Privacy policy.

Effective: June 21, 2026

Who we are

ProphyCapture, a ProphyPost software product, is the controller of personal information used to provide the ProphyCapture Windows TWAIN camera bridge, workstation licensing, client accounts, and support. Contact the controller at info@prophycapture.com or through the Privacy Center.

Information we collect

• Purchase and account information: name, email address, company name, workstation quantity, account credentials stored as password hashes, purchase status, and transaction identifiers.
• License information: license key, license status, allowed and used activation counts, and license creation and update dates.
• Workstation activation information: a one-way hash derived from the Windows MachineGuid, application version, activation timestamps, and a random activation identifier. We do not store the raw MachineGuid after hashing.
• Support information: name, email address, license key when provided, device and application details, ticket messages, ticket status, and support notes.
• Security and service information: limited audit events and keyed references used to detect abuse, enforce rate limits, investigate failures, and protect accounts. Audit records do not retain raw IP addresses, customer emails, license keys, or Stripe session IDs.
• Payment information: Stripe processes payment card details. ProphyCapture receives payment status, amount, customer contact information, and transaction identifiers, but does not receive or store full card numbers.

How information is collected

Information is collected when you purchase a license, activate the installer, sign in to the client portal, submit a support ticket, communicate with support, or use account and licensing features. Payment and email providers also return transaction or delivery information needed to complete those services.

Why we use information

• Process purchases and provide the licenses and account access you request.
• Activate software and enforce per-workstation license limits.
• Authenticate users, secure accounts, prevent fraud, and investigate misuse.
• Deliver transactional license and account emails.
• Respond to support tickets and maintain service history.
• Maintain financial, tax, dispute, and compliance records.
• Operate, troubleshoot, and improve the reliability and security of the service.

Legal bases for international users

• Contract and pre-contract steps: purchases, account creation, licensing, activation, delivery, refunds, and requested support.
• Legitimate interests: service security, fraud prevention, troubleshooting, abuse prevention, business administration, and improving reliability. These interests are balanced against individual rights and expectations.
• Legal obligations: tax, accounting, consumer-protection, security, dispute, and regulatory records.
• Consent: used only when required for a genuinely optional purpose. ProphyCapture does not currently send marketing email or use nonessential tracking cookies.

Cookies

ProphyCapture uses only first-party session cookies needed to sign administrators and clients in securely. These cookies are not used for advertising, cross-site tracking, or analytics. Because no nonessential tracking cookies are currently used, the site does not display a cookie-consent banner. If tracking or advertising technologies are added, this policy and the consent controls will be updated before they are enabled.

How information is disclosed

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. Information is disclosed only as needed to the following service providers or circumstances:

• Stripe: payment processing and transaction records.
• Twilio SendGrid: transactional email delivery.
• Render and its infrastructure providers: application hosting, storage, networking, and security.
• Hostinger: domain email and related mail services.
• Professional advisers and authorities: when reasonably necessary for legal compliance, fraud prevention, security, accounting, insurance, or legal claims.
• Business transfers: if the product or business is reorganized, sold, or transferred, subject to appropriate confidentiality and notice requirements.

Data retention

• Accounts and licenses: while active and generally up to seven years afterward for tax, accounting, fraud, warranty, dispute, and legal records.
• Paid orders and refunds: generally seven years after the transaction.
• Support tickets: generally three years after closure unless a longer period is needed for a dispute or legal obligation.
• Activations: while the license is active and generally no more than twelve months after revocation or approved account deletion, unless an exception applies.
• Security audit events: capped at 1,000 events and generally retained no longer than twelve months.
• Privacy requests: generally retained for at least twenty-four months to demonstrate compliance and prevent duplicate or fraudulent requests.

Data may be retained longer when required by law, litigation hold, fraud prevention, security investigation, or the rights of another person. Data no longer needed is deleted, anonymized, or reduced.

Security

ProphyCapture uses access controls, password hashing, secure session cookies, rate limiting, request validation, encrypted HTTPS transport, signed activation records, restricted data files, and reduced audit logging. No method of storage or transmission is completely risk-free, so absolute security cannot be guaranteed.

Your privacy choices and rights

Depending on where you live, you may request access or knowledge, correction, deletion, restriction, portability, objection, limitation of sensitive-information use, or an appeal. You may withdraw consent where consent is the legal basis. You may also complain to a privacy regulator. ProphyCapture does not discriminate or retaliate against anyone for exercising a privacy right.

Use the Privacy Center, email info@prophycapture.com with the subject "Privacy Request," or use the support form. Logged-in clients can download a structured JSON copy from the client portal. We may reasonably verify identity and authority before disclosing, correcting, or deleting information. Requests are logged with acknowledgement and response deadlines.

EU and EEA individuals may complain to the supervisory authority where they live or work, and UK individuals may complain to the Information Commissioner's Office. California consumers may contact the California Privacy Protection Agency or California Attorney General.

Information required to provide the service

Name, email address, workstation quantity, payment confirmation, account credentials, license information, and a hashed workstation identifier are necessary to complete a purchase, provide an account, issue and activate licenses, and prevent misuse. If required information is not provided, ProphyCapture may be unable to complete the purchase or provide the requested service. Company name, optional ticket details, and other clearly optional fields are not required unless needed to resolve a specific request.

California notice

The categories collected are identifiers, commercial information, internet or electronic activity, professional information, customer communications, and account credentials. Sources include you, your organization, the ProphyCapture application, Stripe, and service-security records. These categories are used for the business purposes described above and may be disclosed to service providers that support payment, email, hosting, security, and legal compliance.

ProphyCapture has not sold personal information or shared it for cross-context behavioral advertising in the preceding twelve months and does not use sensitive personal information to infer characteristics. It therefore does not display a sale/sharing opt-out mechanism or process Global Privacy Control as an opt-out signal. If those practices change, an opt-out method and GPC handling will be implemented before the change. See the Notice at Collection.

California requests are acknowledged within ten business days and generally answered within forty-five calendar days, subject to permitted extensions. Authorized agents may submit requests, but authorization and the consumer's identity may be verified.

Children

ProphyCapture is a business software product and is not directed to children under 13. Accounts and purchases must be created by adults who are authorized to act for themselves or their organization. If we learn that information was submitted by a child under 13 without appropriate authorization, we will delete it.

International processing

The service is operated from the United States. Stripe, Twilio SendGrid, Render, Hostinger, and their authorized subprocessors may process information in the United States or other countries. Where GDPR or UK GDPR transfer restrictions apply, ProphyCapture will rely on an adequacy decision, applicable certification framework, Standard Contractual Clauses, the UK transfer addendum or IDTA, or another lawful safeguard, together with supplementary measures when required.

If ProphyCapture intentionally offers services to individuals in the EU, EEA, or UK in a manner that requires a local representative, representative details will be published here before that offering begins.

Automated decisions

ProphyCapture does not make decisions producing legal or similarly significant effects through automated decision-making or profiling. Automated checks are limited to security, rate limits, payment validation, and workstation license limits, with support available for review.

Changes to this policy

Material changes will be posted on this page with a new effective date. If a change materially affects how existing personal information is used, additional notice will be provided when required.

Contact

Email: info@prophycapture.com
Privacy requests: prophycapture.com/privacy-request
Support: prophycapture.com/support