Privacy Policy

Who we are

Proof Rail is a brand of House of Borel LLC, a Wyoming limited liability company, and House of Borel LLC is the data controller for the information described in this policy. Our mailing address is House of Borel LLC, 30 N Gould St, Suite # 56579, Sheridan, WY 82801, United States.

Proof Rail provides verification infrastructure for digital finance. This policy explains what information we handle when you visit this site, request access, or submit claims and evidence for verification.

Questions about this policy, or requests concerning your personal information, can be sent to privacy@proofrail.me.

Information we collect

Information you give us includes your name, work email, company, claim details, and supporting evidence or documents you send.

We may collect basic technical data such as browser type, device type, and pages viewed to keep the site working and secure.

Our own page-view counts use no cookies. For each page viewed we record the page, the referring website (its name only, not the full address), the device type, the country and any campaign tags in the link. To count visitors rather than views, we use an anonymous key derived from your IP address and browser with a secret that is held only in memory and replaced every day. Once the day ends, the key can no longer be linked back to an address, and visits on different days cannot be joined. Your IP address itself is not stored.

We use a small number of essential cookies to keep you signed in and the service secure. We do not use advertising cookies.

When enabled, optional PostHog analytics load only after you select Accept. You can decline or change this choice using Cookie settings in the footer. Essential sessions and basic first-party operational analytics are separate from optional analytics cookies.

How we use it

We use information to respond to requests, verify submitted claims, issue and maintain verification records, provide support, and improve the service. We do not sell your information.

Evidence and published records

Evidence you submit is used to verify a claim and is not published. A verification record can show the verified fact, evidence standard, record ID, and date checked. You decide which records are issued and where you share them.

The "Is this real?" check and lookup API

Anyone can check a handle, website, email address, wallet, company name or payment detail at proofrail.me/check, or through our public lookup API. We use what you enter only to look it up and show you the answer. We do not store it, and we do not write it to our logs.

The brand-deal email box on the same page reads only the sender's address from what you paste. The rest of the paste, such as the subject, body and recipients, is discarded at once, and the sender's address is checked in the same way and not stored.

To understand how the check is used, we keep daily totals of how many checks were made, grouped only by the kind of value (for example, a website or a wallet), whether a verified record was found, and whether the request came from our browser extension. These totals never contain the value checked.

To stop abuse, the number of checks from each IP address is counted in memory to apply a rate limit. That count is not written to our database or logs.

The check page and the lookup API carry the value in the web address, so it may appear in your own browser history.

Browser extension (coming soon)

We are preparing a browser extension that shows whether something on the page you are viewing has a Proof Rail record. It is not yet available. When it is, it will send to proofrail.me, and nowhere else, only these values: the domain of the site you are on (never the full address or path, and never the domain of a platform such as X or Gmail); @handles shown on x.com; wallet addresses shown on a page; and the sender address of an email you have open in Gmail (never its subject, body or recipients).

Each request carries one value, no cookies and no page content, and identifies itself as coming from the extension and its version. Each value is handled on our side exactly as described in section 05: we do not store it or log it.

Answers are kept for 10 minutes in your browser's memory so the same value is not looked up again, and are cleared when you close the browser. The extension contains no analytics or advertising code.

Legal basis

Where data-protection law requires a legal basis, we rely on: performing our agreement with you (to respond to requests, verify claims and maintain records); our legitimate interests in operating and securing the service; your consent where we ask for it; and compliance with legal obligations. You can withdraw consent at any time where consent is the basis.

Sharing and sub-processors

We share information only with service providers (sub-processors) who help operate the service, such as hosting, our payment processor and our email provider, with official registries, regulators, or networks used to check a claim, or where required by law.

Sub-processors act on our instructions under appropriate confidentiality and data-protection terms. We do not sell your information. A current, named list of our sub-processors is set out in our Data Processing Agreement at proofrail.me/dpa.

International transfers

We operate from the United Arab Emirates and are established in the United States, and our providers may process data in other countries. Where we transfer personal data across borders, we rely on appropriate safeguards, such as recognised transfer mechanisms and contractual protections.

Retention and security

We keep information for as long as needed to provide the service, maintain the integrity of issued records, and meet legal obligations. We apply safeguards appropriate to the sensitivity of the data.

Your rights

Depending on where you are based, you may request access to, correction of, or deletion of your personal information, object to or restrict certain processing, or ask for a copy in a portable form. Contact privacy@proofrail.me.

Deleting personal data does not necessarily withdraw a verification record you asked us to publish; ask us to revoke the record instead.

If you believe we have mishandled your data, you may lodge a complaint with your local data-protection authority; we would appreciate the chance to address it first.

Children

The service is intended for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 18.

Changes

We may update this policy as the service develops. Material changes will be reflected in the date at the top of this page.