Privacy policy

The data controller is Andrea Bertolino.

For any question about the processing of personal data, or to exercise your rights, you can write to info@pruvee.com.

No data protection officer (“DPO”) had been appointed as at the date this policy was last updated.

Data you provide to us

When you create an account or use Pruvee we may process:

• account data, such as email, username, role and account identifier;
• your password, stored in a non-readable form and never in clear text;
• profile data, such as first name, last name or company name, city, sector, bio, job title, experience, availability and declared skills;
• website, portfolio, company size, year founded, profile picture and VAT number, where provided;
• published content, such as videos, images, documents, texts, pruvee, comments, offers, applications, challenges, supply requests and proposals;
• messages exchanged with other users or with Pruvee;
• informazioni relative ad appuntamenti, team, collaborazioni e videochiamate.

Data generated by your use of the service

We may process:

• follows, likes, saves, shares and content hidden or muted;
• blocked users and reports;
• actions taken on the platform and other technical events needed to understand how the service is used;
• pages visited, time spent and the channel the visit came from (for example a link posted on a social network or a search engine), which is associated with the account at sign-up;
• the results of the automated analysis described in section 5;
• IP address, device data, technical logs, sign-in data and information required for security.

Data received from third parties

If you choose to sign in with Google or with Apple, we receive from the provider you chose the data needed to create or link your account, which may include:

• nome;
• cognome;
• email address;
• your account identifier with the provider.

With Sign in with Apple you can choose not to share your real address: in that case we receive an anonymous address generated by Apple (@privaterelay.appleid.com) that forwards our messages to your mailbox. Apple also provides your first and last name only the first time you authorise Pruvee.

If a user invites you to join a team or to collaborate, we may receive your email address and the information needed to manage the invitation.

When we receive data from parties other than you, we use that data for the purposes described in this policy and, where necessary, provide the information required by Article 14 GDPR in a manner appropriate to the context.

Special category data

Pruvee does not ask for data concerning health, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation, genetic data, biometric data used to identify a person, or other special categories of personal data.

Do not publish in your pruvee, messages or other content:

• health data;
• patient or client data;
• biometric data;
• criminal-offence data;
• confidential information belonging to employers or principals;
• personal data of third parties without a valid legal basis and the necessary authorisations.

If content contains special category data or personal data of third parties, we may limit its visibility, remove it or take other measures provided for in the Terms of Use.

We process personal data for the following purposes.

Creating and managing your account

To create your account, authenticate you, manage your profile and let you use the platform's features.

Legal basis: performance of a contract, Article 6(1)(b) GDPR.

Providing Pruvee's features

To let you:

• publish and view pruvee;
• build a professional profile;
• follow users and join teams;
• send and receive messages;
• publish or view opportunities;
• send applications and proposals;
• take part in challenges;
• publish supply requests;
• schedule appointments;
• join video calls.

Legal basis: performance of a contract, Article 6(1)(b) GDPR.

Account verification and security

To verify your email address, handle password recovery, enable two-step verification, prevent unauthorised access and protect the platform.

Legal basis: performance of a contract and legitimate interest in the security of the service and its users, Article 6(1)(b) and (f) GDPR.

Content analysis and suggestions

To analyse published content, extract information about demonstrated skills, organise content, suggest relevant opportunities and content, and rank some of the platform's results.

Legal basis: performance of a contract, Article 6(1)(b) GDPR, where the analysis is necessary to provide Pruvee's core features.

How the analysis works is described in section 5.

Service communications

To send you emails and notifications needed for your account to work, such as verifications, invitations, updates, security alerts and messages about your activity.

Legal basis: performance of a contract, Article 6(1)(b) GDPR.

Moderation and abuse prevention

To detect, prevent and handle spam, fraud, impersonation, harassment, unlawful content, breaches of the Terms, abusive access and security threats.

Legal basis: the legitimate interest of Pruvee and of other users in the security, integrity and proper functioning of the platform, Article 6(1)(f) GDPR.

Improving the platform

To understand how Pruvee's features are used, identify errors, improve the user experience and develop new features.

Statistics are processed in-house and, for this purpose, we do not use advertising platforms or third-party advertising profiling systems.

Legal basis: legitimate interest in improving and maintaining the service, Article 6(1)(f) GDPR.

Legal obligations and protection of rights

To comply with legal obligations, respond to legitimate requests from authorities, handle disputes and establish, exercise or defend a legal claim.

Legal basis: legal obligation or legitimate interest in protecting rights, Article 6(1)(c) and (f) GDPR.

Recording acceptances

We keep the version of the Terms and of the Policy you accepted, together with the date and the technical details needed to evidence that acceptance.

Legal basis: performance of a contract and legitimate interest in demonstrating the proper management of the relationship and protecting our rights, Article 6(1)(b) and (f) GDPR.

Some data is necessary to create your account and use Pruvee's main features. If you do not provide it, we may not be able to create the account or provide the service.

Other data, such as your bio, portfolio, skills, proof and company information, is optional. However, if you choose not to provide it, your profile may be less complete and some discovery, matching or application features may work less well.

Automated content analysis is a core feature of Pruvee.

When you publish a pruvee, the system may:

• extract frames from videos;
• transcribe the audio of videos uploaded as pruvee;
• analyse images, videos and texts;
• identify skills, themes and characteristics apparently demonstrated by the content;
• produce a summary;
• assign indicators relating to the apparent quality and authenticity of the content;
• generate a vector representation of the content, known as an embedding, used for search and for comparison with other content and opportunities;
• update indicators linked to your skills and published content.

These results may be used to:

• organise and suggest content;
• personalise the feed;
• suggest opportunities;
• determine the relevance of similar content;
• contribute to the calculation of the compatibility score;
• affect the order in which some applications are shown to the company managing an opportunity.

The system may therefore carry out profiling within the meaning of Article 4(4) GDPR.

Compatibility score

When you apply to an opportunity, the compatibility score may contribute to the order of the applications shown to the company.

The score may take into account, among other things, the match between required and demonstrated skills, the depth of the proof, indicators of content quality and how recent it is.

An application with a lower score may appear further down the list than others. The score is not a certification of your skills, does not represent an overall judgement of you as a person, and neither guarantees nor rules out being hired or entering into a professional relationship.

Human decisions

The score and the other automated results do not by themselves decide whether a person is to be hired, shortlisted, rejected or excluded from an opportunity.

Decisions on advancing or excluding an application are taken by the company or organisation managing the opportunity.

Pruvee does not take decisions based solely on automated processing that produce legal effects or similarly significant effects on a person.

You can ask for information about how these analyses work in general, express your point of view and contest a result by writing to info@pruvee.com. We will assess the request and, where necessary, carry out a human review.

AI infrastructure

The AI models used for the analysis are self-hosted and run on infrastructure under the controller's control.

User content is not sent to third-party artificial intelligence services and is not used to train or fine-tune the models of external providers.

This description assumes that the endpoints used in production remain under the controller's control. Should external AI services be used in future, this policy will be updated before the relevant processing begins, where the law requires it.

Video calls

Video calls are not recorded, transcribed or analysed by Pruvee.

Pruvee processes only the metadata needed to organise and run the session, such as participants, appointment and call status. The audio and video content of the call is routed in real time and is not stored by Pruvee.

When the account is created, the profile is public by default.

When the profile is public, your name or company name, bio, skills and any content set to public can also be viewed by people who are not registered.

Public content may be acquired and indexed by search engines. Pruvee does not guarantee that indexing will happen and cannot fully control how quickly search engines update or remove copies, caches or previews.

You can make your profile non-public from the privacy settings. You can also manage, using the features available, who can contact you and who can invite you to teams.

When you make content public, you allow it to be viewed according to the settings you have chosen. You can remove content or change its visibility, but removal cannot delete copies already received, downloaded, saved or shared by other users.

Other users

Data may be viewed by other users according to your visibility settings and the features used, including:

• visitors to a public profile;
• users who receive a message;
• users who belong to the same team;
• companies or organisations receiving an application;
• users who receive a proposal or a supply request;
• participants in an appointment or a video call.

Companies and organisations

When you send an application, a proposal, a challenge entry or a supply request, the receiving company or organisation may obtain your profile, the linked proof, the indicators and scores made available by the platform, and the messages relating to that interaction.

The receiving company or organisation processes that data for its own purposes, including assessing applications, recruitment, managing collaborations, evaluating proposals and managing the professional relationship.

For that processing, the company or organisation acts as an independent data controller and not as a processor on Pruvee's behalf. It is responsible for providing data subjects with the required information and for complying with applicable law.

Pruvee remains the controller for the processing needed to run the platform, transmit applications, provide matching, organise the feed, manage visibility settings, ensure security and moderate the service.

Technical providers

We use the following providers, which process data on our behalf as processors under Article 28 GDPR:

The artificial intelligence models do not appear in this list because they are not entrusted to third parties: they run on infrastructure under the controller's control, as described in section 5.

You can ask for up-to-date information about the processors, with their identifying details, by writing to info@pruvee.com.

Google and Apple

If you choose to sign in with Google or with Apple, the provider you chose processes the data relating to its own service as an independent controller under its own privacy policy.

For sign-in with Google or Apple we may receive the data needed to create or link the account, such as first name, last name, email and account identifier.

Authorities and other legitimate recipients

We may disclose personal data to public authorities, courts or other parties where we are required to by law or where disclosure is necessary to respond to a legitimate request, protect rights or prevent fraud and abuse.

We do not sell personal data and we do not transfer it to marketing companies or data brokers.

The platform's data resides in the European Economic Area. The database is hosted in Ireland, the application infrastructure in Germany, and the queues and file storage in European Union regions. The artificial intelligence models run on infrastructure under the controller's direct control.

Some of the providers listed in section 7 are companies based in the United States that deliver the service from European regions. In those cases the data remains stored in the European Economic Area, but access by the provider's support staff from a third country cannot be ruled out: such access takes place on the basis of the Standard Contractual Clauses adopted by the European Commission, with any additional safeguards required.

The domain mailboxes and the sending of service emails are entrusted to an Italian company and involve no transfers outside the European Economic Area.

The only thing outside this framework is signing in with Google or Apple, which happens only if you choose to use it: in that case the provider acts as an independent controller and processes the data under its own policy, including outside the European Economic Area.

You can request a copy of the safeguards in place by writing to info@pruvee.com.

The rule is simple: we keep data until you delete it. We apply no automatic expiry to your content and we do not remove it because it is old or inactive. It stays as long as you leave it published, and your account stays until you delete it.

When you delete content or your account, removal is immediate and permanent: there is no deactivation period and no bin to restore from. When an account is deleted we remove the files you uploaded from storage and delete your profile, content, messages, applications and related interactions. Internal usage statistics are left with no reference to you. Any accounts linked to yours are not deleted: they become independent again, because they belong to different people.

After deletion, only the exceptions set out below and in the “Profile and content visibility” section still apply: what other users have already received cannot be called back.

In particular:

• account and profile data is kept until the account is deleted, except where retention obligations apply or where it is needed to protect legal rights;
• published content stays available until you remove it, or until the account is deleted: no automatic expiry, except for temporary technical copies or retention required by law;
• messages may remain in the recipient's copy even if the sender removes them or deletes their account;
• data about applications, opportunities and interactions stays as long as the account does, because it records activity involving other users too and is needed to handle any related disputes;
• data about acceptance of the Terms and of the Policy is kept for as long as needed to evidence the relationship and protect our rights;
• technical and security logs are kept for as long as needed to prevent and handle incidents, abuse and unauthorised access;
• data we must keep for tax, accounting or legal obligations is kept for the period required by applicable law;
• data needed to establish, exercise or defend a legal claim is kept until the dispute is settled, and for any further period required.

For categories subject to legal obligations the periods are those laid down by applicable law; for the others, data is deleted or anonymised when it is no longer needed for the purpose it was collected for.

Any technical copies held in backups may remain available until overwritten according to the retention cycle of the system concerned: this is the only case in which deleted data can survive for a short period, and it is no longer accessible from the platform.

In the cases provided for by the GDPR you can:

• obtain confirmation as to whether personal data concerning you exists;
• obtain access to the data and a copy of it;
• request rectification of inaccurate or incomplete data;
• request erasure of the data;
• request restriction of processing;
• object to processing based on legitimate interest, on grounds relating to your particular situation;
• receive the data you provided to us in a structured, commonly used and machine-readable format, where the conditions for portability are met;
• contest the results of automated analysis and request a human review;
• withdraw any consent previously given, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, write to info@pruvee.com.

Please state, where possible, the right you wish to exercise and the information needed to identify your account. We may ask for additional information to verify your identity and prevent unauthorised access.

We will reply within one month of the request. That period may be extended by a further two months in complex cases, and we will tell you why.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or to go to court. Information about the Authority is available at garanteprivacy.it.

We apply technical and organisational measures appropriate to the nature of the data and the risks of the processing.

The measures used include:

• storing passwords in a non-readable form;
• encryption of communications in transit;
• access controls;
• separation of roles and permissions;
• technical and security logs;
• two-step verification tools, where available;
• measures to prevent and handle unauthorised access.

No system can be considered completely secure or invulnerable. If a personal data breach occurs that presents a high risk to your rights and freedoms, we will inform you in the cases and in the manner set out in Article 34 GDPR.

Pruvee is reserved for people aged 18 or over.

We do not intend to knowingly collect data about minors. If we learn that a minor has created an account, we will take reasonable steps to verify this and delete the account and the associated data, subject to legal obligations or the need to protect our rights.

Pruvee does not use profiling cookies, advertising cookies, Google Analytics, advertising pixels or third-party advertising tracking systems.

Pruvee uses some local browser technologies, including web storage, to keep the session active, remember interface preferences and measure in aggregated form which channels visits come from.

For more information see the Cookie policy.

We may update this policy to reflect changes to the service, to the processing, to our providers or to applicable law.

The updated version will be published on this page with its date and version number.

In the event of significant changes we will inform you by email, through a notice on the platform or by other appropriate means before the changes take effect, where applicable law requires it.