Privacy Policy

1. Who we are

ProveWorth is operated by Digital Gravity LLC, a Texas limited liability company. If you have questions about this policy, reach out through our contact page.

This policy covers people who read and write reviews, owners who claim a page, businesses on a paid plan, and the customers those businesses ask for a review.

2. What we collect

Account data: your email address, and your name, photo, bio and social links if you add them
Reviews you submit: the text, ratings and whether you'd recommend the business or community. A video review includes the recording and a transcript of it. Reviews are public and attributed to your profile
Page claims: your name, email and the details you give us to show you run the business or community
Business details: for a business on a paid plan, its name, address, phone, time zone and Google review link
Billing: Stripe takes your card. We keep your Stripe customer ID and your plan's status, never your full card number
Customer contact data: the customers a business asks us to contact (see "Customer contact data" below)
Replies and messages: replies to a review-request email, and texts and emails in a business's ProveWorth texting inbox
Calls, chats and forms: what you tell us through our contact form, our site chat or our phone line. An AI assistant answers our phone, and calls may be recorded and transcribed
Usage data: pages you visit, buttons you click and referrer info. We use this to figure out what's working and what to fix
Server logs: IP addresses and request timestamps, kept for roughly 14 days for security and rate-limiting

3. Why we collect it

To show you businesses, communities and their reviews
To let you write reviews, claim a page and manage it
To send a business's review requests and show it what happened to each one
To run the tools on a business's plan, like its texting number, inbox and booking calendar
To bill paid plans
To send you transactional emails (sign-in codes, review notifications, account and billing notices)
To answer you when you contact us
To detect fraud, spam and abuse
To understand what people actually use, so we build the right things next

4. Customer contact data

A business on a paid plan uploads its own customers so we can ask them for a review. We store a name, an email address and a phone number, and nothing else about that person.

The business decides who goes on that list. We process those details to send the request and to record what happened to it. We do not sell them, and we do not use one business's list to contact anyone on behalf of another.

A customer who asks us to stop is recorded as suppressed, not deleted. A deleted record would let the same number get uploaded again the next day.

Before a phone number receives a text from us, the business confirms in writing that the person agreed to hear from them. We store that confirmation word for word, along with who accepted it, when, and the address it came from where we have one.

The agreement itself is between the business and its customer, and the business keeps whatever the customer signed or ticked. Our record shows that the business made the confirmation.

A business that connects its own tools accepts the same confirmation once, when it generates an API key. That wording is stored on the key and copied onto every consent record the key produces.

6. Unsubscribes and STOP

Every request email carries a one-click unsubscribe link and the headers that let a mail app unsubscribe for you.

Replying stop, quit, end, cancel, unsubscribe, opt out or revoke to a text ends it, and so does anything else that plainly means the same. There is no special word to guess.

Every business texts from its own number, and a stop still covers all of them. The stop is recorded against the phone number rather than against the business that sent to it. It normally takes effect in seconds.

7. Google data

A business can add its Google review link, and we include that link in the review requests we send for it. Where available, a business can also connect its Google Business Profile from its dashboard. When it does, we read its Google reviews and keep a copy in that business's private dashboard so it can reply to them.

Google reviews never appear on a ProveWorth page and never count toward a ProveWorth rating.

A reply is drafted for the owner and published to Google only after the owner approves that exact text. Disconnecting the profile stops the reading and the publishing.

8. Third-party services we use

We use these companies to run ProveWorth. Each receives some data to do its job:

Service	What it does	What they see
Supabase	Database, sign-in and file storage	Accounts, reviews, profiles, uploaded images and videos, customer contact data
Vercel	Website hosting and page analytics	IP address and request data (standard hosting logs)
Stripe	Payments and billing	Name, email, card details and plan
Resend	Sending email and receiving replies	Email addresses, email content and replies to review-request emails
Messaging platform provider	Texting, inboxes, booking calendars, site chat and our AI phone assistant	Names, phone numbers, emails, messages and call recordings for the accounts we run
Upstash	Job queue and rate limiting	Job details such as which request to send next, and IP addresses for rate limits
Cloudflare	DNS and forwarding mail sent to our addresses	Emails sent to our addresses
PostHog	Product analytics	Usage events, clicks and page views
Sentry	Error tracking	Error logs (sometimes with a user ID for debugging)
Anthropic (Claude)	AI moderation, page summaries and drafted replies	Review text and profile details during analysis
OpenAI	Transcribing video reviews	The audio of a video review
Dub	Short links	URL data only
Google	Sign-in with Google, and Business Profile when a business connects it	Your Google email and basic profile, and a connected business's Google reviews

We have data processing agreements in place where legally applicable. We don't sell your data.

9. Affiliate relationships

Some outbound links on ProveWorth are affiliate links. When you join a community through one of these links, we may earn a referral commission from the platform hosting that community. These links are labeled in the HTML and disclosed in context next to each one. See our full affiliate disclosure for details.

This relationship does not influence which communities we list, how they're rated, or which reviews we publish. Member reviews drive rankings, not payouts.

10. Cookies and similar technology

Essential cookies: keep you signed in, remember your session and prevent abuse. Can't be turned off without breaking the site
Analytics cookies: event tracking via PostHog. You can opt out through browser-level Do-Not-Track settings
Payment cookies: Stripe sets its own cookies on the payment step to prevent fraud

We don't use third-party advertising cookies. No retargeting, no ad networks.

11. How long we keep data

Account data: until you delete your account (see "Deleting your account" below)
Reviews: permanent once published. You can edit or remove yours. We keep a record of removed reviews for moderation purposes
Customer contact data: while the business's listing is active
Stop and unsubscribe records: kept after the listing that created them is gone, so someone who said stop stays stopped
Server logs: around 14 days
Error logs (Sentry): 90 days
Analytics (PostHog): rolling 12 months

12. Deleting your account

You can delete your ProveWorth account anytime from your dashboard (Account tab, bottom of the page). Here's what happens:

Profile: your name, avatar, bio and personal settings are permanently removed from our database
Email: freed for re-registration, so you can sign up fresh anytime
Reviews you wrote: hidden from public pages. We don't hard-delete them from our database since owners and other readers may have read them, but nobody can see them
Pages you solely owned: archived. Existing reviews stay visible, because those are the reviewers' words, not the owner's

For fraud-prevention and audit purposes we keep a minimal record (your email, deletion timestamp and the count of reviews you had) for 90 days, then it's deleted too. This is allowed under GDPR's legitimate-interest provision.

Deletion is final. We don't offer a grace period or undelete path. If you change your mind after deleting, the only way forward is a fresh signup.

13. Your rights

Access: reach out through our contact page with "data request"
Delete: delete your account from the dashboard (see "Deleting your account" above), or contact us
Correct: edit anything in your profile, or contact us for things you can't edit yourself
Export: contact us for a copy of your data

If a business asked us to contact you, you can stop it with the unsubscribe link or by replying stop. For anything else about your details, ask that business, or contact us and we'll work it out with them.

If you live in California (CCPA/CPRA): you have the right to know, delete, correct and opt out of the "sale" or "sharing" of your personal information. We don't sell or share in the CCPA sense, but the right is yours regardless.

If you live in the EU, UK or EEA (GDPR): you have rights of access, rectification, erasure, restriction, portability and the right to object to processing. You can also lodge a complaint with your local data protection authority.

14. Kids

ProveWorth is for adults. If you're under 16, please don't use the site. If we learn we've collected data from someone under 16, we delete it.

15. Security

We use standard security practices: encryption in transit, an encrypted database, access controls on admin functions and audit logs. Tokens that connect a business's outside accounts are stored encrypted. No system is perfectly secure. If we ever discover a breach affecting you, we'll notify you as required by Texas law and applicable federal law.

16. Changes to this policy

When we update this policy, we'll change the "Last updated" date at the top. For material changes, we'll notify registered users by email.

17. Contact

Use our contact page. We'll respond within a few business days.