ProoV

Privacy policy

Effective Date: 3 October 2026

Welcome to Proov. We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (GDPR). This policy explains what data we collect, why we collect it, and your rights regarding your information.

0. Data Controller

The controller responsible for the processing described in this policy is Shubham Mandawewala, operating ProoV as a sole trader, Wilhelmstr. 27, 74072 Heilbronn, Germany. Full operator details are in our Impressum. You can reach us at [email protected].

1. Data We Collect

When you register and use Proov, we collect:

  • Account Data: Name, email address, password.
  • Profile Data: University, program, field of study, interests, bio, location, languages, GitHub/LinkedIn URLs, portfolio links, and uploaded resumes.
  • Usage Data: Pages visited, interactions, duration, referring URLs, IP addresses, and user agent strings.
  • Submission Data: Files and code you submit as part of your project evaluations.
  • Job Application Data: If you use our CV/Anschreiben builder (ProoV Jobs), we process the job ads you paste in, your CV/résumé content, and the cover-letter drafts you write. If you use the tool as a guest, this content is stored on your device only, until (and unless) you sign in to save it to your account.
  • Class Data: If your professor runs a class on ProoV, we hold the name, email address and group your professor put on the invited list, any invitation sent to you, any request you made for a place, and any message your professor sent the class. Your professor sees this; ProoV staff see it only to support them.
  • Company account data: If you open a company account: your name and work email, the company name, website and country you give us, the legal notice (Impressum) you add, documents you upload to prove the company (such as a register excerpt), and which version of the employer terms you accepted and when. See Company accounts and verification.
  • Report data: If you report content to us: what you report and why, and, if you are not signed in, the email address you leave. See Reports about content.

2. How We Use Your Data

We process your personal data under the following legal bases:

  • Contractual Necessity: To provide our services, manage your account, and evaluate your project submissions.
  • Legitimate Interest: To secure the platform (e.g., using Cloudflare Turnstile), prevent fraud, and analyze system performance.
  • Consent: To track detailed behavioral analytics, which we only perform if you explicitly accept our cookies; and, separately, to create a session for you, store your CV/letter content, and send that content to Azure OpenAI for AI-assisted drafting when you use the Jobs CV builder — each asked for individually before you start, not bundled into one blanket agreement.

3. Data Storage and Sub-Processors

Your data is hosted within the European Union, in Microsoft Azure’s North Europe region. We use the following service providers (sub-processors) to run Proov:

  • Microsoft Azure (App Service / Container Apps, PostgreSQL, Blob Storage): Our core cloud infrastructure, database, and file storage.
  • Azure OpenAI Service: Used to evaluate criteria-based project submissions, and to help draft/check CVs and cover letters in the Jobs builder. We disable data logging and model-training use on these services, so your submissions and documents are never used to train AI models. When a professor imports a student list, an assistant may see the column headers and masked samples to work out which column holds the address. It never sees a name or an address.
  • Azure Communication Services (ACS): Sends our system and account emails (e.g. sign-in links, notifications).
  • Cloudflare: Website security, performance routing, and bot protection.

Separately, ProoV Jobs displays public job listings sourced from the German Federal Employment Agency’s (Bundesagentur für Arbeit) open Jobsuche API. This is a one-way data feed — we read public job postings from it; we never send your personal data, CV, or any account information to that API.

4. Sharing with Sponsoring Companies

Proov projects are set by sponsoring companies. When you take part in a company’s project and rank among the strongest candidates, your shortlisted profile is shared with that company so they can assess your work and consider you for hiring. What we share is limited to your name, your profile details, your verified score, and your scorecard.

Integrity checks we run during evaluation (for example, flags for possible plagiarism or AI-generated work) are used internally only. They are never shared with sponsoring companies. We do not sell your personal data to anyone.

Company accounts and verification

Companies can open an account on ProoV to post jobs for students. ProoV checks every company before its jobs can go live, to keep students safe from fake employers and recruitment scams.

  • What we check: whether the work email is on the same domain as the company website; whether it is a free email address; whether the website’s domain receives email and the website answers over HTTPS; whether the legal notice on the website names the company; whether the company name looks like another company on ProoV or an employer in the public job listings we show; how many student accounts use the email domain; look-alike letters in the name; and the type of company. To do this we read public pages of the company website, and we check them again every week after approval.
  • Who decides: these checks run automatically, but they never approve or reject a company on their own. A person at ProoV decides, and may ask for a register excerpt, send a code to a role address on the company’s domain (such as jobs@), or call the phone number in the legal notice on the company website.
  • Who sees it: ProoV staff. A company sees every decision about it with the reasons, but not the check results. When we approve a company, we write to the contact address in its legal notice, so that the company knows an account exists.
  • Signup limits: to stop mass signups we count company signups per email domain and per network each day. For the network we keep a keyed, one-way hash of the IP address, never the address itself.
  • Legal basis: providing the company account that was asked for (GDPR Art. 6(1)(b)) and our legitimate interest in keeping fake employers off ProoV (GDPR Art. 6(1)(f)).
  • How long: documents uploaded as proof are deleted 90 days after our decision, or 12 months after the last upload if we never decide. The legal notice stays while the company account exists, and it is shown on the company’s job pages once they go live.

Reports about content

Anyone can report a job ad, a company or anything else on ProoV at projectstudy.in/report, with or without an account.

  • What we keep: what you report, the reason, your description and the link you give us. If you are signed in, we link the report to your account; if not, you can leave an email address.
  • Your email address as a guest: we send it one email asking you to confirm it, and we write to it again only after you confirm, to acknowledge your report and to tell you our decision. We never repeat your report in an email.
  • Your IP address: we do not store it. We keep a keyed, one-way hash of it to limit how many reports one network can send in a day. Cloudflare Turnstile checks that a guest is a person before a report is sent.
  • Who sees it: the people at ProoV who decide reports. We do not give your name or email address to the company or person you report, unless the law requires it.
  • Legal basis: our legal duty to handle notices about illegal content under the Digital Services Act (GDPR Art. 6(1)(c)) and our legitimate interest in keeping ProoV safe (GDPR Art. 6(1)(f)).
  • How long: your email address and the IP hash are deleted 6 months after our decision, or 6 months after you sent the report if we have not decided by then. If you never confirm your email address, we delete it after 7 days. The report and our decision are kept as the record of how we handled it.

5. Data Retention

We keep your personal data only for as long as needed for the purposes in this policy. When you delete your account from your settings, we erase your personal data and the files you uploaded with your submissions. To keep certificates you have already earned verifiable, the underlying evaluation and certificate records are kept in pseudonymized form: they no longer identify you, but the verified result stands. We aim to remove your data from active systems and backups within 30 days. Six months after the class is archived or closes, class invitations, requests and unclaimed invited-list entries are deleted, the name and group on any invited-list entry you claimed are cleared, and the text of any message sent to the class is removed, though its subject and audience stay on the record. Your membership, marks and results stay with the class as the professor’s record.

6. Your GDPR Rights

Under the GDPR, you have the right to:

  • Right to Access & Portability: Export a copy of your personal data as a machine-readable JSON file at any time from Settings → Your data.
  • Right to Rectification: Edit your profile information from your dashboard.
  • Right to Erasure: Delete your account and your personal data from Settings → Danger zone. This erases your profile data and uploaded files; records needed to keep issued certificates verifiable are retained in pseudonymized form (the "Right to be Forgotten").

7. Integrity Checks in Projects

Some projects run automatic integrity checks alongside your project evaluation, to help keep certificates trustworthy. These checks only ever compare things a machine can check for certain — they never guess at how you feel, how confident you sound, or who you are.

  • How you wrote an answer, never what you wrote: for a few long written answers, we record simple counts — how many characters you typed versus pasted, how big the largest paste was, how long you spent — never the text itself, and never anything you copy or cut on your own device outside the answer box.
  • Numbers made just for you: some projects give each student their own set of numbers to work with (a revenue table, a fan list, a budget), so two students working through the same project are not handed the same figures to compare or copy.
  • A short spoken or typed defence: a few projects end with two short questions about your own work, answered out loud or typed, whichever you prefer. If you speak, your voice is turned into text and the audio is thrown away right after — we never keep a recording of your voice. We do not try to identify you from your voice, and we never read your tone, stress, or confidence into it.
  • A human reviews anything unusual, nothing fails on its own: if a check flags something — a copied figure, an inconsistent answer, a mismatched number — a person looks at it before any certificate decision is made. No automatic check on this platform can fail you by itself.
  • Never shown to you or to companies: these flags and writing-style counts are for our internal review only. They are never shown to you, never shown to a sponsoring company, and never sent to the AI model that grades your work.

Legal basis: we run these checks under Legitimate Interest (GDPR Art. 6(1)(f)) — keeping certificates meaningful for the students who earn them honestly. You can object to this processing at any time by writing to [email protected]; we will consider your objection and reply.

Retention: the writing-style counts described above are automatically cleared, on a scheduled daily cleanup job, 90 days after your last activity in that project session, and separately from the saved copy attached to your submission 90 days after you submitted. A defence recording is never stored at all — it exists only for the seconds it takes to turn it into text, then it is discarded from memory. Internal review flags and notes follow the same rules as the rest of your submission data (see Section 5, Data Retention, above).

For questions, data access requests, or privacy concerns, please email us at [email protected].