PROOFPAY PRIVACY POLICY

Web / Off-Store Automated Extraction Version — International

Effective Date: 25 August 2026

Last Updated: 25 August 2026

1. Purpose and Scope

ProofPay is a product and brand operating under the DENXOR brand. DENXOR is a brand identity and is not represented in this Policy as a separately registered company. References to “ProofPay”, “DENXOR”, “we”, “us” or “our” refer to the person or persons responsible for developing and operating ProofPay, unless a separate legal entity is expressly identified in the relevant service.

This Privacy Policy is intended for users internationally. It is designed to provide a consistent baseline of privacy protections while recognising that privacy and data-protection laws differ between jurisdictions. Where mandatory local law gives a user stronger rights or imposes additional obligations, those rights and obligations will apply to the extent required.

This Policy applies to the ProofPay Web / Off-Store version, including its automated receipt-extraction functionality and browser-based transaction-management features.

2. Global Privacy Principles

ProofPay follows internationally recognised privacy principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

ProofPay will not intentionally collect more information than reasonably necessary for a stated purpose, and will not use personal information for materially incompatible purposes without an appropriate legal basis or notice where required.

3. Information We Process

Depending on the features used, ProofPay Web may process merchant names, transaction amounts, dates, transaction references, payment descriptions, categories, notes, receipts, screenshots, PDFs, extracted transaction fields, application preferences and limited technical information necessary for security and reliability.

4. Local Automated Receipt Extraction

ProofPay Web is designed so that, where local extraction is implemented, a receipt selected by the user can be processed directly within the browser or device.

Selecting a receipt for local extraction does not by itself mean that the underlying receipt is uploaded to ProofPay infrastructure. The extraction is intended to occur locally, and only the resulting information or other data deliberately submitted by the user is handled according to the relevant feature.

This distinction is central to ProofPay's privacy model: local document processing reduces unnecessary exposure of sensitive receipts and financial information.

5. Local Browser Storage

ProofPay Web may use local browser technologies such as local storage, IndexedDB, session storage, cache or temporary memory to support transaction records, preferences, sessions and processing.

Users can generally remove locally stored information through ProofPay's deletion controls or browser site-data controls. Browser or operating-system backups and caches may be subject to separate controls outside ProofPay's direct control.

6. Server-Side Processing

ProofPay Web distinguishes between local processing and server-side processing. A web service does not mean that every receipt or transaction record is automatically uploaded.

Where a feature requires remote hosting, authentication, synchronisation, support, backup or other server-side processing, information necessary for that feature may be transmitted and stored by the relevant service provider. The applicable feature disclosure should identify such processing where required.

7. Information We Do Not Need for Local Extraction

ProofPay Web does not need access to SMS messages, call logs, contact lists, precise GPS location, banking passwords, mobile-money PINs, card PINs or unrelated browsing history merely to perform local receipt extraction.

8. Uses of Information

Information may be used to perform receipt extraction, create and organise transaction records, classify information, display records, generate documents requested by the user, maintain security, prevent abuse, diagnose errors and comply with legal obligations.

ProofPay does not sell financial information or receipt contents and does not use transaction information for behavioural advertising.

9. Cookies and Similar Technologies

ProofPay Web may use cookies or similar technologies necessary for sessions, authentication, security and preferences. Non-essential analytics, tracking or advertising technologies, if introduced, will be disclosed and handled according to applicable legal requirements.

10. Security

ProofPay applies reasonable technical and organisational measures appropriate to the nature and sensitivity of the information processed. Depending on the version and feature, these may include local processing, data minimisation, encryption in transit, encrypted local storage, access controls, secure key management, PIN protection, rate limiting or escalating lockouts, temporary-file cleanup and secure software-development practices.

The Android implementation uses salted PBKDF2-HMAC-SHA256 PIN processing with 210,000 iterations and escalating PIN lockout measures. Its established SMS processing queue is designed to use encrypted application storage and Android security facilities. These controls reduce risk but cannot guarantee absolute security.

11. Retention and Deletion

Locally stored information may remain in the user's browser until deleted through ProofPay controls or browser site-data controls.

Remote information, if any, is retained only as long as reasonably necessary to provide the relevant feature, maintain security, prevent abuse, resolve disputes or comply with legal obligations.

If ProofPay provides account functionality, the service will provide an appropriate account-deletion mechanism where required.

12. Data Sharing

ProofPay does not sell, rent or trade personal information. Information may be shared only where reasonably necessary for requested functionality, essential infrastructure, security, abuse prevention, legal compliance or protection of users and legal rights.

13. Analytics and Advertising

ProofPay aims to minimise analytics. Technical diagnostics may be used to maintain reliability and security. Receipt contents and transaction information are not intended to be supplied to analytics providers merely for advertising.

ProofPay does not sell financial information to advertisers or use transaction information for behavioural advertising.

14. Legal Bases

Where a jurisdiction requires a legal basis for processing, ProofPay will seek to rely on an appropriate basis depending on the purpose and circumstances. Potential bases may include performance of a contract or provision of a requested service, compliance with a legal obligation, legitimate interests that are not overridden by applicable rights, consent where consent is required or appropriate, protection of vital interests, or another lawful basis recognised by applicable law.

Where consent is the applicable basis, users may withdraw consent where the law provides that right. Withdrawal does not necessarily affect processing that was lawfully carried out before withdrawal.

15. International Data Transfers

ProofPay may use infrastructure or service providers located in countries other than the country in which a user lives. Where personal information is transferred internationally, ProofPay intends to use a lawful transfer mechanism where required, such as an adequacy decision or regulation, appropriate contractual safeguards, approved standard contractual clauses or equivalent safeguards, binding corporate rules where applicable, or a legally recognised exception.

Where applicable law requires an assessment of the risks associated with an international transfer, ProofPay will take reasonable steps to perform that assessment and apply appropriate safeguards.

Users may contact ProofPay using the published privacy contact to request information about applicable transfer safeguards, subject to legitimate confidentiality and security limitations.

16. Your Privacy Rights

Depending on applicable law and the circumstances, users may have rights including the right to know or be informed about processing; access; correction or rectification; deletion or erasure; objection; restriction; withdrawal of consent; data portability; rights concerning certain automated decision-making or profiling; and the right to lodge a complaint with a competent privacy or data-protection authority.

Some rights are subject to legal exceptions, thresholds or verification requirements. ProofPay may need to verify the identity of the requester before releasing, correcting or deleting sensitive information.

Requests should be submitted through the privacy/support contact provided in the application, website or official ProofPay service. If a request is subject to a specific statutory response period, ProofPay will respond within the period required by applicable law.

17. California Privacy Rights

If California privacy law applies to you, you may have additional rights concerning notice, access, deletion, correction, portability, opting out of certain sales or sharing activities, and limitations on certain uses of sensitive personal information, subject to applicable statutory definitions and exceptions.

ProofPay does not sell personal information in the ordinary meaning of that term as a business model. If a future practice constitutes a “sale” or “sharing” under applicable California law, ProofPay will provide the notices and opt-out mechanisms required by law.

18. European Economic Area and UK

If the GDPR or UK GDPR applies, ProofPay will provide the information, rights and safeguards required by those regimes, including appropriate transparency concerning purposes, categories of data, recipients, retention, legal bases and international transfers.

Where applicable, users may contact a competent supervisory authority or data-protection regulator in their jurisdiction.

19. Other Jurisdictions

Where ProofPay is used in a jurisdiction with privacy laws that grant additional rights or impose additional obligations, ProofPay intends to honour those mandatory requirements. This may include rights concerning sensitive information, automated processing, direct marketing, cross-border transfers, children's information, deletion, portability or objection, depending on the applicable law.

20. Automated Extraction and Accuracy

Receipt extraction is a convenience feature and may incorrectly identify merchant names, amounts, dates, references or categories. Users should review extracted information before relying on it as a financial record.

The extraction feature is not intended to make legal, credit, employment, insurance or similarly significant decisions about users.

21. Children's Privacy

ProofPay Web is not designed as a child-directed financial application. We do not knowingly seek children's personal information in circumstances prohibited by applicable law.

22. Data Breaches

If ProofPay becomes aware of a security incident involving personal information, the responsible operator will assess and respond according to applicable law, including notifications where legally required.

23. Complaints

Users are encouraged to contact ProofPay first. Where applicable, users may also lodge a complaint with the competent privacy or data-protection authority in their jurisdiction.

24. Changes

This Policy may be updated when the service, processing activities, infrastructure, security practices or applicable laws change. The effective and last-updated dates identify the current version.

25. Contact

Privacy contact: denxorpraxis@gmail.com

Because DENXOR is a brand and not a registered company, the final published version should identify the actual legal person or registered entity responsible for the service wherever applicable or legally required.