Who this covers

This Data Processing Addendum (“DPA”) forms part of the Terms of Service when you use ProofLet Pro cloud backup. It applies only to personal data about tenants, contractors, and other third parties that you upload or that arrives in your ProofLet inbox so we can store and sync it for you.

It does not cover your own account email, subscription status, App Check tokens, or support mail you send us. For those, ProofLet is the controller — see the Privacy Policy.

Roles

You (the landlord or letting professional) are the controller of personal data you enter or receive about tenants and contractors (names, emails, property addresses tied to people, certificate contents, evidence photos that identify people, inbound email senders and attachments, and similar).
ProofLet (Joshua Mason trading as ProofLet) is the processor of that data when cloud backup is on. We process it only to provide backup, multi-device sync, the inbox, expiry email reminders you leave on, and the web portal at portal.prooflet.co.uk, on your instructions.

You are responsible for having a lawful basis to put other people’s details into ProofLet and for honouring their rights under UK GDPR.

What we process

Categories typically include property addresses, optional tenant name and email, certificate records and evidence files, and inbox messages/attachments from contractors. We do not decide which properties or tenants you store.

Instructions

We process that data only to:

store a backup copy in the European Union;
sync it to devices and the portal where you are signed in with your Pro account;
receive and hold inbox attachments until you file or discard them;
send expiry reminder emails when you have that option on;
generate proof packs and similar outputs at your request in the app;
delete it when you delete a property, discard inbox items, use Delete account, or ask us in writing.

We will not sell it, use it for advertising, or use it to contact your tenants or contractors (except delivering mail you directed to your inbox address, and expiry emails to you).

Sub-processors

Infrastructure is provided by Cloudflare, Inc. (Workers, D1, R2, email sending and Email Routing for the inbox). Cloudflare processes data on our behalf under its data processing terms. Backed-up records and evidence are stored in the European Union. We will update this page if we add a material sub-processor for third-party personal data.

Security

We use TLS in transit, Cloudflare platform encryption at rest, owner-scoped APIs so one account cannot read another’s rows, hashed session tokens, Firebase App Check on the API, and application-level encryption for sign-in and tenant emails at rest. Certificate evidence and property fields in the backup are readable by ProofLet and Cloudflare operators who run the service — this is not end-to-end encryption.

Retention and deletion

Live backup data is kept while your account exists.
Deleting a property removes its live rows and evidence from the backup; a UUID tombstone may remain so devices do not resurrect it.
Filed inbox items may keep metadata until you delete your account; discard removes pending items and their files.
Delete account in Settings removes the live cloud copy when the request succeeds. If the cloud wipe fails, the app leaves your phone alone so you can retry.
You can also email support@prooflet.co.uk from the address you signed in with. We will action a deletion request within 30 days.

Assistance

We will help you respond to data-subject requests that relate to data we hold as your processor, insofar as you cannot do it yourself in the app. Contact support@prooflet.co.uk.

International transfers

Where processing involves a transfer outside the UK, we rely on UK-approved safeguards such as the International Data Transfer Agreement or Addendum, as described in the Privacy Policy.

Liability and term

This DPA lasts for as long as we process third-party personal data for your Pro backup. Liability remains as set out in the Terms. If there is a conflict on processing of that data, this DPA prevails over the Privacy Policy for that conflict only.

Contact

Joshua Mason trading as ProofLet · Unit 82701, PO Box 92, Cardiff, CF11 1NB, United Kingdom · support@prooflet.co.uk · ICO: ZC243782.