# ExitProof Privacy Notice

Effective September 27, 2026.

ExitProof is operated by Davisville Labs LLC. This notice covers the public website, machine interfaces, paid specialist operations, durable Exit Manifests, billing-recovery state, and service telemetry.

## Information processed

ExitProof processes only the information needed to perform the requested operation. Depending on the operation, that may include a public target URL, caller-observed HTTP 402 payment-challenge metadata, structured cancellation or refund terms, stated deadlines or penalties, merchant or policy identifiers, operation and pricing identifiers, and technical delivery status.

ExitProof does not require a human account, inbox access, bank access, complete card number, private wallet key, raw prompt, or uploaded receipt. It never forwards a target merchant payment credential, cookie, authorization header, or arbitrary request body.

## Durable manifests and retention

A durable Exit Manifest stores the minimum normalized commitment, exit, deadline, evidence, and policy fields needed for later retrieval. Optional client-reference values are stored only as SHA-256 hashes. Manifest access tokens are shown once and stored only as hashes. The current manifest retention period is 400 days from creation. Each manifest carries its own expiresAt timestamp; after expiry it is no longer accessible, and expired manifest state is removed by bounded background cleanup. Retention may be shortened when required for security, legal, or operational reasons.

## Payments and analytics

Payment providers process payment credentials on their own rails. ExitProof retains bounded payment, replay, idempotency, and settled-delivery recovery state needed to prevent duplicate charging and recover paid delivery.

Davisville Labs may send privacy-minimized operational events to AI Agent Analytics. Those events are designed not to include merchant checkout terms, raw request bodies, manifest access tokens, target payment credentials, private keys, or buyer IP addresses.

## Service providers and disclosure

Davisville Labs uses infrastructure and payment providers to host, secure, route, and settle the service. We do not sell ExitProof user data. Information may be disclosed when required by law, to protect the service and its users, or to providers acting on our behalf.

## Choices, correction, and contact

To ask about retained ExitProof information, request correction or deletion where applicable, report a privacy concern, or question a billing record, contact hello@davisvillelabs.com. Some records may need to be retained for security, fraud prevention, accounting, dispute resolution, or other legal obligations.