Privacy Policy

1. Who we are

ProofChain is a product of HKMM Group Inc. ("ProofChain", "we", "our"), an Ontario corporation with its registered office at 146 Thirtieth Street, Suite 100, Etobicoke, Ontario M8W 3C4, Canada. We act as data controller for the personal information described below. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws — including British Columbia PIPA, Alberta PIPA, and Quebec's Act respecting the protection of personal information in the private sector (Law 25).

Privacy Officer / Person in charge of the protection of personal information: the President of HKMM Group Inc., reachable at privacy@proofchain.world or +1 289-643-9839. This person approves our privacy practices, signs off on privacy impact assessments, and handles every request and complaint.

2. What we collect

• Account data: email, display name, hashed authentication credentials, multi-factor secrets.
• Home data you or verified partners submit: address, permits, work orders, receipts, photos, warranty documents, utility, tax and HOA statements, insurance policies, inspection reports.
• Verification evidence: postal PIN confirmations, bills, land-registry or notary documents you upload to prove ownership.
• Usage: page views, feature usage, device and browser data, IP address (hashed for audit), crash breadcrumbs.
• Communications: support messages, consent records, email delivery events.

Payment card details are collected and processed by Paddle.com as Merchant of Record. We never see or store your card number.

3. How we use it, and on what basis

• Performing our contract with you: operating the Home Passport, verifying ownership, producing reports, processing subscriptions.
• Legitimate interests: fraud prevention, security, service improvement, aggregated analytics.
• Your consent: optional analytics cookies, marketing emails, publishing a public passport page, sharing a Buyer Trust Pack.
• Legal obligation: tax records, responding to lawful demands, breach reporting.

We do not sell personal information and we do not build advertising profiles.

4. Automated decisions

The Trust Score of a home and the trust score of each data source are calculated automatically. We tell you which factors are used and you may submit observations and obtain human review — see Automated decisions & the Trust Score. These scores are never used to decide credit, insurance or employment.

5. Public pages and your control

A Home Passport is private by default. A public page exists only when the verified owner switches public sharing on, and it shows the address, trust grade, source ledger and events the owner marked public — never amounts, policy numbers, documents, notes or owner identity. Owners can unpublish instantly from the Visibility & trust tab of a home. Anyone else can ask us to remove, correct or de-index a page through our takedown and correction form.

6. Your rights

• Access: download every record we hold on you as JSON from Privacy & sessions.
• Correction: edit your profile, correct a fact in the passport, or dispute an attestation.
• Erasure: request account deletion in the same place. We review within 30 days. Signed attestations another party submitted on a home may be retained in anonymized form for ledger integrity.
• Portability (Law 25): the JSON export is a structured, commonly used, machine-readable format.
• De-indexing / cessation of dissemination (Law 25): use the takedown form above.
• Withdraw consent: cookie preferences, marketing emails and public sharing can be turned off at any time.

We answer every request within 30 days, free of charge.

7. Retention schedule

• Account and profile data: while the account is active, plus 12 months.
• Verification evidence (bills, registry documents): 24 months after the verification decision, then deleted.
• Passport events and attestations: for the life of the home on the ledger — this is the purpose of the service; they are dissociated from your identity when you close your account.
• Consent records and CASL proof of consent: 3 years after the consent ends.
• Security, audit and access logs: 24 months.
• Support correspondence: 24 months.

8. Security and breach response

Row-level security at the database, TLS in transit, encryption at rest, Merkle-anchored event history, least-privilege staff access with multi-factor authentication, and an audit log on every administrative action.

If a confidentiality incident presents a risk of serious injury or real risk of significant harm, we notify the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec where applicable, and affected individuals promptly. We maintain a register of confidentiality incidents for 24 months as required by PIPEDA and Law 25.

9. Service providers and subprocessors

• Lovable Cloud (managed database, storage, authentication) — Canada / United States.
• Paddle.com Market Ltd. — Merchant of Record: payments, billing, tax, invoicing — United Kingdom / European Economic Area.
• Lovable Emails — transactional email delivery.
• Google Maps Platform — address autocomplete and map display; addresses you type are sent to Google.
• Google Gemini (via Lovable AI Gateway) — reading receipts and bills you upload, drafting Home Coach summaries. Content is processed for your request only and is not used to train third-party models.

None of these providers has advertising rights over your data.

10. Data outside Quebec and Canada

Some providers process data in the United States and the European Economic Area. Before entrusting personal information outside Quebec we conduct the assessment required by Law 25, considering the sensitivity of the data, the purpose, the safeguards in place and the legal framework of the destination. Transfers rely on written contracts including standard contractual clauses or an adequacy decision. You may request a summary of an assessment.

11. Cookies

See our Cookie Policy. Only strictly necessary cookies run without consent; you can change your choices at any time from the banner or your privacy settings.

12. Children

ProofChain is not directed at anyone under 14 and we do not knowingly collect their personal information.

13. Contact and complaints

Privacy Officer / Person in charge of the protection of personal information:
HKMM Group Inc.
146 Thirtieth Street, Suite 100, Etobicoke, Ontario M8W 3C4, Canada
Email: privacy@proofchain.world
Tel: +1 289-643-9839

You may also lodge a complaint with the Office of the Privacy Commissioner of Canada or, if you reside in Quebec, the Commission d'accès à l'information.