Privacy

Proveniro provides likeness rights infrastructure and AI synthetic media detection. For our website and our direct customer relationships we act as a data controller. For media and biometric data processed on behalf of a customer, we act as a data processor under that customer's instructions and a data processing agreement.

We collect three distinct categories of data, and we treat them differently.

• Website and contact data — name, work email, organisation, role and anything you write in an access request, plus standard server logs.
• Analysed media — audio, video or images submitted for AI verification by a customer, together with derived features, model outputs and the resulting verdict.
• Registry data — enrolment media, biometric templates, consent records and licence grants for individuals who choose to register a likeness.

Website and contact data is processed to respond to your enquiry and to operate the site, on the basis of legitimate interests and, where required, consent.

Analysed media is processed on our customer's instructions to determine whether media is AI-generated. Where that processing involves biometric data, the customer is responsible for establishing a lawful basis, and we provide consent-capture and notice tooling as well as a mode that scores synthesis without performing identity matching.

Registry data is processed on the basis of the explicit, recorded and revocable consent of the individual whose likeness it represents.

Three commitments that we treat as product constraints, not policy language.

• We do not use customer media or registry data to train or fine-tune any AI model.
• We do not sell personal data, and we do not share it with advertisers or data brokers.
• We do not retain raw media beyond the retention window configured by the customer.

Analysed media is retained for a period the customer configures, from zero-retention scoring up to ninety days. Evidence records outlive the media they describe, but contain hashes and metadata rather than the media itself.

Registry enrolment data is retained for as long as the enrolment is active. Revoking an enrolment deletes the biometric templates and invalidates any grants that depended on them.

Customers select a processing region — European Union, United Kingdom or United States — and media is processed and stored in that region. Where any transfer outside the selected region is required for support, it happens under appropriate safeguards and is disclosed in the data processing agreement.

Depending on your jurisdiction you may have rights to access, correct, delete, restrict or port your personal data, and to object to processing. Where we act as a processor, we will route your request to the relevant customer and support them in answering it.

To exercise a right, or to withdraw consent to an enrolment, write to privacy@proveniro.com. You also have the right to complain to your local supervisory authority.

Data is encrypted in transit with TLS 1.3 and at rest with AES-256. Biometric templates are encrypted with per-subject keys. Access is role-based, logged and reviewed. We are pursuing SOC 2 Type II, and we will share our current security documentation under NDA with prospective customers.

We will post material changes to this page and notify customers directly where the change affects processing under an existing agreement. Questions go to privacy@proveniro.com.