Privacy Policy

ChecksTrue is a software service that checks whether documents, graphics, presentations and marketing assets are still on-brand.

For South African users, The Druff Technology Group is the responsible party under the Protection of Personal Information Act, 2013 (POPIA). For users in the European Economic Area or United Kingdom, we act as the data controller where we determine the purposes and means of processing personal data.

ChecksTrue was built by the founders of Druff, a creative and digital agency, who also operate Druff.io. ChecksTrue is run as a separate software service. Section 8 explains what that separation means for your information, and section 10 of the Terms of Service makes it a contractual commitment.

Our privacy contact and Information Officer contact is support@checkstrue.com.

Account information. Name, email address, company or workspace name, password credentials managed by our authentication provider, and user role and workspace permissions. We do not store plain-text passwords.

Brand Blueprint information. Logos, brand colors, font information, brand guidelines, brand reference files, website reference information, and notes or settings added by users.

Uploaded review assets. Documents, graphics, presentations, PDFs, images or other marketing assets uploaded for review. These files may contain personal information or confidential business information if included by the user.

Review results and metadata. Brand Compliance Score, review findings, page-level issue metadata, confidence levels, file name, upload date, the user who created the review, and processing status.

Billing information. When paid subscriptions are enabled, billing will be handled by our payment provider or merchant of record. We do not store full card numbers. We may receive subscription status, plan details, billing contact information, payment status and invoice metadata.

Technical and usage information. IP address, browser type, device information, pages visited, login events, upload events, error logs and security logs. We use this information to operate, secure and improve the Service.

We use information to:

• Provide the Service
• Create and manage accounts
• Create and manage Brand Blueprints
• Analyze uploaded assets
• Generate review results
• Display review history
• Provide customer support
• Send transactional emails
• Manage subscriptions and billing
• Monitor security
• Prevent fraud, abuse and unauthorized access
• Comply with legal obligations

We do not sell personal information. We do not use customer content for advertising.

Where applicable law requires a legal basis, we process personal information on one or more of the following bases:

• To perform our contract with you or your organization
• To operate and secure the Service
• To comply with legal obligations
• With your consent where required
• For legitimate interests, such as fraud prevention, service improvement, support and security

ChecksTrue uses automated systems, including AI models, to analyze uploaded assets against a customer’s Brand Blueprint. When a review is submitted, relevant uploaded assets and Brand Blueprint information may be sent to an AI provider for analysis. The AI provider processes the information only to return review findings to the Service.

Customer content is not used by ChecksTrue to train AI models. Where we use commercial AI APIs, we rely on provider terms that state API inputs and outputs are not used to train their general models unless separately opted in or otherwise agreed.

AI-generated review results may contain errors, omissions or inaccuracies. Users remain responsible for reviewing results before relying on them.

We do not use uploaded content for any purpose other than providing the Service to you. We count reviews, scans and storage per workspace to apply plan limits and billing, and the website uses Vercel’s cookieless page analytics and performance measurement, which record page views, visit counts and load times, not content. We do not run behavioural analytics on your files or results.

You retain all rights to the content you upload, including logos, brand guidelines, documents, graphics, presentations, marketing assets, fonts and related brand material. We do not acquire ownership of your uploaded assets, trademarks, logos, designs, documents or Brand Blueprints.

You grant us a limited license to host, process, analyze, display and transmit your content solely as necessary to provide the Service.

We treat uploaded customer materials as confidential. Access to customer content is limited to:

• Providing the Service
• Troubleshooting support issues
• Investigating security concerns
• Preventing abuse
• Complying with legal obligations
• Actions authorized by the customer

We do not manually review customer content unless necessary for support, security, abuse prevention or legal compliance.

In practice, your uploaded files and results can be reached by: the Service itself, which processes them automatically; the small number of named ChecksTrue operators who run and support the Service, each protected by two-factor authentication; and the service providers listed in section 9, each only for the purpose described there. When an operator needs to see your workspace to help you, they open a time-limited support session that is recorded in your workspace’s audit log, which is included in your data export. Error reports sent to our monitoring provider contain stack traces only, never your files or their contents.

We use third-party providers to operate the Service. Current or planned providers may include:

• Supabase — authentication, database and storage
• Anthropic — AI analysis
• Adobe (PDF Services) — PowerPoint file conversion. When you upload a .pptx file it is sent to Adobe to be converted to PDF before analysis; other file types are never sent to Adobe
• Resend — transactional email
• Paddle — billing and subscriptions (merchant of record)
• Vercel — application hosting
• Sentry — error reporting. Stack traces only; request bodies, cookies and headers are removed before anything leaves the platform

These providers process information only as needed to provide services to us. We may update our providers as the Service evolves; customers under our Data Processing Agreement receive 30 days’ notice of a change.

We are based in South Africa, but our users and service providers may be located globally. Your information may be processed in countries outside your country of residence, including countries that may not provide the same level of data protection. Where required, we rely on appropriate safeguards, including contractual commitments, data processing agreements and recognized transfer mechanisms.

Uploaded review asset files are retained according to your workspace retention settings. The default retention period is 90 days, unless configured differently. Review results, scores, findings and metadata may be retained for review history unless deleted by the user or workspace administrator.

If you delete your account, we will delete or anonymize personal information within a reasonable period, except where retention is required for legal obligations, billing records, security logs, fraud prevention, dispute resolution or backup retention.

A workspace owner can delete the whole workspace from the Account page. This removes uploaded files, converted copies, page previews, findings, reports, Brand Blueprints, team data and the logins of people who belong only to that workspace, immediately and without our involvement. Backup copies held by our infrastructure provider expire on their own schedule.

When you delete a review, or the retention period ends, the original uploaded file and any converted copy are removed from active storage. The review’s score, findings and page previews are kept as review history until you delete the workspace. Backup copies may persist for a limited period before automatic deletion.

We use reasonable technical and organizational measures to protect information, including:

• Encrypted connections
• Private storage buckets
• Signed access URLs where required
• Tenant isolation
• Row-level security
• Role-based access controls
• Restricted production access
• Server-side validation
• Audit logging
• Monitoring for abuse or unauthorized access

No system is perfectly secure. We cannot guarantee absolute security, but we take reasonable steps appropriate to the nature of the information processed. If we become aware of a security incident affecting personal information, we will take reasonable steps to investigate, contain and notify affected parties or regulators where required by law.

ChecksTrue is a multi-tenant SaaS application. Each customer workspace is logically separated. Users should only access data belonging to workspaces where they are authorized members.

If you believe you have accessed another customer’s information, or another customer has accessed yours, contact us immediately at support@checkstrue.com.

We use essential cookies and similar technologies to keep users signed in, secure sessions, prevent abuse and remember basic preferences. We do not currently use advertising or cross-site tracking cookies. If analytics or marketing cookies are added later, we will update this policy and provide any required consent controls.

Depending on your location, you may have rights to:

• Access personal information we hold about you
• Correct inaccurate information
• Delete information
• Object to certain processing
• Restrict processing
• Request data portability
• Withdraw consent where processing is based on consent

To exercise these rights, contact support@checkstrue.com. We may need to verify your identity before responding.

If you are in South Africa and are not satisfied with our response, you may contact the Information Regulator: inforegulator.org.za.

If GDPR or UK GDPR applies, you may have the right to lodge a complaint with your local data protection authority. You may also contact us first so we can try to resolve your concern.

Where applicable United States state privacy laws apply, you may have rights to access, delete, correct or receive a copy of certain personal information. We do not sell personal information. We do not share personal information for cross-context behavioral advertising. To submit a privacy request, contact support@checkstrue.com.

The Service is intended for business use and is not directed at children. We do not knowingly collect personal information from anyone under 18.

We may update this Privacy Policy as the Service evolves. If changes are material, we will notify account holders by email or in-app notice where appropriate. The updated version will always show the latest effective date.

For privacy questions, contact support@checkstrue.com.