Privacy Policy
1. Who this applies to
This Privacy Policy explains how COLLECTiT! ("COLLECTiT!," "we," "us"), a product of PROVE iT! Forensics, collects, uses, and protects information when you visit our marketing site, go through onboarding, or use the COLLECTiT! platform as a customer. It covers a few different kinds of data, handled differently:
- Account & visitor data — information about the people who use COLLECTiT!: names, emails, login activity, and information submitted through demo or contact forms. For this data, COLLECTiT! is the data controller.
- Case & evidence data — the evidence, case notes, and metadata a customer organization collects and stores in COLLECTiT! for its own investigations. For this data, COLLECTiT! acts as a data processor on the customer's behalf — the customer organization controls what's collected, retained, and deleted, not us. We built the platform so that we don't have standing access to case content in the ordinary course of business.
- Business verification (KYC) data — information collected during onboarding to verify the organization signing up is real, via our identity-verification vendor (Stripe Identity). This can include a government ID and a liveness/selfie check, processed by Stripe on our behalf.
2. Information we collect
- Account information — name, work email, organization, role, and password (stored as a salted hash, never in plain text).
- Usage & log data — login timestamps, IP address, session activity, and actions taken in the product, recorded in an audit log for security and accountability.
- Business verification data — processed via Stripe Identity as described above; we receive a verification result, not necessarily the raw document images, depending on how the vendor integration is configured.
- Case & evidence data — files, endpoint data, and case metadata that a customer's team collects through the platform, including via installed collection agents on enrolled devices.
- Contact & demo-request information — anything submitted through a "Book a Demo," waitlist, or contact form on this site.
- Billing information — subscription billing is handled by Stripe; COLLECTiT! does not store full card numbers on its own servers.
3. How we use information
- To provide, operate, and secure the COLLECTiT! platform, including authentication, role-based access, case management, and evidence collection for the organization that owns the data.
- To verify the legitimacy of organizations signing up, as part of preventing fraud and misuse of a platform designed to collect real evidence.
- To maintain the audit log that records administrative and security-relevant actions within an organization's own account.
- To respond to demo requests and inquiries.
- To improve the product, troubleshoot issues, and maintain reliability and security. We do not sell personal information, and we do not use case or evidence data for advertising or for training purposes outside the service.
4. Data sharing & subprocessors
- Infrastructure providers — COLLECTiT! is hosted on Google Cloud Platform in the United States.
- Identity verification — Stripe Identity, for business/onboarding verification.
- Payment processing — Stripe, for subscription billing.
- Within your own organization — case and evidence data is visible only to users your organization has granted access to.
- We do not share case or evidence data across organizations. Each organization's data is logically isolated from every other organization's.
- Legal process — because COLLECTiT! stores evidence customers use in real investigations, we may occasionally receive law enforcement requests, subpoenas, or litigation hold notices directed at a customer's data. Our default is to redirect such requests to the customer organization, since they control and own that data, and to notify the customer unless legally prohibited from doing so. We do not proactively disclose case data to third parties.
5. Data security
COLLECTiT! is built by a team with a forensics background, for the express purpose of producing evidence that holds up. This includes encryption in transit and at rest, hashed credentials, multi-factor authentication, role-based access control, and an audit log designed to record administrative and security-relevant actions. No system is perfectly secure, and we can't guarantee absolute security, but we design and operate the platform with that goal in mind.
6. Data retention
We retain account data for as long as an account is active, plus a reasonable period afterward for legal, security, and record-keeping purposes. Case and evidence data is retained according to the retention and legal-hold settings the owning organization configures; extending a case's retention (for example, for an active legal hold) is a feature the organization controls itself. An organization can request deletion of its own data by contacting us, subject to any active legal hold.
7. Your rights
Depending on where you're located, you may have rights to access, correct, export, or delete personal information we hold about you. If you're an end user inside a customer organization, the fastest path is usually through your organization's own admin, since they control your account and any case data associated with it. You can also contact us directly at support@collectitplatform.com.
8. International data transfers
COLLECTiT!'s infrastructure is currently hosted in the United States. If you're accessing COLLECTiT! from outside the United States, your information will be transferred to and processed in the United States.
9. Children's privacy
COLLECTiT! is a business product intended for use by investigators, IT, and HR professionals on behalf of their organizations. It is not directed at, and we do not knowingly collect information from, children under 16.
10. Changes to this policy
We may update this policy as COLLECTiT! evolves. We'll update the "Last updated" date above when we do, and for material changes we'll make a reasonable effort to notify account admins directly.
11. Contact us
Questions about this policy or how your data is handled: support@collectitplatform.com.