ProofChain LLC — Privacy Policy
Last updated: September 20, 2026 · Effective: September 20, 2026
1. Who we are
This Privacy Policy explains how ProofChain LLC, a Wyoming limited liability company ("ProofChain," "we," "us"), handles personal data across our products, including Sentra (a security-checkpoint API), MailFrame, and Sovereign.
Contact for privacy matters: mailframeapp@gmail.com · ProofChain LLC, 5830 E 2nd St, Ste 7000 #38324, Casper, Wyoming 82609, USA.
This policy focuses on Sentra. MailFrame maintains its own product-specific privacy notice.
2. Our roles (controller vs. processor)
Our role depends on the data:
- Controller — for data about our customers and their account/billing (e.g., the name, email, and business name of the person who buys Credits) and for our own operational and security data. We decide how and why this is processed.
- Processor — for personal data that a customer submits to the Sentra API to be evaluated or executed ("Customer Content"). Here the customer is the controller and we process on their instructions to provide the Service. Customers are responsible for having a lawful basis to submit such data. A Data Processing Agreement (DPA) is available on request.
3. What data we collect and process
Account & billing data (controller). When you purchase, our payment processor collects your name, business name, and email and shares limited transaction details with us. We do not receive or store your full payment-card number — that is handled by Stripe.
API credentials. We issue you an API key. We store only a one-way hash (SHA-256) of your key, never the key itself.
Usage & metering data (controller). Counts of API calls, timestamps, and Credit consumption, used for billing, support, and abuse prevention.
Technical & log data (controller). IP addresses and request metadata, used for rate limiting, security, and fraud prevention. (Your IP may be derived from network headers set by our CDN.)
Customer Content (processor). Data you send to the API — request parameters (e.g., session identifiers, resource/action descriptors) and, for /run_in_seed, the payload you submit for execution. Payloads are executed in an isolated, disposable sandbox and the sandbox is destroyed after use.
Support communications (controller). If you email us, we receive your message and email address via our email provider.
What we do NOT do: Sentra's risk engine is rule-based. We do not send your requests or Customer Content to any third-party AI/LLM provider for processing.
4. Why we process it, and our legal bases (GDPR)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the Services; issue keys; run evaluations/sandboxes | Performance of a contract (6(1)(b)) |
| Billing and payments | Contract (6(1)(b)); legal obligation for records (6(1)(c)) |
| Security, rate limiting, fraud/abuse prevention, infrastructure protection | Legitimate interests (6(1)(f)) |
| Service improvement and support | Legitimate interests (6(1)(f)) |
| Tax and accounting records | Legal obligation (6(1)(c)) |
| Marketing (if any); non-essential cookies (if any) | Consent (6(1)(a)) |
5. Third parties / subprocessors
We rely on the following providers. All are located in / process data in the United States.
| Subprocessor | Purpose |
|---|---|
| Stripe, Inc. | Payment processing and card data |
| Render | Application/API hosting |
| E2B | Isolated sandbox execution of /run_in_seed payloads |
| Cloudflare, Inc. | Network, CDN, and DDoS protection in front of the API |
| GitHub, Inc. | Hosting of the Sentra web pages |
| Google LLC (Gmail) | Support email communications |
We do not sell personal data. We share it only with these providers to run the Services, or where required by law. We maintain a current list of subprocessors; a detailed subprocessor list is available in our Data Processing Agreement (DPA).
We do not currently deploy third-party advertising or analytics trackers on the Sentra pages.
6. International data transfers
We are a US entity and our subprocessors are in the US. Where we process personal data of individuals in the EEA/UK, transfers rely on appropriate safeguards such as the EU-US Data Privacy Framework (where the recipient is certified) and/or Standard Contractual Clauses.
7. Data retention
We keep personal data only as long as needed for the purposes above:
- Account/billing data: for the life of the relationship and then as required for tax/accounting (typically 7 years).
- API key hashes: until the key is revoked/expired.
- Usage/metering & logs: 12 months.
- Customer Content / sandbox payloads: ephemeral — destroyed with the sandbox and not retained beyond what is needed to return a result.
8. Your rights
Depending on your location (including under the GDPR), you may have the right to: access your data; rectify inaccurate data; erase data; restrict or object to processing; data portability; and to withdraw consent where processing is based on consent.
To exercise these rights, email mailframeapp@gmail.com. For personal data we process as a processor (Customer Content), please contact the relevant customer (the controller); we will assist them.
You also have the right to lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali, or your local EEA authority.
9. Security
We use measures including encryption in transit (TLS), storing API keys only as hashes, isolating untrusted execution in disposable sandboxes, rate limiting, and access controls. No method is perfectly secure; we cannot guarantee absolute security.
10. Children
The Services are for businesses and are not directed to children, and we do not knowingly collect data from anyone under 16.
11. Cookies
The Sentra pages use only what is necessary to function.
12. Changes
We may update this policy; we will revise the "Last updated" date and, for material changes, take reasonable steps to notify you.
13. Contact
Privacy questions: mailframeapp@gmail.com · ProofChain LLC, 5830 E 2nd St, Ste 7000 #38324, Casper, Wyoming 82609, USA.