Privacy Policy

CurrentProof is committed to protecting the personal data of our users. This policy explains what data we collect, how we use it, who we share it with, and what rights you have under UK GDPR and the Data Protection Act 2018.

The data controller responsible for your personal data is Divine Ventures Group Ltd, trading as CurrentProof, a company registered in England and Wales under company number 17245470, with its registered office at 66 Paul Street, London, EC2A 4NA. We are registered with the Information Commissioner's Office under reference ZC172796. You can contact us about any privacy matter at privacy@currentproof.co.uk. If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office, the United Kingdom supervisory authority for data protection, at ico.org.uk.

Data you provide

Data collected automatically when you use the service

Some data is collected automatically when you use the service, including your IP address, login timestamps, and usage data. This happens as part of normal service operation and is used for security, fraud prevention, and service improvement.

Data from third parties

• Stripe: payment status, subscription tier, and billing history. No card details are stored by CurrentProof.
• Supabase: authentication and database provider. Acts as a data processor on our behalf.

We do not sell personal data to third parties. We do not use automated decision-making that produces legal or similarly significant effects. We do not intentionally collect or process any special category personal data (such as data revealing health, racial or ethnic origin, political or religious beliefs, or biometric data).

Marketing emails are sent using Resend (resend.com). You can opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email or by contacting us at privacy@currentproof.co.uk. Opting out does not affect transactional emails that are necessary to provide the service.

We do not share personal data with any other third parties except where required by applicable law or a binding legal order.

Where data is transferred outside the UK or EU, appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the ICO.

• Account data (name, email, profession): retained for the duration of your account plus 2 years after account deletion.
• Calculation data and projects: retained for the duration of your account. Deleted within 90 days of account deletion, or immediately on request.
• Billing records: retained for 7 years to comply with tax and accounting obligations.
• Contact form messages: retained for 2 years.
• Enquiry and customer relationship records held in HubSpot: retained for 2 years from our last contact with you.
• Security and access logs: retained for 12 months.

On account deletion, personal data is anonymised or deleted within 90 days unless a longer retention period is required by law.

Under UK GDPR, you have the following rights:

• Right of access: request a copy of the personal data we hold about you (DSAR).
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data in certain circumstances.
• Right to restriction: request that we restrict processing of your data.
• Right to portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest.
• Right to withdraw consent: withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at privacy@currentproof.co.uk. We will respond within 30 days.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

When you first visit, a banner asks whether you accept analytics cookies. Declining is as easy as accepting, and the site works the same either way. Until you accept, HubSpot sets no analytics cookies and links nothing to you. It still counts the visit in an anonymous total of page views.

If you accept, HubSpot records which pages of this site you view, which links you click, and when. If you have sent us an enquiry, or you sign in to CurrentProof, those page views are linked to your contact record so that we can see which pages you have read. We use this to understand which parts of the site are useful and to follow up enquiries. We do not use it for advertising and we do not sell it.

You can change your choice at any time using the cookie settings link at the foot of every page, or by clearing this site's cookies in your browser.

Aggregate page performance data is also collected by Vercel Analytics and Vercel Speed Insights. Both are cookie free and do not track individual users.

A small set of product events, such as starting a sign-up or reaching a Professional calculator, is recorded in our own database (hosted by Supabase). These records hold the event name, the page and fixed descriptive values only. They contain no name, email address, account ID or IP address, and are not shared with any analytics provider.

To improve the sign-up page we sometimes show visitors one of two versions of it. Your browser's local storage remembers which version you were shown, so it stays the same on your next visit, and briefly holds an unsaved calculation while you create an account so that it can be saved to that account. No cookie is set for either. You can clear both at any time by clearing this site's data in your browser.

• All data is transmitted over HTTPS/TLS encryption.
• Passwords are hashed using industry-standard algorithms. We do not store plaintext passwords.
• Access to production systems is restricted to authorised personnel only.
• Supabase, our database provider, holds SOC 2 Type II certification. See supabase.com/security.

In the event of a personal data breach, we will notify the ICO within 72 hours where required by UK GDPR, and affected users where there is a high risk to their rights.

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we discover that an account has been created by someone under 16, we will delete the account and associated data promptly.

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page will reflect any changes.

For material changes, we will provide at least 14 days' notice by email or in-app notification before the updated policy takes effect.

For privacy-related enquiries, to exercise your data rights, or to submit a DSAR:

• Email: privacy@currentproof.co.uk
• Web: currentproof.co.uk/contact

ICO details: ico.org.uk · 0303 123 1113

We are not required to appoint a statutory Data Protection Officer under the UK GDPR, and we have not appointed one voluntarily. You can raise any question about how we handle your personal data, or exercise any of your data protection rights, by contacting us at privacy@currentproof.co.uk.