

Find the terms, privacy policy, data retention, cookies, subprocessors and commercial rules that apply to PROVEN.

← Back to all policies
01

PROVEN policy

Privacy Policy

Privacy policy for PROVEN Web, Try PROVEN, public Support, Zenia, and the installed PROVEN Shopify application.

Version
15
Updated
2026-09-20
Effective from
2026-09-20

1. Who operates PROVEN

PROVEN is operated by Adrian Popescu, an independent developer based in Bucharest, Romania. Privacy contact details are published on this page and in the Legal section.

2. Scope

This policy covers the PROVEN website, Try PROVEN, public support, Zenia and the installed PROVEN Shopify app.

3. Public website data

The site may process technical data needed for operation and security, user-requested preferences and information voluntarily submitted through public forms. A support request may include an email address, request category, optional store domain, message and a Request ID when available.

4. Try PROVEN

Try PROVEN analyzes information publicly available in the submitted storefront. It does not require Shopify Admin access and does not modify the store. Technical data needed to run and protect the request may be retained temporarily.

5. Zenia

Zenia processes conversation messages and PROVEN context needed to answer. An anonymous conversation identifier may be stored for continuity. Persisted messages are retained for up to 12 months and the anonymous identifier for up to 180 days unless removed earlier.

6. Installed Shopify app

The app may process store and catalog data needed for checks, findings, remediation, publication, audit and service administration. Access depends on Shopify permissions granted by the merchant.

For image optimization, PROVEN may temporarily retain in Cloudflare R2 the original media artifact and optimized version needed for verification and restore. Included media-backup retention is 30 days from verified completion; plan terms may provide a longer period. Privacy- or uninstall-related deletion may occur earlier where required.

PROVEN does not require customer or order data by default for the catalog-quality functions described on this site.

Where PROVEN processes merchant-controlled personal data solely on the merchant’s behalf, the DPA applies to the processor role. PROVEN may act as an independent controller for its own security, support, account administration and compliance purposes.

Data may be used to provide requested services, maintain security and prevent abuse, provide support, comply with legal obligations and perform the applicable contract or legitimate interests. Consent is requested separately where required by law.

8. Providers

PROVEN may use providers for hosting, traffic protection, object storage for media artifacts, email and model/assistant services. Cloudflare R2 is used for temporary storage of image-optimization media artifacts. Relevant providers are listed in the Subprocessors Policy.

9. International transfers

Some providers may process data outside the EEA. Where required, transfers rely on contractual mechanisms or other safeguards recognized by applicable law.

10. Retention

Data is retained only as long as needed for the described purposes, legal obligations and protection of rights. Main periods are described in the Data Retention Policy.

11. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection and may withdraw consent where consent is the legal basis. You may also lodge a complaint with the competent data-protection authority.

12. Security

PROVEN uses technical and organizational measures appropriate to the service, including access separation, credential protection, request validation and limiting actions to granted permissions.

13. Contact

Use the Legal/Privacy contact published on the site for personal-data requests.